From 58221daefeab51e7cbfeae3c7f8319d07d14172e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Dec 2024 11:58:22 +0200 Subject: [PATCH 001/191] added initiatl initiatives description --- docs/valint/initiatives.md | 173 +++++++++++++++++++++++++++++++++++++ 1 file changed, 173 insertions(+) create mode 100644 docs/valint/initiatives.md diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md new file mode 100644 index 000000000..586e7dd80 --- /dev/null +++ b/docs/valint/initiatives.md @@ -0,0 +1,173 @@ +--- +sidebar_label: "Adopting intiatives" +title: Adopting intiatives +author: viktor kartashov - Scribe +sidebar_position: 5 +date: December 10, 2024 +geometry: margin=2cm +--- + +## Initiatives + +### What is an initiative? + +Initiative is a representation of a supply chain security framework. It is a collection of controls, rules, and gates that define the security policy for a product or a set of products. Initiatives are versioned and can be adopted by multiple products. + +### Initiative config format + +```yaml +config-type: initiative +id: initiative-id +name: "Initiative name" +version: "1.0.0" +description: "Initiative description" +url: + +# optional set of params to override the existing evidence lookup params +# for each rule in the initiative +defaults: + evidence: + signed: true + +controls: + - name: "Control-1" + description: "Control description" + when: # optional filters + gate: "Build" # type of gate to run the control on + rules: + - name: "my-rule-1" + uses: sbom/blocklist-packages@v2/rules # reuse an existing rule from the bundle + with: + blocklist: + - "liblzma5@5.6.0" + - "liblzma5@5.6.1" + - "xz-utils@5.6.0" + - "xz-utils@5.6.1" + - name: "my-rule-2" + uses: sbom/banned-licenses@v2/rules + level: warning + with: + banned-licenses: + - "GPL-2.0" + - "GPL-3.0" + - name: "Control-2" + description: "Control description" + when: + gate: "Deploy" + rules: + - name: "my-rule-3" + uses: sbom/evidence-exists@v2/rules +``` + +Fields `id` and `name` are required. The `version` field is optional and can be used to easily track the changes in the initiative. +The `url` field is optional and can be used to provide a link to the documentation. + +`id` for the initiative/control/rule can be specified by the user, but they cannot contain forward slashes `/`. + +Each initiative can have one or more controls. Each control can have one or more rules. Rules can be reused from the existing rule in the bundle or defined inline. + +### How to adopt an initiative? + +An initiative is defined as a file that can be consumed locally or from a git bundle. To run the initiative from a local file, use the following command: + +```bash +valint verify --initiative initiative.yaml --product-key --product-version +``` + +To run an initiative from a git bundle, use the following command: + +```bash +valint verify --initiative my-initiative@v2/initiatives --product-key --product-version +``` + +To run a part of an initiative filtered by gate, use the following command: + +```bash +valint verify --initiative my-initiative@v2/initiatives --product-key --product-version --gate-type Build --gate-name "Build of My Product" +``` + +### Additional features + +#### Template arguments + +Rules can have template arguments that can be used to simplify the rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided in the runtime: + +```yaml + +... +with: + api_token: '{{ .Args.Token }}' + owner: '{{ .Args.Owner }}' + repo: '{{ .Args.Repo }}' + branch: '{{ .Args.Branch }} +... +``` + +To specify those, `valint` should be run with args `--rule-args Token=MyToken,Owner=MyOwner,Repo=MyRepo,Branch=MyBranch`. + +When required template arg is not specified, the rule will be disabled with a warning. + +##### Built-in functions + +To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of such functions is to disable filtering when the `--all-evidence` flag is used, see below. + +List of supported functions: + +* `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below +* `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name` +* `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used +* `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead + +#### Whole product evaluation + +One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: + +```bash +valint verify --initiative my-initiative@v2/initiatives --product-key --product-version --all-evidence +``` + +If template args are used within the initiative, they should be defined through built-in functions that disable filtering when the `--all-evidence` flag is used. For example, the following example filters evidence by label only when the `--all-evidence` flag is not used: + +```yaml +... +with: + defaults: + evidence: + labels: + - '{{ on_target .Args.MyLabel }}' +... +``` + +#### Rules that don't require evidence + +If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule config: + +```yaml +... +skip-evidence: true +... +``` + +#### Rules that require Scribe API + +If a rule requires an API call to be verified, it can use the `require-scribe-api` flag to ensure that all the uploaded attestations are processed and the API is ready to be used: + +```yaml +... +require-scribe-api: true +... +``` + +#### Rules that should fail on missing evidence + +By default, if no evidence for a rule found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used: + +```yaml +... +fail-on-missing-evidence: true +... +``` + +#### Unicode symbols in rule results + +To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. THis would result in replacing rule levels and results in `valint` logs with emojis. From fdccb250981500b32f355fe23c431773ae652dfa Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Dec 2024 13:27:42 +0200 Subject: [PATCH 002/191] fix --- docs/valint/help/valint_diff.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/valint/help/valint_diff.md b/docs/valint/help/valint_diff.md index d6cfb9900..17c204504 100644 --- a/docs/valint/help/valint_diff.md +++ b/docs/valint/help/valint_diff.md @@ -2,13 +2,13 @@ Compare differences between source and destination sboms -``` +```bash valint diff [SOURCE_SBOM] [DESTINATION_SBOM] [flags] ``` ### Examples for running `valint diff` -``` +```bash valint diff valint diff --integrity validated,modified valint diff --package npm,deb @@ -22,7 +22,8 @@ valint diff [SOURCE_SBOM] [DESTINATION_SBOM] [flags] ``` -### Options flags +### Options flags + specific flags for command | Short | Long | Description | Default | @@ -37,8 +38,8 @@ specific flags for command | | --regex-src | Select diff scope regex source paths | | | | --synopsis | Enable synopsis | true | - ### Global options flags + global flag for all commands @@ -49,7 +50,7 @@ global flag for all commands | -C | --context-type | CI context type, options=[jenkins github circleci local gitlab] | "local" | | -L | --label | Add Custom labels | | | -D | --level | Log depth level, options=[panic fatal error warning info debug trace] | | -| -d | --output-directory | Output directory path | "${XDG_CACHE_HOME}/valint" | +| -d | --output-directory | Output directory path | "$\{XDG_CACHE_HOME\}/valint" | | -O | --output-file | Output file name | | | -n | --product-key | Scribe Project Key | | | -q | --quiet | Suppress all logging output | | @@ -59,7 +60,6 @@ global flag for all commands | -u | --scribe.url | Scribe API Url | "https://airflow.scribesecurity.com" | | -v | --verbose | Log verbosity level (-v = info, -vv = debug) | | - ### SEE ALSO -* [valint](valint.md) - supply chain integrity tool +* [valint](valint.md) - supply chain integrity tool From e11b6e24d78f122b05e8ffd65a57736a6cba3e89 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Dec 2024 14:32:26 +0200 Subject: [PATCH 003/191] updated initiative description --- docs/valint/initiatives.md | 144 ++++++++++++++++++++++++++++++------- 1 file changed, 117 insertions(+), 27 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 586e7dd80..f1b43af59 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -11,32 +11,85 @@ geometry: margin=2cm ### What is an initiative? -Initiative is a representation of a supply chain security framework. It is a collection of controls, rules, and gates that define the security policy for a product or a set of products. Initiatives are versioned and can be adopted by multiple products. +Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` that your supply chain must comply with. The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluatoin results and references to the verified assets and evidences. + +An initiative consists of a set of `controls`, each of which in turn consists of a set of `rules` and is verified if all of them are evaluated and verified. +A `rule` is verified if ANY `evidence` is found that complies with the `rule` configuration and setting. + +Rules can be reused from the existing rule in the bundle or defined inline. ### Initiative config format ```yaml config-type: initiative -id: initiative-id -name: "Initiative name" -version: "1.0.0" -description: "Initiative description" +id: +name: +version: +description: url: # optional set of params to override the existing evidence lookup params # for each rule in the initiative defaults: - evidence: - signed: true + labels: [] + evidence: + signed: false + content_body_type: content_body_type> + filter-by: [] + +env: # File-wise environment variables for the template engine (see below) + : controls: - - name: "Control-1" - description: "Control description" + - name: + id: # if no ID is provided, the ID is generated from the name + description: when: # optional filters - gate: "Build" # type of gate to run the control on + gate: # type of gate to run the control on + rules: + - name: + id: # if no ID is provided, the ID is generated from the name + path: # specify if a custom external script is used + uses: # reuse an existing rule from the bundle + description: + aggregate-results: false # Aggregate all of the rule violations to a single SARIF result + labels: [] # list of user-specified labels + evidence: #Evidence lookup parameters + signed: true | false + content_body_type: + filter-by: [] # A group of Context fields to use for the evidence lookup + with: {} # rule input, depending on the rule type +``` + +> Fields `id` and `name` are required. The `version` field is optional and can be used to easily track the changes in the initiative. +> +> The `url` field is optional and can be used to provide a link to the documentation. +> +> `id` for the initiative/control/rule can be specified by the user, but they cannot contain forward slashes `/`. + +> For configuration details, see the [configuration](./configuration.md) section. +> +> For PKI configuration, see the [attestations](https://scribe-security.netlify.app/docs/valint/attestations) section. + +An example of an initiative could be: + +```yaml +config-type: initiative +id: my-initiative +name: "My Initiative" +version: "v1.0.0" +description: "This initiative enforces a couple of simple checks on a Docker image" + +defaults: + evidence: + signed: true + +controls: + - name: "My Control" + when: + gate: "Build" rules: - - name: "my-rule-1" - uses: sbom/blocklist-packages@v2/rules # reuse an existing rule from the bundle + uses: sbom/blocklist-packages@v2/rules with: blocklist: - "liblzma5@5.6.0" @@ -51,41 +104,78 @@ controls: - "GPL-2.0" - "GPL-3.0" - name: "Control-2" - description: "Control description" - when: - gate: "Deploy" - rules: - - name: "my-rule-3" - uses: sbom/evidence-exists@v2/rules + when: + gate: "Deploy" + rules: + - name: "my-rule-3" + uses: sbom/evidence-exists@v2/rules ``` -Fields `id` and `name` are required. The `version` field is optional and can be used to easily track the changes in the initiative. -The `url` field is optional and can be used to provide a link to the documentation. +More examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). -`id` for the initiative/control/rule can be specified by the user, but they cannot contain forward slashes `/`. +### How to adopt an initiative? -Each initiative can have one or more controls. Each control can have one or more rules. Rules can be reused from the existing rule in the bundle or defined inline. +An initiative is defined as a file that can be consumed locally or from a git bundle. To run the initiative from a local file, first one needs to create the required evidences: -### How to adopt an initiative? +1. Generate an SBOM +```bash +valint bom : --product-key --product-version -P +``` -An initiative is defined as a file that can be consumed locally or from a git bundle. To run the initiative from a local file, use the following command: +2. Generate SLSA Provenance +```bash +valint slsa : --product-key --product-version -P +``` + +3. Create generic evidences from 3rd party tool reports: +```bash +valint evidence --product-key --product-version -P +``` +------------------- +Then, the initiative can be run with the following command: ```bash -valint verify --initiative initiative.yaml --product-key --product-version +valint verify --initiative initiative.yaml --product-key --product-version -P ``` To run an initiative from a git bundle, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives --product-key --product-version +valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P ``` To run a part of an initiative filtered by gate, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives --product-key --product-version --gate-type Build --gate-name "Build of My Product" +valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P --gate-type Build --gate-name "Build of My Product" +``` + +### Using private bundle + +Rules and initiatives can be provided locally, reused from the public Scribe bundle or from a private bundle. To use a private bundle, the following rules should be followed: + +1. The private bundle should be a git repository referenced in `valint` command with the `--bundle` flag, for example: + +```bash +valint verify ... --bundle https://github.com/scribe-public/sample-policies ... +``` + +2. If git authentication is required, it can be provided either in the git url or through the `--bundle-auth` flag. + +3. A specific branch, tag or commit can be specified with the `--bundle-branch`, `--bundle-tag` or `--bundle-commit` flags respectively. + +4. File structure within the bundle is up to the administrator, but when referencing the rules in initiative configs, the path should be relative to the bundle root and at least one level deep, for example: + +```yaml +... +rules: + - uses: sbom/blocklist-packages@v2/rules +... ``` +means that the rule path within the bundle is `v2/rules/sbom/blocklist-packages.yaml`. +Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag. + ### Additional features #### Template arguments From b603b193f81e19ea40df90c73b207fba6604fd07 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Dec 2024 15:00:46 +0200 Subject: [PATCH 004/191] fix --- docs/valint/initiatives.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index f1b43af59..848af7d1a 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -176,6 +176,11 @@ rules: means that the rule path within the bundle is `v2/rules/sbom/blocklist-packages.yaml`. Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag. +### Rule configuration + +Rules are defined as a combination of a `.yaml` configuration file and a `.rego` script. The `.yaml` file contains the rule configuration, while the `.rego` script contains the rule logic. +The rule configuration is described above along with the initiative configuration. The rego script + ### Additional features #### Template arguments @@ -189,7 +194,7 @@ with: api_token: '{{ .Args.Token }}' owner: '{{ .Args.Owner }}' repo: '{{ .Args.Repo }}' - branch: '{{ .Args.Branch }} + branch: '{{ .Args.Branch }}' ... ``` From 35e26193422486abfe2bdad09d57aca19a101d40 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 16 Dec 2024 17:23:32 +0200 Subject: [PATCH 005/191] update initiative docs --- docs/valint/initiatives.md | 66 +++++++++++++++++++++++++++++++------- 1 file changed, 54 insertions(+), 12 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 848af7d1a..72c586ac3 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -16,12 +16,13 @@ Each `initiative` proposes to enforce a set of requirements (aka `rules`) groupe An initiative consists of a set of `controls`, each of which in turn consists of a set of `rules` and is verified if all of them are evaluated and verified. A `rule` is verified if ANY `evidence` is found that complies with the `rule` configuration and setting. -Rules can be reused from the existing rule in the bundle or defined inline. +Rules can reuse from the existing ones from a bundle or be defined inline. ### Initiative config format ```yaml config-type: initiative +required-valint-version: "2.0.0" # minimum valint version required to run the initiative id: name: version: @@ -61,11 +62,11 @@ controls: with: {} # rule input, depending on the rule type ``` -> Fields `id` and `name` are required. The `version` field is optional and can be used to easily track the changes in the initiative. +> The `id` and `name` fields are required. The `version` field is optional and can be used to easily track the changes in the initiative. > > The `url` field is optional and can be used to provide a link to the documentation. > -> `id` for the initiative/control/rule can be specified by the user, but they cannot contain forward slashes `/`. +> The `id` of an initiative, control or rule cannot contain forward slashes `/`. > For configuration details, see the [configuration](./configuration.md) section. > @@ -75,6 +76,7 @@ An example of an initiative could be: ```yaml config-type: initiative +required-valint-version: "2.0.0" id: my-initiative name: "My Initiative" version: "v1.0.0" @@ -100,6 +102,9 @@ controls: uses: sbom/banned-licenses@v2/rules level: warning with: + identity: + emails: + - my@email.com banned-licenses: - "GPL-2.0" - "GPL-3.0" @@ -115,24 +120,28 @@ More examples of rules and initiatives can be found in the [sample-policies bund ### How to adopt an initiative? -An initiative is defined as a file that can be consumed locally or from a git bundle. To run the initiative from a local file, first one needs to create the required evidences: +An initiative is defined as a file that can be consumed locally or from a git bundle. To run an initiative, one first needs to create the required evidences: 1. Generate an SBOM + ```bash valint bom : --product-key --product-version -P ``` 2. Generate SLSA Provenance + ```bash valint slsa : --product-key --product-version -P ``` 3. Create generic evidences from 3rd party tool reports: + ```bash valint evidence --product-key --product-version -P ``` + ------------------- -Then, the initiative can be run with the following command: +Then, a local initiative can be run with the following command: ```bash valint verify --initiative initiative.yaml --product-key --product-version -P @@ -144,7 +153,7 @@ To run an initiative from a git bundle, use the following command: valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P ``` -To run a part of an initiative filtered by gate, use the following command: +To run a part of an initiative filtered by gate type, use the following command: ```bash valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P --gate-type Build --gate-name "Build of My Product" @@ -152,7 +161,8 @@ valint verify --initiative my-initiative@v2/initiatives --product-key Date: Wed, 18 Dec 2024 10:51:22 +0200 Subject: [PATCH 006/191] added filter-by description to the initiatives --- docs/valint/initiatives.md | 69 +++++++++++++++++++++++++++++++++----- 1 file changed, 60 insertions(+), 9 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 72c586ac3..3cc78c13b 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -166,9 +166,9 @@ To use a private bundle instead, the following rules should be followed: 1. The private bundle should be a git repository referenced in `valint` command with the `--bundle` flag, for example: -```bash -valint verify ... --bundle https://github.com/scribe-public/sample-policies ... -``` + ```bash + valint verify ... --bundle https://github.com/scribe-public/sample-policies ... + ``` 2. If git authentication is required, it can be provided either in the git url or through the `--bundle-auth` flag. @@ -177,12 +177,12 @@ valint verify ... --bundle https://github.com/scribe-public/sample-policies ... 4. File structure within the bundle is up to the administrator, but when referencing the rules in initiative configs, the path should be relative to the bundle root and at least one level deep. For example, this is how to reference a rule from the public Scribe bundle: -```yaml -... -rules: - - uses: sbom/blocklist-packages@v2/rules -... -``` + ```yaml + ... + rules: + - uses: sbom/blocklist-packages@v2/rules + ... + ``` Here `sbom/blocklist-packages@v2/rules` means that the rule path within the bundle is`v2/rules/sbom/blocklist-packages.yaml`. Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag. @@ -225,6 +225,57 @@ asset := scribe.get_asset_data(input.evidence) ### Advanced features +#### Evidence Lookup + +In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. +These parameters can be set manually by the user or automatically derived from the context. +Parameters that can be derived automatically are categorized into three context groups: "target," "pipeline", and "product". +By default, the "target" and "product" groups are enabled for each rule. + +1. `target` context group specifies parameters that can be derived from the provided target. Those parameters are: + * `target_type` - the type of the target provided (e.g., image, git, generic etc.) + * `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) + + > If no target is provided, the rule is disabled with a warning. + +2. `pipeline` context group specifies parameters that can be derived from the running environment. Those parameters are: + * `context_type` - type of the environment (e.g., local, github, etc.) + * `git_url` - git url of the repository (if any) + * `git_commit` - git commit of the current repository state (if any) + * `run_id` - run id + * `build_num` - build number + +3. `product` context group specifies product parameters that can be derived from the command line arguments. Those parameters are: + * `name` - name of the product + * `product_version` - version of the product + * `predicate_type` - type of the predicate (e.g., , , etc.) + +User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. +By default `target` and `product` groups are used. +The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. + +In addition, one can manually specify any parameters that they want to be matched by an evidence. For example, these can be `git_url` or `timestamp`. + +If more than one evidence is found, the newest one is used. + +
+ Usage + +An example of using the `target` context group and a specific timestamp value is shown below: + +```yaml +config-type: rule +name: my_rule +evidence: + signed: true + content_body_type: cyclonedx + timestamp: "2023-11-16T09:46:25+02:00" # manually specified timestamp + filter-by: + - target +``` + +
+ #### Template arguments Rules can have template arguments that can be used to simplify the rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided in the runtime: From 81926609c195d0185f975ae96270a75c8b34c004 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 18 Dec 2024 15:08:01 +0200 Subject: [PATCH 007/191] fix --- docs/valint/initiatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 3cc78c13b..21177e67d 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -248,7 +248,7 @@ By default, the "target" and "product" groups are enabled for each rule. 3. `product` context group specifies product parameters that can be derived from the command line arguments. Those parameters are: * `name` - name of the product * `product_version` - version of the product - * `predicate_type` - type of the predicate (e.g., , , etc.) + * `predicate_type` - type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. By default `target` and `product` groups are used. From 4ed95eab81abb944ad69e9825fb9c499776b30f2 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:13:17 +0200 Subject: [PATCH 008/191] added field descriptions --- docs/valint/initiatives.md | 243 +++++++++++++++++++++++++++++++++---- 1 file changed, 219 insertions(+), 24 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 21177e67d..2249b0c67 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -22,55 +22,154 @@ Rules can reuse from the existing ones from a bundle or be defined inline. ```yaml config-type: initiative -required-valint-version: "2.0.0" # minimum valint version required to run the initiative +required-valint-version: "2.0.0" id: name: version: description: url: -# optional set of params to override the existing evidence lookup params -# for each rule in the initiative defaults: - labels: [] evidence: signed: false content_body_type: content_body_type> filter-by: [] -env: # File-wise environment variables for the template engine (see below) +env: : controls: - name: - id: # if no ID is provided, the ID is generated from the name + id: description: - when: # optional filters - gate: # type of gate to run the control on + when: + gate: rules: - name: - id: # if no ID is provided, the ID is generated from the name - path: # specify if a custom external script is used - uses: # reuse an existing rule from the bundle + id: + path: + uses: description: - aggregate-results: false # Aggregate all of the rule violations to a single SARIF result - labels: [] # list of user-specified labels - evidence: #Evidence lookup parameters + aggregate-results: false + labels: [] + evidence: signed: true | false content_body_type: - filter-by: [] # A group of Context fields to use for the evidence lookup - with: {} # rule input, depending on the rule type + filter-by: [] + with: {} ``` -> The `id` and `name` fields are required. The `version` field is optional and can be used to easily track the changes in the initiative. -> -> The `url` field is optional and can be used to provide a link to the documentation. -> -> The `id` of an initiative, control or rule cannot contain forward slashes `/`. +#### `config-type` + +- **Type:** String +- **Required:** Yes +- **Description:** Specifies the type of configuration. For initiatives, this should be set to `initiative`. + +#### `required-valint-version` + +- **Type:** String +- **Required:** No +- **Description:** The minimum version of Valint required to run the initiative. +- **Example:** `"2.0.0"` + +#### `id` + +- **Type:** String +- **Required:** No +- **Description:** A unique identifier for the initiative. Cannot contain the `::` symbol. If no ID is provided, it is generated from the name. + +#### `name` + +- **Type:** String +- **Required:** Yes +- **Description:** The name of the initiative. + +#### `version` + +- **Type:** String +- **Required:** No +- **Description:** The version of the initiative. + +#### `description` + +- **Type:** String +- **Required:** No +- **Description:** A brief description of the initiative. + +#### `url` + +- **Type:** String (URL) +- **Required:** No +- **Description:** A URL pointing to the help or documentation for the initiative. + +#### `defaults` + +- **Type:** Object +- **Required:** No +- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. + +##### `defaults.level` + +- **Type:** String +- **Required:** No +- **Description:** Rule level to use for all rules in the initiative + +##### `defaults.evidence` + +- **Type:** Object +- **Required:** No +- **Description:** Evidence lookup parameters. Any parameters supported by the `rule.evidence` field can be used here. + +#### `env` + +- **Type:** Object +- **Required:** No +- **Description:** File-wise environment variables for the template engine. + +#### `controls` + +- **Type:** Array of Objects +- **Required:** Yes +- **Description:** A list of controls for the initiative. + +##### `controls[].name` + +- **Type:** String +- **Required:** Yes +- **Description:** The name of the control. + +##### `controls[].id` + +- **Type:** String +- **Required:** No +- **Description:** A unique identifier for the control. Cannot contain the `::` symbol. If no ID is provided, it is generated from the name. + +##### `controls[].description` + +- **Type:** String +- **Required:** No +- **Description:** A brief description of the control. + +##### `controls[].when` + +- **Type:** Object +- **Required:** No +- **Description:** Optional filters for when the control should be run. + +###### `controls[].when.gate` + +- **Type:** String +- **Required:** No +- **Description:** The type of gate to run the control on. + +##### `controls[].rules` -> For configuration details, see the [configuration](./configuration.md) section. +- **Type:** Array of Objects +- **Description:** A list of rules for the control. For the details, see the `rules` section below. + +> For `valint` configuration details, see the [configuration](./configuration.md) section. > -> For PKI configuration, see the [attestations](https://scribe-security.netlify.app/docs/valint/attestations) section. +> For PKI configuration, see the [attestations](./attestations.md) section. An example of an initiative could be: @@ -116,7 +215,103 @@ controls: uses: sbom/evidence-exists@v2/rules ``` -More examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). +### Rule config format + +Every rule that is used separately via the `--rule` arg or as part of an initiative should be defined as YAML: + +```yaml +config-type: rule +required-valint-version: "2.0.0" +id: +name: +path: + +description: + +labels: [] + +require-scribe-api: +fail-on-missing-evidence: + +evidence: {} + +with: {} +``` + +#### `config-type` + +- **Type:** String +- **Required:** Yes +- **Description:** Specifies the type of configuration. For rules, this should be set to `rule`. + +#### `required-valint-version` + +- **Type:** String +- **Required:** No +- **Description:** The minimum version of Valint required to run the initiative. +- **Example:** `"2.0.0"` + +#### `id` + +- **Type:** String +- **Required:** No +- **Description:** A unique identifier for the rule. Cannot contain the `::` symbol. Must be unique within the initiative. If no ID is provided, it is generated from the name. + +#### `name` + +- **Type:** String +- **Required:** Yes +- **Description:** The name of the rule. This should be unique within the initiative. + +#### `path` + +- **Type:** String +- **Required:** No +- **Description:** The path to a custom external script, if used. Should be relative to the rule file. + +#### `description` + +- **Type:** String +- **Required:** No +- **Description:** A brief description of the rule. + +#### `labels` + +- **Type:** Array of Strings +- **Required:** No +- **Description:** A list of user-specified labels for the rule itself. + +#### `require-scribe-api` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the Scribe API is required. + +#### `fail-on-missing-evidence` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the open result if no evidence is found. + +#### `evidence` + +- **Type:** Object +- **Required:** No +- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. + +##### `evidence.filter-by` + +- **Type:** List of Strings +- **Required:** No +- **Description:** A list of parameters in the environment to filter the evidence by. If the value `target` is used, the rule will require a target (otherwise, it will be disabled with a warning) and use the target parameters for evidence lookup. If the value `pipeline` is used, the rule will use the pipeline parameters for evidence lookup. If the value `none` is used, the rule will not filter the evidence by any parameters except for the product ones. + +#### `with` + +- **Type:** Object +- **Required:** No +- **Description:** Rule input, depending on the rule script. + +Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). ### How to adopt an initiative? From 5d16724a3b392e15c3f35f56ce60e4edabf490bb Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:25:21 +0200 Subject: [PATCH 009/191] tried to fix docosaurus module versions --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 9e6aea010..0224c1071 100644 --- a/package.json +++ b/package.json @@ -16,8 +16,8 @@ }, "dependencies": { "@docusaurus/core": "3.5.2", - "@docusaurus/plugin-client-redirects": "^3.5.2", - "@docusaurus/plugin-sitemap": "^3.5.2", + "@docusaurus/plugin-client-redirects": "3.5.2", + "@docusaurus/plugin-sitemap": "3.5.2", "@docusaurus/preset-classic": "3.5.2", "@mdx-js/react": "^3.0.0", "classnames": "^2.3.0", From 6e291f7b92c378bf7f3d930bf6402a593bedb841 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:37:06 +0200 Subject: [PATCH 010/191] limit toc max level --- docs/valint/initiatives.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 2249b0c67..fc2f7af2c 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -5,6 +5,7 @@ author: viktor kartashov - Scribe sidebar_position: 5 date: December 10, 2024 geometry: margin=2cm +toc_max_heading_level: 3 --- ## Initiatives From a489288ac4f9acd2c4161fd7b2dc8bc121f0a7d9 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:44:17 +0200 Subject: [PATCH 011/191] adjusted markdown levels --- docs/valint/initiatives.md | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index fc2f7af2c..b64d1551e 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -5,12 +5,10 @@ author: viktor kartashov - Scribe sidebar_position: 5 date: December 10, 2024 geometry: margin=2cm -toc_max_heading_level: 3 +toc_max_heading_level: 4 --- -## Initiatives - -### What is an initiative? +## What is an initiative? Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` that your supply chain must comply with. The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluatoin results and references to the verified assets and evidences. @@ -19,7 +17,7 @@ A `rule` is verified if ANY `evidence` is found that complies with the `rule` co Rules can reuse from the existing ones from a bundle or be defined inline. -### Initiative config format +## Initiative config format ```yaml config-type: initiative @@ -60,6 +58,8 @@ controls: with: {} ``` +### Initiative configuration fields + #### `config-type` - **Type:** String @@ -216,7 +216,7 @@ controls: uses: sbom/evidence-exists@v2/rules ``` -### Rule config format +## Rule config format Every rule that is used separately via the `--rule` arg or as part of an initiative should be defined as YAML: @@ -239,6 +239,8 @@ evidence: {} with: {} ``` +### Rule configuration fields + #### `config-type` - **Type:** String @@ -314,7 +316,7 @@ with: {} Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). -### How to adopt an initiative? +## How to adopt an initiative? An initiative is defined as a file that can be consumed locally or from a git bundle. To run an initiative, one first needs to create the required evidences: @@ -355,7 +357,7 @@ To run a part of an initiative filtered by gate type, use the following command: valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P --gate-type Build --gate-name "Build of My Product" ``` -### Using private bundle +## Using private bundle Rules and initiatives can be provided locally or reused either from the public Scribe bundle or a private bundle managed by the user. By default, the public Scribe bundle is used. To use a private bundle instead, the following rules should be followed: @@ -383,7 +385,7 @@ For example, this is how to reference a rule from the public Scribe bundle: Here `sbom/blocklist-packages@v2/rules` means that the rule path within the bundle is`v2/rules/sbom/blocklist-packages.yaml`. Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag. -### Rule configuration +## Rule configuration Rules are defined as a combination of a `.yaml` configuration file and a `.rego` script. The `.yaml` file contains the rule configuration, while the `.rego` script contains the rule logic. The rule configuration is described above along with the initiative configuration. @@ -419,9 +421,9 @@ default asset = {} asset := scribe.get_asset_data(input.evidence) ``` -### Advanced features +## Advanced features -#### Evidence Lookup +### Evidence Lookup In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. These parameters can be set manually by the user or automatically derived from the context. @@ -472,7 +474,7 @@ evidence: -#### Template arguments +### Template arguments Rules can have template arguments that can be used to simplify the rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided in the runtime: @@ -491,7 +493,7 @@ To specify those, `valint` should be run with args `--rule-args Token=MyToken,Ow When required template arg is not specified, the rule will be disabled with a warning. -##### Built-in functions +#### Built-in functions To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of such functions is to disable filtering when the `--all-evidence` flag is used, see below. @@ -502,7 +504,7 @@ List of supported functions: * `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used * `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead -#### Whole product evaluation +### Whole product evaluation One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: @@ -522,7 +524,7 @@ with: ... ``` -#### Rules that don't require evidence +### Rules that don't require evidence If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule config: @@ -532,7 +534,7 @@ skip-evidence: true ... ``` -#### Rules that require Scribe API +### Rules that require Scribe API If a rule requires an API call to be verified, it can use the `require-scribe-api` flag to ensure that all the uploaded attestations are processed and the API is ready to be used: @@ -542,7 +544,7 @@ require-scribe-api: true ... ``` -#### Rules that should fail on missing evidence +### Rules that should fail on missing evidence By default, if no evidence for a rule found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used: @@ -552,6 +554,6 @@ fail-on-missing-evidence: true ... ``` -#### Unicode symbols in rule results +### Unicode symbols in rule results To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. THis would result in replacing rule levels and results in `valint` logs with emojis. From 7c60dfad69be4fed36f1e05d90dfcbfdc969eb37 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:46:00 +0200 Subject: [PATCH 012/191] limit toc max level --- docs/valint/initiatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index b64d1551e..04a09f894 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -5,7 +5,7 @@ author: viktor kartashov - Scribe sidebar_position: 5 date: December 10, 2024 geometry: margin=2cm -toc_max_heading_level: 4 +toc_max_heading_level: 3 --- ## What is an initiative? From 53ff7a600d6022152612b6ebf350c0ddbd163f22 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 27 Jan 2025 17:54:22 +0200 Subject: [PATCH 013/191] small updates --- docs/valint/initiatives.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 04a09f894..8a7bbd868 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -233,6 +233,7 @@ labels: [] require-scribe-api: fail-on-missing-evidence: +skip-evidence: evidence: {} @@ -296,6 +297,12 @@ with: {} - **Required:** No - **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the open result if no evidence is found. +#### `skip-evidence` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the rule should skip evidence downloading and go straight to the rule evaluation. Can be helpful for rules that don't require evidence, like API rules. + #### `evidence` - **Type:** Object @@ -306,7 +313,7 @@ with: {} - **Type:** List of Strings - **Required:** No -- **Description:** A list of parameters in the environment to filter the evidence by. If the value `target` is used, the rule will require a target (otherwise, it will be disabled with a warning) and use the target parameters for evidence lookup. If the value `pipeline` is used, the rule will use the pipeline parameters for evidence lookup. If the value `none` is used, the rule will not filter the evidence by any parameters except for the product ones. +- **Description:** A list of parameters in the environment to filter the evidence by (see [Evidence Lookup](#evidence-lookup)). #### `with` @@ -434,7 +441,7 @@ By default, the "target" and "product" groups are enabled for each rule. * `target_type` - the type of the target provided (e.g., image, git, generic etc.) * `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) - > If no target is provided, the rule is disabled with a warning. + > If this parameter is set and no target provided, the rule is disabled with a warning. 2. `pipeline` context group specifies parameters that can be derived from the running environment. Those parameters are: * `context_type` - type of the environment (e.g., local, github, etc.) From ed0d6be23d40f066b013b838b9c671fb57cad2c3 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 28 Jan 2025 10:30:51 +0200 Subject: [PATCH 014/191] missing rule fields --- docs/valint/initiatives.md | 66 +++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 18 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 8a7bbd868..3cd08ac99 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -26,11 +26,11 @@ id: name: version: description: -url: +help: defaults: evidence: - signed: false + signed: content_body_type: content_body_type> filter-by: [] @@ -41,21 +41,10 @@ controls: - name: id: description: + disable: when: gate: - rules: - - name: - id: - path: - uses: - description: - aggregate-results: false - labels: [] - evidence: - signed: true | false - content_body_type: - filter-by: [] - with: {} + rules: [] ``` ### Initiative configuration fields @@ -97,7 +86,7 @@ controls: - **Required:** No - **Description:** A brief description of the initiative. -#### `url` +#### `help` - **Type:** String (URL) - **Required:** No @@ -151,6 +140,12 @@ controls: - **Required:** No - **Description:** A brief description of the control. +##### `controls[].disable` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the control should be disabled. If set to `true`, the control will not be evaluated. + ##### `controls[].when` - **Type:** Object @@ -166,7 +161,7 @@ controls: ##### `controls[].rules` - **Type:** Array of Objects -- **Description:** A list of rules for the control. For the details, see the `rules` section below. +- **Description:** A list of rules for the control. For the details, see the [Rules](#rule-config-format) section below. > For `valint` configuration details, see the [configuration](./configuration.md) section. > @@ -223,17 +218,22 @@ Every rule that is used separately via the `--rule` arg or as part of an initiat ```yaml config-type: rule required-valint-version: "2.0.0" +disable: id: name: path: - +uses: description: +help: labels: [] +level: + require-scribe-api: fail-on-missing-evidence: skip-evidence: +aggregate-results: evidence: {} @@ -255,6 +255,12 @@ with: {} - **Description:** The minimum version of Valint required to run the initiative. - **Example:** `"2.0.0"` +#### `disable` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the rule should be disabled. If set to `true`, the rule will not be evaluated. + #### `id` - **Type:** String @@ -273,18 +279,36 @@ with: {} - **Required:** No - **Description:** The path to a custom external script, if used. Should be relative to the rule file. +#### `uses` + +- **Type:** String +- **Required:** No +- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@/rules`. + #### `description` - **Type:** String - **Required:** No - **Description:** A brief description of the rule. +#### `help` + +- **Type:** String (URL) +- **Required:** No +- **Description:** A URL pointing to the help or documentation for the rule. + #### `labels` - **Type:** Array of Strings - **Required:** No - **Description:** A list of user-specified labels for the rule itself. +#### `level` + +- **Type:** String +- **Required:** No +- **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. + #### `require-scribe-api` - **Type:** Boolean @@ -303,6 +327,12 @@ with: {} - **Required:** No - **Description:** Indicates whether the rule should skip evidence downloading and go straight to the rule evaluation. Can be helpful for rules that don't require evidence, like API rules. +#### `aggregate-results` + +- **Type:** Boolean +- **Required:** No +- **Description:** Indicates whether the rule results should be aggregated. If set to `true`, the rule will return a single result for all the violations found. + #### `evidence` - **Type:** Object From 76e86a108d2eb48d63f323ba7a2c814b5b06d2b7 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 28 Jan 2025 15:12:13 +0200 Subject: [PATCH 015/191] updated policy catalog ref to v2 --- docs/guides/enforcing-sdlc-policy.md | 320 +++++++----------- .../gatekeeper-provider.md | 14 +- 2 files changed, 131 insertions(+), 203 deletions(-) diff --git a/docs/guides/enforcing-sdlc-policy.md b/docs/guides/enforcing-sdlc-policy.md index 3c625141d..c0603fa83 100644 --- a/docs/guides/enforcing-sdlc-policy.md +++ b/docs/guides/enforcing-sdlc-policy.md @@ -18,7 +18,7 @@ For the detailed policy description, see **[policies](../valint/policies)** sect ## Sample Rule Bundle -The following is a description of a sample rule bundle (*please note that the feature is in early availability*) that can be used to build a policy for your SDLC. +The following is a description of a sample rule bundle that can be used to build a policy for your SDLC. ## Quickstart @@ -35,24 +35,26 @@ The following is a description of a sample rule bundle (*please note that the fe ``` Additional options: - * To explore other evidence types, use commands like `valint slsa` or `valint evidence`. - * Specify `-o attest` for signed evidence. + - To explore other evidence types, use commands `valint slsa` or `valint evidence`. + - Specify `-o attest` for signed evidence. -3. Verify the SBOM against a policy. The current catalogue will be used as a default bundle for `valint`. +3. Verify the SBOM against a rule. The current catalogue will be used as a default bundle for `valint`. ```bash - valint verify busybox:latest --rule sboms/complete-licenses@v1 # path within a repo + valint verify busybox:latest --rule sbom/complete-licenses@v2/rules # path within a repo ``` - If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--git-tag` flag for `valint`: + If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--bundle-tag` flag for `valint`: ```bash - valint verify busybox:latest --git-tag v1.0.0 --rule sboms/complete-licenses@v1 + valint verify busybox:latest --bundle-tag v2.0.0 --rule sbom/complete-licenses@v2/rules ``` + > By default, `valint` uses the version of the catalog matching the version of the `valint` binary. + ### Targetless Run - All of the policy rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based on the product name and version. To do so, first create an SBOM providing these values: + Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based on the product name and version and options specified in the rule config. To try this out, first create an SBOM providing these values: ```bash valint bom busybox:latest -o statement --product-name busybox --product-version v1.36.1 @@ -61,7 +63,7 @@ The following is a description of a sample rule bundle (*please note that the fe Then, run ```bash - valint verify --rule sboms/complete-licenses@v1 --product-name busybox --product-version v1.36.1 + valint verify --rule sbom/complete-licenses@v2/rules --product-name busybox --product-version v1.36.1 ``` Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. @@ -74,50 +76,40 @@ In order to run a rule, its script file should be referred by a rule config. Eac If you fork this ruleset or create your own, in order to use it you need to specify its location in `valint` flag `--bundle` either in cmd args or a `valint.yaml` config file: ```bash -valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sboms/complete-licenses@v1 +valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sbom/complete-licenses@v2/rules ``` ## Policy Rule Catalogue | Rule | Description | Additional Info | | --- | --- | --- | -| [Forbid Unsigned Artifacts](#forbid-unsigned-artifacts) | Verify the artifact's authenticity and signer identity. | [SBOM](#sboms) | -| [Blocklist Packages](#blocklist-packages) | Prevent risky packages in the artifact. | [SBOM](#sboms) | -| [Required Packages](#required-packages) | Ensure mandatory packages/files in the artifact. | [SBOM](#sboms) | -| [Banned Licenses](#banned-licenses) | Restrict inclusion of certain licenses in the artifact. | [SBOM](#sboms) | -| [Complete Licenses](#complete-licenses) | Guarantee all packages have valid licenses. | [SBOM](#sboms) | -| [Fresh Artifact](#fresh-artifact) | Verify an artifact's freshness. | [SBOM](#sboms) | -| [Fresh Image](#fresh-image) | Ensure an image freshness. | [Image SBOM](#images) | -| [Restrict Shell Image Entrypoint](#restrict-shell-image-entrypoint) | Prevent shell as image entrypoint. | [SBOM](#sboms) | -| [Blocklist Image Build Scripts](#blocklist-image-build-scripts) | Restrict build scripts in image build. | [Image SBOM](#images) | -| [Verify Image Lables/Annotations](#verify-image-lablesannotations) | Ensure image has required labels (e.g., git-commit). | [SBOM](#sboms) | -| [Forbid Huge Images](#forbid-large-images) | Limit image size. | [Image SBOM](#images) | -| [Coding Permissions](#coding-permissions) | Control file modifications by authorized identities. | [Git SBOM](#git) | -| Merging Permissions | Ensure authorized identities merge to main. | Counterpart to [Forbid Commits To Main](#forbid-commits-to-main)? | -| [Forbid Unsigned Commits](#forbid-unsigned-commits) | Prevent unsigned commits in evidence. | [Git SBOM](#git) | -| [Forbid Commits To Main](#forbid-commits-to-main) | Verify there were no commits to the main branch. | [Git SBOM](#git) | -| [Verify Use of Specific Builder](#builder-name) | Enforce use of a specific builder for artifact. | [SLSA-Prov](#slsa) | -| [Banned Builder Dependencies](#banned-builder-dependencies) | Restrict banned builder dependencies. | [SLSA-Prov](#slsa) | -| [Verify Build Time](#build-time) | Validate build time within window. | [SLSA-Prov](#slsa) | -| [Verify Byproducts Produced](#produced-byproducts) | Ensure that specific byproducts are produced. | [SLSA-Prov](#slsa) | -| [Verify That Field Exists](#verify-that-field-exists) | Ensure that specific field exists in the SLSA statement. | [SLSA-Prov](#slsa) | -| [No Critical CVEs](#no-critical-cves) | Prohibit ANY critical CVEs. | [SARIF](#sarif-reports) | -| [Limit High CVEs](#limit-high-cves) | Limit high CVEs. | [SARIF](#sarif-reports) | -| [Do Not Allow Specific CVEs](#do-not-allow-specific-cves) | Prevent specific CVEs in the artifact. | [SARIF](#sarif-reports) | -| [No Static Analysis Errors](#no-static-analysis-errors) | Prevent static analysis errors in the artifact. | [SARIF](#sarif-reports) | -| [Limit Static Analysis Warnings](#limit-static-analysis-warnings) | Restrict static analysis warnings count. | [SARIF](#sarif-reports) | -| [Do Not Allow Specific Static Analysis Rules](#do-not-allow-specific-static-analysis-rules) | Restrict specific static analysis warnings. | [SARIF](#sarif-reports) | +| [Require SBOM Signature](#require-sbom-signature) | Verify the SBOM is signed. | [SBOM](#sbom) | +| [Restrict Disallowed Dependencies](#restrict-disallowed-dependencies) | Verify the number of disallowed dependencies remains below the specified threshold. | [SBOM](#sbom) | +| [Enforce SBOM Dependencies](#enforce-sbom-dependencies) | Verify the artifact includes all required dependencies. | [SBOM](#sbom) | +| [Restrict Disallowed SBOM Licenses](#restrict-disallowed-sbom-licenses) | Verify specific users are not allowed in an SBOM. | [SBOM](#sbom) | +| [Enforce SBOM License Completeness](#enforce-sbom-license-completeness) | Verify all dependencies in the artifact have a license. | [SBOM](#sbom) | +| [Enforce SBOM Freshness](#enforce-sbom-freshness) | Verify the SBOM is not older than the specified duration. | [SBOM](#sbom) | +| [Fresh Image](#fresh-image) |Verify the image is not older than the specified threshold. | [Image SBOM](#images) | +| [Disallow Container Shell Entrypoint](#disallow-container-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](#images) | +| [Restrict Build Scripts](#restrict-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](#images) | +| [Verify Image Labels](#verify-image-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](#images) | +| [Forbid Large Images](#forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](#images) | +| [Restrict Coding Permissions](#restrict-coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](#git) | +| [Disallow Unsigned Commits](#disallow-unsigned-commits) | Verify all commits are signed. | [Git SBOM](#git) | +| [Disallow Commits to Main Branch](#disallow-commits-to-main-branch) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](#git) | +| [Verify that artifact was created by the specified builder](#verify-that-artifact-was-created-by-the-specified-builder) | Verify the artifact was created by the specified builder. | [SLSA-Prov](#slsa) | +| [Disallow dependencies in SLSA Provenance Document](#disallow-dependencies-in-slsa-provenance-document) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA-Prov](#slsa) | +| [Verify Build Time](#verify-build-time) | Verify the artifact was created within the specified time window. | [SLSA-Prov](#slsa) | +| [Verify that artifact has no disallowed builder dependencies](#verify-that-artifact-has-no-disallowed-builder-dependencies) | Verify the artifact has no disallowed builder dependencies. | [SLSA-Prov](#slsa) | +| [SLSA Field Exists in Provenance Document](#slsa-field-exists-in-provenance-document) | Verify the specified field exists in the provenance document. | [SLSA-Prov](#slsa) | +| [Verify Rule Compliance in SARIF](#verify-rule-compliance-in-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF](#sarif-reports) | | [Do Not Allow Vulnerabilities Based On Specific Attack Vector](#do-not-allow-vulnerabilities-based-on-specific-attack-vector) | Restrict vulnerabilities based on specific attack vector. | [SARIF](#sarif-reports) | -| [Report IaC Configuration errors](#report-iac-configuration-errors) | Check if there are any IaC configuration errors. | [SARIF](#sarif-reports) | -| [Verify Semgrep SARIF report](#verify-semgrep-sarif-report) | Check for specific violations in a semgrep report. | [SARIF](#sarif-reports) | -| [Verify Scanner Tool Evidence](#verify-tool-evidence) | Check the existance of an evidence of SARIF report created by specified tool | [SARIF](#sarif-reports) | -| [Forbid Accessing Host](#forbid-accessing-host) | Do not allow images with detected vulnerabilities giving access to the host system. | Generic Evidence | [Generic](#generic) | -| No Package Downgrading | Restrict package downgrades. | src and dst [SBOM](#sboms) | -| No License Modification | Prevent license modifications. | src and dst [SBOM](#sboms) | -| Verify Source code Integrity | Verify that the artifact source code has not been modified | src and dst [Git SBOM](#git) | -| Verify Dependencies Integrity | Verify that specific files or folders have not been modified | src and dst [SBOM](#sboms) | -| [Verify Github Branch Protection](https://github.com/scribe-public/sample-policies/tree/main/v1/apis/github-branch-protection.md) | Verify that the branch protection rules are compliant to required | None | -| [Verify GitLab Push Rules](https://github.com/scribe-public/sample-policies/tree/main/v1/apis/gitlab-push-rules.md) | Verify that the push rules are compliant to required. GitLabs push rules overlap some of GitHub's branch protection rules | None | +| [Verify IaC Misconfiguration Threshold in SARIF](#verify-iac-misconfiguration-threshold-in-sarif) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF](#sarif-reports) | +| [Verify Semgrep Rule in SARIF](#verify-semgrep-rule-in-sarif) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF](#sarif-reports) | +| [Verify Tool Evidence in SARIF](#verify-tool-evidence-in-sarif) | Verify required tools were used to generate the SARIF report. | [SARIF](#sarif-reports) | +| [K8s Jailbreak](#k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold. | [Generic](#generic) | +| [Verify Github Branch Protection](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/api/branch-protection.md) | Verify that the branch protection rules are compliant to required | None | +| [Verify GitLab Push Rules](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/gitlab/api/push-rules.md) | Verify that the push rules are compliant to required. GitLabs push rules overlap some of GitHub's branch protection rules | None | ### General Information @@ -126,7 +118,7 @@ Most of the policy rules in this bundle consist of two files: a `.yaml` and a `. The first is a rule configuration file that should be referenced by on runtime or merged to the actual `valint.yaml`. The second is a rego script that contains the actual verifyer code. It can be used as is or merged to the `.yaml` using `script` option. -### SBOMs +### SBOM An example of creating an SBOM evidence: @@ -137,16 +129,16 @@ valint bom ubuntu:latest -o statement To verify the evidence against the rule, run: ```bash -valint verify ubuntu:latest -i statement-cyclonedx-json --rule sboms/rule_config@v1 +valint verify ubuntu:latest -i statement-cyclonedx-json --rule sbom/rule_config@v2/rules ``` -#### Forbid Unsigned Artifacts +#### Require SBOM Signature -This rule ([artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/artifact-signed.yaml)) verifies that the SBOM is signed and the signer identity equals to a given value. +This rule ([artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/artifact-signed.yaml)) verifies that the SBOM is signed and the signer identity equals to a given value. If you have not created an SBOM yet, create an sbom attestation, for example: -In [artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/artifact-signed.yaml) file, +In [artifact-signed.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/artifact-signed.yaml) file, edit policy parameters ```attest.cocosign.policies.rules.input identity``` to reflect the expected signers identity. You can also edit `target_type` to refelct the artifact type. @@ -155,20 +147,20 @@ You can also edit `target_type` to refelct the artifact type. ```yaml evidence: - target_type: image + target_type: container with: identity: emails: - example@company.com ``` -#### Blocklist Packages +#### Restrict Disallowed Dependencies -This rule ([blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.yaml), [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.rego)) verifies an SBOM does not include packages in the list of risky packages. +This rule ([blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.yaml), [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.rego)) verifies an SBOM does not include packages in the list of risky packages. -`rego` code for This rule can be found in the [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.rego) file. +`rego` code for This rule can be found in the [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.rego) file. -Edit the list of the risky licenses in the `input.rego.args` parameter in file [blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/blocklist-packages.yaml): +Edit the list of the risky licenses in the `input.rego.args` parameter in file [blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/blocklist-packages.yaml): ```yaml with: @@ -178,11 +170,11 @@ with: blocklisted_limit: 0 ``` -#### Required Packages +#### Enforce SBOM Dependencies -This rule ([required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.yaml), [required-packages.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.rego)) verifies that the SBOM includes packages from the list of required packages. +This rule ([required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.yaml), [required-packages.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.rego)) verifies that the SBOM includes packages from the list of required packages. -Edit the list of the required packages in the `input.rego.args` parameter in file [required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/required-packages.yaml): +Edit the list of the required packages in the `input.rego.args` parameter in file [required-packages.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/required-packages.yaml): ```yaml with: @@ -193,11 +185,11 @@ with: The rule checks if there is a package listed in SBOM whose name contains the name of a required package as a substring. For example, if the package name is ```pkg:deb/ubuntu/bash@5.1-6ubuntu1?arch=amd64\u0026distro=ubuntu-22.04```, it will match any substring, like just ```bash``` or ```bash@5.1-6ubuntu1```. -#### Banned Licenses +#### Restrict Disallowed SBOM Licenses -This rule ([banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.yaml), [banned-licenses.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.rego)) verifies that the SBOM does not include licenses from the list of risky licenses. +This rule ([banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.yaml), [banned-licenses.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.rego)) verifies that the SBOM does not include licenses from the list of risky licenses. -Edit the list of the risky licenses in the `input.rego.args` parameter in file [banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/banned-licenses.yaml): +Edit the list of the risky licenses in the `input.rego.args` parameter in file [banned-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/banned-licenses.yaml): ```yaml rgs: @@ -207,17 +199,17 @@ rgs: blocklisted_limit : 10 ``` -#### Complete Licenses +#### Enforce SBOM License Completeness -This rule ([complete-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/complete-licenses.yaml), [complete-licenses.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/complete-licenses.rego)) verifies that every package in the SBOM has a license. +This rule ([complete-licenses.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/complete-licenses.yaml), [complete-licenses.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/complete-licenses.rego)) verifies that every package in the SBOM has a license. It doesn't have any additional parameters. -#### Fresh Artifact +#### Enforce SBOM Freshness -This rule ([fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.yaml), [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.rego)) verifies that the SBOM is not older than a given number of days. +This rule ([fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.yaml), [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.rego)) verifies that the SBOM is not older than a given number of days. -Edit the config `input.rego.args` parameter in file [fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sboms/fresh-sbom.yaml): +Edit the config `input.rego.args` parameter in file [fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sbom/fresh-sbom.yaml): ```yaml with: @@ -235,20 +227,20 @@ valint bom ubuntu:latest -o statement To verify the evidence against the rule: ```bash -valint verify ubuntu:latest -i statement --rule images/rule_config@v1 +valint verify ubuntu:latest -i statement --rule images/rule_config@v2/rules ``` -#### Restrict Shell Image Entrypoint +#### Disallow Container Shell Entrypoint -This rule ([restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/restrict-shell-entrypoint.yaml), [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/restrict-shell-entrypoint.rego)) verifies that the image entrypoint does not provide shell access by default. It does so by verifying that both `Entrypoint` and `Cmd` don't contain `sh` (there's an exclusion for `.sh` though). +This rule ([restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/restrict-shell-entrypoint.yaml), [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/restrict-shell-entrypoint.rego)) verifies that the image entrypoint does not provide shell access by default. It does so by verifying that both `Entrypoint` and `Cmd` don't contain `sh` (there's an exclusion for `.sh` though). This rule is not configurable. -#### Blocklist Image Build Scripts +#### Restrict Build Scripts -This rule ([blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/blocklist-build-scripts.yaml), [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/blocklist-build-scripts.rego)) verifies that the image did not run blocklisted scripts on build. +This rule ([blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/blocklist-build-scripts.yaml), [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/blocklist-build-scripts.rego)) verifies that the image did not run blocklisted scripts on build. -Edit the list of the blocklisted scripts in the `input.rego.args` parameter in file [blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/no-build-scripts.yaml): +Edit the list of the blocklisted scripts in the `input.rego.args` parameter in file [blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/no-build-scripts.yaml): ```yaml with: @@ -256,11 +248,11 @@ with: - curl ``` -#### Verify Image Lables/Annotations +#### Verify Image Labels -This rule ([verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.yaml), [verify-labels.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.rego)) verifies that image has labels with required values. +This rule ([verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.yaml), [verify-labels.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.rego)) verifies that image has labels with required values. -Edit the list of the required labels in the config object in file [verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/verify-labels.yaml): +Edit the list of the required labels in the config object in file [verify-labels.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/verify-labels.yaml): ```yaml with: @@ -271,9 +263,9 @@ with: #### Fresh Image -This rule ([fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.yaml), [fresh-image.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.rego)) verifies that the image is not older than a given number of days. +This rule ([fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.yaml), [fresh-image.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.rego)) verifies that the image is not older than a given number of days. -Edit the config `input.rego.args` parameter in file [fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/fresh-image.yaml): +Edit the config `input.rego.args` parameter in file [fresh-image.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/fresh-image.yaml): ```yaml with: @@ -282,9 +274,9 @@ with: #### Forbid Large Images -This rule ([forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.yaml), [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.rego)) verifies that the image is not larger than a given size. +This rule ([forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.yaml), [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.rego)) verifies that the image is not larger than a given size. -Set max size in bytes in the `input.rego.args` parameter in file [forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/images/forbid-large-images.yaml): +Set max size in bytes in the `input.rego.args` parameter in file [forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/images/forbid-large-images.yaml): ```yaml with: @@ -302,16 +294,16 @@ valint bom git:https://github.com/golang/go -o statement To verify the evidence against the rule: ```bash -valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v1 +valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v2/rules ``` -#### Coding Permissions +#### Restrict Coding Permissions -This rule ([coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.yaml), [coding-permissions.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.rego)) verifies that files from the specified list were modified by authorized users only. +This rule ([coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.yaml), [coding-permissions.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.rego)) verifies that files from the specified list were modified by authorized users only. For This rule be able to run, the evidence must include a reference to the files that were modified in the commit. This can be done by adding parameter `--components commits,files` to the `valint bom` command. -For specifying the list of files and identities, edit the `input.rego.args` parameter in file [coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/coding-permissions.yaml). +For specifying the list of files and identities, edit the `input.rego.args` parameter in file [coding-permissions.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/coding-permissions.yaml). This example for repository [Golang Build](https://github.com/golang/build) verifies that files `build.go` and `internal/https/README.md` were modified only by identities containing `@golang.com` and `@golang.org`: ```yaml @@ -324,13 +316,13 @@ with: - "somedir/b.txt" ``` -#### Forbid Unsigned Commits +#### Disallow Unsigned Commits -This rule ([no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-unsigned-commits.yaml), [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-unsigned-commits.rego)) verifies that evidence has no unsigned commits. It does not verify the signatures though. +This rule ([no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-unsigned-commits.yaml), [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-unsigned-commits.rego)) verifies that evidence has no unsigned commits. It does not verify the signatures though. -#### Forbid Commits To Main +#### Disallow Commits to Main Branch -This rule ([no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-commit-to-main.yaml), [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/git/no-commit-to-main.rego)) verifies that evidence has no commits made to main branch. +This rule ([no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-commit-to-main.yaml), [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/git/no-commit-to-main.rego)) verifies that evidence has no commits made to main branch. ### SLSA @@ -343,25 +335,25 @@ valint slsa ubuntu:latest -o statement Example of verifying a SLSA statement: ```bash -valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v1 +valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v2/rules ``` -#### Builder Name +#### Verify that artifact was created by the specified builder -This rule ([verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.yaml), [verify-builder.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.rego)) verifies that the builder name of the SLSA statement equals to a given value. +This rule ([verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.yaml), [verify-builder.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.rego)) verifies that the builder name of the SLSA statement equals to a given value. -Edit config `input.rego.args` parameter in file [verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-builder.yaml): +Edit config `input.rego.args` parameter in file [verify-builder.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-builder.yaml): ```yaml with: id: "local" ``` -#### Banned Builder Dependencies +#### Disallow dependencies in SLSA Provenance Document -This rule ([banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.yaml), [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.rego)) verifies that the builder used to build an artifact does not have banned dependencies (such as an old openSSL version). +This rule ([banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.yaml), [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.rego)) verifies that the builder used to build an artifact does not have banned dependencies (such as an old openSSL version). -Edit config `input.rego.args` parameter in file [banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/banned-builder-deps.yaml): +Edit config `input.rego.args` parameter in file [banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/banned-builder-deps.yaml): ```yaml with: @@ -370,11 +362,11 @@ with: version: "0.0.0" ``` -#### Build Time +#### Verify Build Time -This rule ([build-time.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.yaml), [build-time.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.rego)) verifies that the build time of the SLSA statement is within a given time window The timezone is derived from the timestamp in the statement. +This rule ([build-time.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.yaml), [build-time.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.rego)) verifies that the build time of the SLSA statement is within a given time window The timezone is derived from the timestamp in the statement. -Edit config `input.rego.args` parameter in file [build-time.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/build-time.yaml): +Edit config `input.rego.args` parameter in file [build-time.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/build-time.yaml): ```yaml with: @@ -388,13 +380,13 @@ with: - "Thursday" ``` -#### Produced Byproducts +#### Verify that artifact has no disallowed builder dependencies -This rule ([verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.yaml), [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.rego)) verifies that the SLSA statement contains all the required byproducts. +This rule ([verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.yaml), [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.rego)) verifies that the SLSA statement contains all the required byproducts. According to the SLSA Provenance [documentation](https://slsa.dev/spec/v1.0/provenance), there are no mandatory fields in the description of a byproduct, but at least one of `uri, digest, content` should be specified. So, the rule checks if each byproduct specified in the configuration is present in one of those fields of any byproduct in the SLSA statement. It does so by calling the `contains` function, so the match is not exact. -Before running the rule, specify desired byproducts in the `input.rego.args` parameter in file [verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/verify-byproducts.yaml): +Before running the rule, specify desired byproducts in the `input.rego.args` parameter in file [verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/verify-byproducts.yaml): ```yaml with: @@ -402,11 +394,11 @@ with: - 4693057ce2364720d39e57e85a5b8e0bd9ac3573716237736d6470ec5b7b7230 ``` -#### Verify That Field Exists +#### SLSA Field Exists in Provenance Document -This rule ([field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.yaml), [field-exists.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.rego)) verifies that the SLSA statement contains a field with the given path. +This rule ([field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.yaml), [field-exists.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.rego)) verifies that the SLSA statement contains a field with the given path. -Before running the rule, specify desired paths in the `input.rego.args` parameter in file [field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/slsa/field-exists.yaml): +Before running the rule, specify desired paths in the `input.rego.args` parameter in file [field-exists.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/slsa/field-exists.yaml): ```yaml with: @@ -419,15 +411,15 @@ with: #### Generic SARIF Rule -This rule ([verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml), [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.rego)) allows to verify any SARIF report against a given rule. The rule has several parameters to check against: +This rule ([verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml), [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.rego)) allows to verify any SARIF report against a given rule. The rule has several parameters to check against: -* ruleLevel: the level of the rule, can be "error", "warning", "note", "none" -* ruleIds: the list of the rule IDs to check against -* precision: the precision of the check, can be "exact", "substring", "regex" -* ignore: the list of the rule IDs to ignore -* maxAllowed: the maximum number of violations allowed +- ruleLevel: the level of the rule, can be "error", "warning", "note", "none" +- ruleIds: the list of the rule IDs to check against +- precision: the precision of the check, can be "exact", "substring", "regex" +- ignore: the list of the rule IDs to ignore +- maxAllowed: the maximum number of violations allowed -These values can be changed in the `input.rego.args` section in the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file. +These values can be changed in the `input.rego.args` section in the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) file. ##### Creating a BOM out of a SARIF report @@ -446,7 +438,7 @@ valint evidence ubuntu-cve.json -o statement Verify the attestation against the rule: ```bash -valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v1 +valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2/rules ``` ###### Running Trivy On Docker Container Rootfs @@ -472,36 +464,20 @@ docker cp $(docker ps -lq):/rootfs.json . After that create the evidence and verify it as described above. -##### No Critical CVEs +##### Verify Rule Compliance in SARIF -To verify that the SARIF report does not contain any critical CVEs, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: +To verify that the SARIF report complies with defined generic rules for compliance and security, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) file: ```yaml with: - rule_level: - - critical + rule_level: [] precision: [] rule_ids: [] ignore: [] max_allowed: 0 ``` -##### Limit High CVEs - -To verify that the SARIF report does not contain more than specified number of CVEs with high level (let's say 10), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: - -```yaml -with: - rule_level: high, - precision: [] - rule_ids: [] - ignore: [] - max_allowed: 10 -``` - -##### Do Not Allow Specific CVEs - -To verify that the SARIF report does not contain certain CVEs (let's say CVE-2021-1234 and CVE-2021-5678), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: +For example, to alarm on specific rule levels & rule IDs, modify config as follows: ```yaml with: @@ -518,59 +494,11 @@ with: max_allowed: 0 ``` -##### No Static Analysis Errors - -To verify that the SARIF report does not contain any static analysis errors, set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: - -```yaml -with: - rule_level: - - "error" - precision: [] - rule_ids: [] - ignore: [] - max_allowed: 0 -``` - -##### Limit Static Analysis Warnings - -To verify that the SARIF report does not contain more than specified number of static analysis warnings (let's say 10), set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: - -```yaml -with: - rule_level: - - "warning" - precision: [] - rule_ids: [] - ignore: [] - max_allowed: 10 -``` - -##### Do Not Allow Specific Static Analysis Rules - -To verify that the SARIF report does not contain static analysis warnings from the following rules: "rule1", "rule2", "rule3", set the following parameters in the `rego.args` section in the[verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) file: - -```yaml -with: - rule_level: - - "error" - - "warning" - - "note" - - "none" - precision: [] - rule_ids: - - "rule1" - - "rule2" - - "rule3" - ignore: [] - max_allowed: 0 -``` - ##### Do Not Allow Vulnerabilities Based On Specific Attack Vector Trivy/grype reports usually contain descriptions for some CVEs, like impact and attack vector. -This rule ([verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.yaml), [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.rego)) is meant to restrict number of vulnerabilities with specific attack vectors. -For example, to restrict vulnerabilities with attack vector "stack buffer overflow", set the following parameters in the `rego.args` section in the [verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-attack-vector.yaml) file: +This rule ([verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.yaml), [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.rego)) is meant to restrict number of vulnerabilities with specific attack vectors. +For example, to restrict vulnerabilities with attack vector "stack buffer overflow", set the following parameters in the `rego.args` section in the [verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-attack-vector.yaml) file: ```yaml with: @@ -581,9 +509,9 @@ with: Then run the rule against the SARIF report as described above. -#### Report IaC Configuration errors +#### Verify IaC Misconfiguration Threshold in SARIF -This rule ([report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.yaml), [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.rego)) allows to verify a Trivy IaC report and check if there are any errors in the configuration. +This rule ([report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.yaml), [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.rego)) allows to verify a Trivy IaC report and check if there are any errors in the configuration. First, create a trivy report of the misconfigurations of a Dockerfile: @@ -600,21 +528,21 @@ valint evidence my-image-dockerfile.json -o statement Verify the attestation against the rule: ```bash -valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v1 +valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v2/rules ``` -The only configurable parameter in [report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/report-iac-errors.yaml) is `violations_threshold`, which is the maximum number of errors allowed in the report: +The only configurable parameter in [report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.yaml) is `violations_threshold`, which is the maximum number of errors allowed in the report: ```yaml with: violations_threshold: 0 ``` -#### Verify Semgrep SARIF report +#### Verify Semgrep Rule in SARIF `semgrep`, a code analysis tool, can produce SARIF reports, which later can be verified by `valint` against a given rule. -This rule ([verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.yaml), [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.rego)) allows to verify that given SARIF report does not contain specific rules violations. +This rule ([verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.yaml), [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.rego)) allows to verify that given SARIF report does not contain specific rules violations. First, one needs to create a semgrep report (say, for the `openvpn` repo): @@ -629,7 +557,7 @@ Then, create an evidence from this report: valint evidence semgrep-report.sarif -o statement ``` -Configuration of This rule is done in the file [verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-semgrep-report.yaml). In this example we forbid any violations of the `use-after-free` rule: +Configuration of This rule is done in the file [verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-semgrep-report.yaml). In this example we forbid any violations of the `use-after-free` rule: ```yaml with: @@ -641,22 +569,22 @@ with: Then, run `valint verify` as usual: ```bash -valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v1 +valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v2/rules ``` If any violations found, the output will contain their description, including the violated rule and the file where the violation was found. -#### Verify Tool Evidence +#### Verify Tool Evidence in SARIF -This rule ([verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-tool-evidence.yaml)) allows to verify the existence of an evidence of SARIF report created by a specified tool. By default, the rule checks for an evidence created out of *any* SARIF report. To specify a tool, use the `tool` parameter in the `evidence` section of the rule configuration. For example, to verify that there is an evidence of a SARIF report created by `trivy`, use the following configuration: +This rule ([verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-tool-evidence.yaml)) allows to verify the existence of an evidence of SARIF report created by a specified tool. By default, the rule checks for an evidence created out of _any_ SARIF report. To specify a tool, use the `tool` parameter in the `evidence` section of the rule configuration. For example, to verify that there is an evidence of a SARIF report created by `trivy`, use the following configuration: ```yaml -uses: sarif/verify-tool-evidence@v1 +uses: sarif/verify-tool-evidence@v2/rules evidence: tool: "Trivy Vulnerability Scanner" ``` -### Forbid Accessing Host +### K8s Jailbreak Trivy k8s analysis can highlight some misconfigurations which allow container to access host filesystem or network. The goal of This rule is to detect such misconfigurations. @@ -666,8 +594,8 @@ To run this rule one has to create a Trivy k8s report and create a generic state Rego policy rules can be written either as snippets in the yaml file, or as separate rego files. -An example of such a rego script is given in the [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.rego) file, that is consumed by the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/main/v1/sarif/verify-sarif.yaml) configuraion. To evaluate the rule, run +An example of such a rego script is given in the [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.rego) file, that is consumed by the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) configuraion. To evaluate the rule, run ```bash -valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v1 +valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2/rules ``` diff --git a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md index 414f57c81..1a4dc6153 100644 --- a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md +++ b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md @@ -212,7 +212,7 @@ select: name: require_signed_images rules: - name: error_on_unsigned_image - uses: sbom/artifact-signed@v1 + uses: sbom/artifact-signed@v2/rules level: error ``` @@ -364,7 +364,7 @@ select: name: cluster-policy rules: - name: fresh-image - uses: images/fresh-image@v1 + uses: images/fresh-image@v2/rules level: warning with: max_days: 356 @@ -390,7 +390,7 @@ select: name: cluster-policy rules: - name: fresh-image - uses: images/fresh-image@v1 + uses: images/fresh-image@v2/rules level: warning with: max_days: 356 @@ -415,7 +415,7 @@ select: name: pipeline-scanners rules: - name: check-vulnerabilities - uses: sarif/verify-sarif@v1 + uses: sarif/verify-sarif@v2/rules evidence: tool: "Trivy Vulnerability Scanner" with: @@ -464,7 +464,7 @@ select: name: pipeline-scanners rules: - name: check-vulnerabilities - uses: sarif/verify-sarif@v1 + uses: sarif/verify-sarif@v2/rules evidence: tool: "Trivy Vulnerability Scanner" with: @@ -535,7 +535,7 @@ select: name: default-provider-policy rules: - name: warn_on_unsigned_image - uses: sbom/artifact-signed@v1 + uses: sbom/artifact-signed@v2/rules level: "warning" ``` @@ -699,7 +699,7 @@ select: name: require_signed_images rules: - name: error_on_unsigned_image - uses: sbom/artifact-signed@v1 + uses: sbom/artifact-signed@v2/rules level: error ``` From c7cb80e682d8541e87eabfba99b098ea228fb243 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 28 Jan 2025 18:17:57 +0200 Subject: [PATCH 016/191] initiative guide --- ...policy.md => enforcing-sdlc-initiative.md} | 128 ++++++++++++++++-- 1 file changed, 120 insertions(+), 8 deletions(-) rename docs/guides/{enforcing-sdlc-policy.md => enforcing-sdlc-initiative.md} (64%) diff --git a/docs/guides/enforcing-sdlc-policy.md b/docs/guides/enforcing-sdlc-initiative.md similarity index 64% rename from docs/guides/enforcing-sdlc-policy.md rename to docs/guides/enforcing-sdlc-initiative.md index c0603fa83..0ab8d6e19 100644 --- a/docs/guides/enforcing-sdlc-policy.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -1,6 +1,6 @@ --- -sidebar_label: "Applying Policies to your SDLC" -title: Applying Policies to your SDLC +sidebar_label: "Applying Initiatives to your SDLC" +title: Applying Initiatives to your SDLC sidebar_position: 3 toc_min_heading_level: 2 toc_max_heading_level: 5 @@ -14,7 +14,7 @@ For example, at the end of a build or at the admission control point to the prod - Tagged sources must be signed and verified by a set of individuals or processes. - Released binaries must be built by Azure DevOps from a specific git repository and have unsigned SLSA provenance. -For the detailed policy description, see **[policies](../valint/policies)** section. +For the detailed initiative description, see **[initiatives](../valint/initiatives)** section. ## Sample Rule Bundle @@ -44,6 +44,34 @@ The following is a description of a sample rule bundle that can be used to build valint verify busybox:latest --rule sbom/complete-licenses@v2/rules # path within a repo ``` + As a result, you will see the output table of the rule verification: + + ```bash + ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ Control "default. Default" Evaluation Summary │ + ├───────────────────────────────────┬───────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────┬────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────┤ + │ sbom-require-complete-license-set │ Enforce SBOM License Completeness │ error │ false │ pass │ All packages have licenses │ busybox:1.36.1 │ + ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────┤ + │ CONTROL RESULT │ │ │ │ PASS │ │ │ + └───────────────────────────────────┴───────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────┴────────────────┘ + ``` + + You will also see the result table of the initiative evaluation: + + ```bash + ┌─────────────────────────────────────────────────────────────────────────────────────────────┐ + │ Initiative "client-initiative. client-initiative" Evaluation Summary │ + ├───────────────────┬───────────────┬────────────────────────────────────────────────┬────────┤ + │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ + ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤ + │ default │ Default │ sbom-require-complete-license-set(error->pass) │ pass │ + ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤ + │ INITIATIVE RESULT │ │ │ PASS │ + └───────────────────┴───────────────┴────────────────────────────────────────────────┴────────┘ + ``` + If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--bundle-tag` flag for `valint`: ```bash @@ -54,19 +82,103 @@ The following is a description of a sample rule bundle that can be used to build ### Targetless Run - Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based on the product name and version and options specified in the rule config. To try this out, first create an SBOM providing these values: + Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../platforms/overview). + + As an example, let's run `trivy` to create a SARIF report: + + ```bash + trivy image --format sarif --output results.sarif ubuntu:latest + ``` + + Then, create an evidence from this report: ```bash - valint bom busybox:latest -o statement --product-name busybox --product-version v1.36.1 + valint evidence results.sarif --product-name ubuntu --product-version 24.04 ``` - Then, run + And finally, verify the evidence against the rule. Note that we don't need to provide `valint `with the target report: ```bash - valint verify --rule sbom/complete-licenses@v2/rules --product-name busybox --product-version v1.36.1 + valint verify --rule sarif/trivy/verify-trivy-report@v2/rules --product-name ubuntu --product-version 24.04 ``` - Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. + Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, so `valint` was able to find it just by this partial context: + + ```bash + ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ Control "default. Default" Evaluation Summary │ + ├────────────────┬──────────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────┬───────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ + │ trivy-report │ Verify Trivy SARIF Report Compliance │ error │ false │ fail │ 113 violations | 0 max allowed │ results.sarif │ + ├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ + │ CONTROL RESULT │ │ │ │ FAIL │ │ │ + └────────────────┴──────────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────┴───────────────┘ + + ┌────────────────────────────────────────────────────────────────────────┐ + │ Initiative "client-initiative. client-initiative" Evaluation Summary │ + ├───────────────────┬───────────────┬───────────────────────────┬────────┤ + │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ + ├───────────────────┼───────────────┼───────────────────────────┼────────┤ + │ default │ Default │ trivy-report(error->fail) │ fail │ + ├───────────────────┼───────────────┼───────────────────────────┼────────┤ + │ INITIATIVE RESULT │ │ │ FAIL │ + └───────────────────┴───────────────┴───────────────────────────┴────────┘ + ``` + +### Verify Initiative + +Similar to a single rule, one can verify an initiative. The following command will verify all rules in the SSDF initiative: + +```bash +valint verify busybox:latest --initiative ssdf@v2/initiatives +``` + +The results would look like: + +```bash +[2025-01-28 17:28:29] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ +Evaluation Target Name 'index.docker.io/library/busybox:latest' + +[2025-01-28 17:28:29] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────┐ +│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬─────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼─────────────────────┼────────┤ +│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ +│ │ │ PS.3.2(error->pass) │ │ +├───────────────────┼───────────────┼─────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴───────────────┴─────────────────────┴────────┘ +``` + +Note that only the rules that are applicable to the target and provided inputs were be verified. Other rules were disabled with a warning: + +```syslog +[2025-01-28 17:28:27] WARN rule: [PS.1.1::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found +[2025-01-28 17:28:27] WARN rule: [PS.1.3::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found +[2025-01-28 17:28:27] WARN rule: [PS.1.5::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found +[2025-01-28 17:28:27] WARN control: [SSDF-ORG::SSDF] no rules enabled, skipping control +[2025-01-28 17:28:27] WARN rule: [PS.1.2::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found +[2025-01-28 17:28:27] WARN rule: [PS.1.4::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found +``` + +## Reading the Results + +The results of the verification are presented in a table format. The table consists of the following columns: + ## Modifying Rules in This Catalogue From 39d976eaf3a06f16e89403df5c69c65538137b74 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 28 Jan 2025 18:21:58 +0200 Subject: [PATCH 017/191] initiative guide --- docs/guides/enforcing-sdlc-initiative.md | 160 +++++++++++++++++++++++ 1 file changed, 160 insertions(+) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 0ab8d6e19..fd47f67a5 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -175,6 +175,166 @@ Note that only the rules that are applicable to the target and provided inputs w [2025-01-28 17:28:27] WARN rule: [PS.1.4::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found ``` +In the SSDF example, to enable other rules verification we need to rune [platforms discovery](../platforms/overview) for GitHub organizations and repositories first. After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. `platforms` will provide the necessary arguments to `valint` to verify the discovered assets. + +
+ +Initiative results + +```bash +[2025-01-28 17:50:36] INFO Control "SSDF-ORG. SSDF ORG" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-ORG. SSDF ORG" Evaluation Summary │ +├────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.1 │ Enforce 2FA │ error │ true │ pass │ 2FA authentication is enabled │ my-org (github organization) │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.3 │ Limit admins │ error │ true │ fail │ 9 admins | 3 max allowed │ my-org (github organization) │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ + +[2025-01-28 17:50:36] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ +├────────────────┬───────────────┬───────┬──────────┬────────┬──────────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼───────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org__my-repo_repository_attestation.json │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ +├────────────────┼───────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴───────────────┴───────┴──────────┴────────┴──────────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────┘ + +[2025-01-28 17:50:36] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────┐ +│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬──────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-ORG │ SSDF ORG │ PS.1.1(error->pass), │ fail │ +│ │ │ PS.1.3(error->fail), │ │ +│ │ │ PS.1.5(error->fail) │ │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-REPO │ SSDF REPO │ PS.3.1(error->pass) │ pass │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴───────────────┴──────────────────────┴────────┘ + +``` + +
+ +Note that in this case `valint` filtered out `SSDF-IMAGE` rules because it wasn't provided with the right target. + +## Whole initiative verification + +If one wants to verify an initiative on all the existing evidences, they need to provide `valint` with the `--all-evidence` flag. It disables most of rule filterings and for each rule verifies all the matching evidences. + +```bash +valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name busybox --product-version v1.36.1 +``` + +
+ +Initiative results + +```bash +[2025-01-28 18:13:23] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ + +[2025-01-28 18:13:23] INFO Control "SSDF-ORG. SSDF ORG" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-ORG. SSDF ORG" Evaluation Summary │ +├────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.1 │ Enforce 2FA │ error │ true │ pass │ 2FA authentication is enabled │ my-org (github organization) │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.3 │ Limit admins │ error │ true │ fail │ 9 admins | 3 max allowed │ my-org (github organization) │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization │ +├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ + +[2025-01-28 18:13:23] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: +┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬──────────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/scribot (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/scribot (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ 33842 (scribe sarif evidence) │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ 33843 (scribe sarif evidence) │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ busybox:latest │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org__my-repo_repository_attestation.js │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ on │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org_organization_attestation.json │ +│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴──────────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────┘ + +[2025-01-28 18:13:23] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────┐ +│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬──────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ +│ │ │ PS.3.2(error->pass) │ │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-ORG │ SSDF ORG │ PS.1.1(error->pass), │ fail │ +│ │ │ PS.1.1(error->pass), │ │ +│ │ │ PS.1.3(error->fail), │ │ +│ │ │ PS.1.3(error->fail), │ │ +│ │ │ PS.1.5(error->fail), │ │ +│ │ │ PS.1.5(error->fail) │ │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-REPO │ SSDF REPO │ PS.3.1(error->pass), │ fail │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.3.1(error->pass), │ │ +│ │ │ PS.1.2(error->fail), │ │ +│ │ │ PS.1.2(error->fail), │ │ +│ │ │ PS.1.4(error->pass), │ │ +│ │ │ PS.1.4(error->pass) │ │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴───────────────┴──────────────────────┴────────┘ +``` + +
+ +In this case no rule was disabled and all of them were verified. + ## Reading the Results The results of the verification are presented in a table format. The table consists of the following columns: From d7e2efcf7eaf739c5037f2c9d6f10659c6f4af18 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 29 Jan 2025 15:48:25 +0200 Subject: [PATCH 018/191] update result logs --- docs/guides/enforcing-sdlc-initiative.md | 97 +++++++++++------------- 1 file changed, 43 insertions(+), 54 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index fd47f67a5..fd83e91f9 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -181,6 +181,8 @@ In the SSDF example, to enable other rules verification we need to rune [platfor Initiative results +### For GitHub organization + ```bash [2025-01-28 17:50:36] INFO Control "SSDF-ORG. SSDF ORG" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ @@ -197,18 +199,6 @@ In the SSDF example, to enable other rules verification we need to rune [platfor │ CONTROL RESULT │ │ │ │ FAIL │ │ │ └────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ -[2025-01-28 17:50:36] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ -├────────────────┬───────────────┬───────┬──────────┬────────┬──────────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼───────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org__my-repo_repository_attestation.json │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ -├────────────────┼───────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ PASS │ │ │ -└────────────────┴───────────────┴───────┴──────────┴────────┴──────────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────┘ - [2025-01-28 17:50:36] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────────┐ │ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ @@ -219,11 +209,37 @@ In the SSDF example, to enable other rules verification we need to rune [platfor │ │ │ PS.1.3(error->fail), │ │ │ │ │ PS.1.5(error->fail) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-REPO │ SSDF REPO │ PS.3.1(error->pass) │ pass │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ FAIL │ └───────────────────┴───────────────┴──────────────────────┴────────┘ +``` + +### For GitHub repository +```bash +[2025-01-28 17:50:36] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: +┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────────────────────────┬───────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/my-repo (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/my-repo (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘ + +[2025-01-28 17:50:36] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────┐ +│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬──────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ SSDF-REPO │ SSDF REPO │ PS.1.2(error->fail), │ fail │ +│ │ │ PS.1.4(error->pass) │ │ +├───────────────────┼───────────────┼──────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴───────────────┴──────────────────────┴────────┘ ``` @@ -266,38 +282,23 @@ valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name bu ├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ │ PS.1.3 │ Limit admins │ error │ true │ fail │ 9 admins | 3 max allowed │ my-org (github organization) │ ├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization │ +│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │ ├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ │ CONTROL RESULT │ │ │ │ FAIL │ │ │ └────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ [2025-01-28 18:13:23] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: -┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ -├────────────────┬──────────────────┬───────┬──────────┬────────┬──────────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/scribot (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/scribot (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ 33842 (scribe sarif evidence) │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ 33843 (scribe sarif evidence) │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ busybox:latest │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org__my-repo_repository_attestation.js │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ on │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ PS.3.1 │ Code archived │ error │ true │ pass │ The code is archived in a repository. This is a demo rule, plann │ output/github_my-org_organization_attestation.json │ -│ │ │ │ │ │ ed to run from a workflow in a repository. │ │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼──────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ FAIL │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴──────────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────┘ +┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary | +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────────────────────────┬───────────────────────────────────────| +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET | +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/my-repo (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/my-repo (github repo) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘ [2025-01-28 18:13:23] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────────┐ @@ -309,22 +310,10 @@ valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name bu │ │ │ PS.3.2(error->pass) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ │ SSDF-ORG │ SSDF ORG │ PS.1.1(error->pass), │ fail │ -│ │ │ PS.1.1(error->pass), │ │ -│ │ │ PS.1.3(error->fail), │ │ │ │ │ PS.1.3(error->fail), │ │ -│ │ │ PS.1.5(error->fail), │ │ │ │ │ PS.1.5(error->fail) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-REPO │ SSDF REPO │ PS.3.1(error->pass), │ fail │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.3.1(error->pass), │ │ -│ │ │ PS.1.2(error->fail), │ │ -│ │ │ PS.1.2(error->fail), │ │ -│ │ │ PS.1.4(error->pass), │ │ +│ SSDF-REPO │ SSDF REPO │ PS.1.2(error->fail), │ fail │ │ │ │ PS.1.4(error->pass) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ FAIL │ From 40ce26f6d0f0389173f2b94864a1ff1491a020a0 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 29 Jan 2025 16:50:02 +0200 Subject: [PATCH 019/191] hide policy results tables --- docs/guides/enforcing-sdlc-initiative.md | 26 ++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index fd83e91f9..27624063c 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -44,7 +44,11 @@ The following is a description of a sample rule bundle that can be used to build valint verify busybox:latest --rule sbom/complete-licenses@v2/rules # path within a repo ``` - As a result, you will see the output table of the rule verification: + As a result, you will see the output table of the rule verification. + +
+ + Rule evaluation results ```bash ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ @@ -72,6 +76,8 @@ The following is a description of a sample rule bundle that can be used to build └───────────────────┴───────────────┴────────────────────────────────────────────────┴────────┘ ``` +
+ If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--bundle-tag` flag for `valint`: ```bash @@ -102,7 +108,12 @@ The following is a description of a sample rule bundle that can be used to build valint verify --rule sarif/trivy/verify-trivy-report@v2/rules --product-name ubuntu --product-version 24.04 ``` - Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, so `valint` was able to find it just by this partial context: + Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. + In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, so `valint` was able to find it just by this partial context. + +
+ + Initiative results ```bash ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ @@ -126,15 +137,20 @@ The following is a description of a sample rule bundle that can be used to build └───────────────────┴───────────────┴───────────────────────────┴────────┘ ``` +
+ ### Verify Initiative -Similar to a single rule, one can verify an initiative. The following command will verify all rules in the SSDF initiative: +Similar to a single rule, one can verify an initiative. Let's take as an example the SSDF initiative available in the sample bundle as `ssdf@v2/initiatives`. +The following command will *try to* verify all rules in the initiative: ```bash valint verify busybox:latest --initiative ssdf@v2/initiatives ``` -The results would look like: +
+ +Initiative results ```bash [2025-01-28 17:28:29] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: @@ -164,6 +180,8 @@ Evaluation Target Name 'index.docker.io/library/busybox:latest' └───────────────────┴───────────────┴─────────────────────┴────────┘ ``` +
+ Note that only the rules that are applicable to the target and provided inputs were be verified. Other rules were disabled with a warning: ```syslog From a23e9febfbb3cdffe4123bc5b1f561b531da3d08 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 29 Jan 2025 17:00:03 +0200 Subject: [PATCH 020/191] result tables description --- docs/guides/enforcing-sdlc-initiative.md | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 27624063c..caca31cf0 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -264,7 +264,7 @@ In the SSDF example, to enable other rules verification we need to rune [platfor Note that in this case `valint` filtered out `SSDF-IMAGE` rules because it wasn't provided with the right target. -## Whole initiative verification +### Whole initiative verification If one wants to verify an initiative on all the existing evidences, they need to provide `valint` with the `--all-evidence` flag. It disables most of rule filterings and for each rule verifies all the matching evidences. @@ -342,10 +342,24 @@ valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name bu In this case no rule was disabled and all of them were verified. -## Reading the Results +### Reading the Results -The results of the verification are presented in a table format. The table consists of the following columns: +The results of the control verification are presented in a table format. The table consists of the following columns: +- `RULE ID`: The unique identifier of the rule. +- `RULE NAME`: The name of the rule. +- `LEVEL`: The severity level of the rule. Only rules with the "error" level can fail the control. +- `VERIFIED`: The boolean value indicating whether the evidence signature was verified. It may or may not fail the rule, based on the rule's requirements. +- `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open". +- `SUMMARY`: The reason for the rule result. +- `TARGET`: The target asset of the rule verification. + +The results of the initiative verification are also presented in a table format. The table consists of the following columns: + +- `CONTROL ID`: The unique identifier of the control. +- `CONTROL NAME`: The name of the control. +- `RULE LIST`: The list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In the parentheses, the rule's result is shown in the format `rule_id(level->result)`. +- `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". ## Modifying Rules in This Catalogue From 2e3e8090bba20e152f9a044156c8262200a62f97 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 29 Jan 2025 17:04:58 +0200 Subject: [PATCH 021/191] fix links --- docs/guides/enforcing-sdlc-initiative.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index caca31cf0..2c8c171b5 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -14,7 +14,7 @@ For example, at the end of a build or at the admission control point to the prod - Tagged sources must be signed and verified by a set of individuals or processes. - Released binaries must be built by Azure DevOps from a specific git repository and have unsigned SLSA provenance. -For the detailed initiative description, see **[initiatives](../valint/initiatives)** section. +For the detailed initiative description, see **[initiatives](../../valint/initiatives)** section. ## Sample Rule Bundle @@ -88,7 +88,7 @@ The following is a description of a sample rule bundle that can be used to build ### Targetless Run - Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../platforms/overview). + Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../../platforms/overview). As an example, let's run `trivy` to create a SARIF report: @@ -193,7 +193,7 @@ Note that only the rules that are applicable to the target and provided inputs w [2025-01-28 17:28:27] WARN rule: [PS.1.4::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found ``` -In the SSDF example, to enable other rules verification we need to rune [platforms discovery](../platforms/overview) for GitHub organizations and repositories first. After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. `platforms` will provide the necessary arguments to `valint` to verify the discovered assets. +In the SSDF example, to enable other rules verification we need to rune [platforms discovery](../../platforms/overview) for GitHub organizations and repositories first. After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. `platforms` will provide the necessary arguments to `valint` to verify the discovered assets.
From a2b8a37ee28cafda4f9440e01551615934cb138c Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 30 Jan 2025 13:26:34 +0200 Subject: [PATCH 022/191] small refactoring --- docs/guides/enforcing-sdlc-initiative.md | 33 ++++++++++++++---------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 2c8c171b5..0d90cfe3b 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -16,12 +16,10 @@ For example, at the end of a build or at the admission control point to the prod For the detailed initiative description, see **[initiatives](../../valint/initiatives)** section. -## Sample Rule Bundle - -The following is a description of a sample rule bundle that can be used to build a policy for your SDLC. - ## Quickstart +### Running a single rule verification + 1. Install `valint`: ```bash @@ -38,13 +36,13 @@ The following is a description of a sample rule bundle that can be used to build - To explore other evidence types, use commands `valint slsa` or `valint evidence`. - Specify `-o attest` for signed evidence. -3. Verify the SBOM against a rule. The current catalogue will be used as a default bundle for `valint`. +3. Verify the SBOM against a rule. [Scribe Sample Rule Catalogue](#sample-rule-catalogue) will be used as a default rule bundle for `valint`. ```bash - valint verify busybox:latest --rule sbom/complete-licenses@v2/rules # path within a repo + valint verify busybox:latest --rule sbom/complete-licenses@v2/rules ``` - As a result, you will see the output table of the rule verification. + As a result, you will see the output table of the rule verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section.
@@ -78,7 +76,7 @@ The following is a description of a sample rule bundle that can be used to build
- If you want to use a specific (say, early-access version or outdated) of this catalogue, use `--bundle-tag` flag for `valint`: + If you want to use a specific (say, early-access) version of this catalogue, use `--bundle-tag` flag for `valint`: ```bash valint verify busybox:latest --bundle-tag v2.0.0 --rule sbom/complete-licenses@v2/rules @@ -88,7 +86,10 @@ The following is a description of a sample rule bundle that can be used to build ### Targetless Run - Some of the rules in this catalogue can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../../platforms/overview). + Some of the rules in this catalogue can also be run in "targetless" mode, + meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. + No target for premilinary analysis needed. + This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../../platforms/overview). As an example, let's run `trivy` to create a SARIF report: @@ -109,7 +110,8 @@ The following is a description of a sample rule bundle that can be used to build ``` Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. - In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, so `valint` was able to find it just by this partial context. + In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, + so `valint` was able to find it just by this partial context.
@@ -182,7 +184,7 @@ Evaluation Target Name 'index.docker.io/library/busybox:latest'
-Note that only the rules that are applicable to the target and provided inputs were be verified. Other rules were disabled with a warning: +Note that only the rules that are applicable to the target and the provided inputs were verified. Other rules were disabled with a warning: ```syslog [2025-01-28 17:28:27] WARN rule: [PS.1.1::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found @@ -193,7 +195,9 @@ Note that only the rules that are applicable to the target and provided inputs w [2025-01-28 17:28:27] WARN rule: [PS.1.4::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found ``` -In the SSDF example, to enable other rules verification we need to rune [platforms discovery](../../platforms/overview) for GitHub organizations and repositories first. After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. `platforms` will provide the necessary arguments to `valint` to verify the discovered assets. +In the SSDF example, to enable other rules verification we need to run [platforms discovery](../../platforms/overview) for GitHub organizations and repositories first. +After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. +`platforms` will provide the necessary arguments for `valint` to verify the discovered assets.
@@ -266,7 +270,8 @@ Note that in this case `valint` filtered out `SSDF-IMAGE` rules because it wasn' ### Whole initiative verification -If one wants to verify an initiative on all the existing evidences, they need to provide `valint` with the `--all-evidence` flag. It disables most of rule filterings and for each rule verifies all the matching evidences. +If one wants to verify an initiative on all the existing evidences, they need to provide `valint` with the `--all-evidence` flag. +It disables most of rule filterings and for each rule verifies all the matching evidences. ```bash valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name busybox --product-version v1.36.1 @@ -372,7 +377,7 @@ If you fork this ruleset or create your own, in order to use it you need to spec valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sbom/complete-licenses@v2/rules ``` -## Policy Rule Catalogue +## Sample Rule Catalogue | Rule | Description | Additional Info | | --- | --- | --- | From 81c4af4adb9318e2573a5712cbee92d3acca927d Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 6 Feb 2025 09:26:50 +0200 Subject: [PATCH 023/191] changes suggested by @dn --- docs/guides/enforcing-sdlc-initiative.md | 13 ++++++------- docs/valint/initiatives.md | 5 ++--- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 0d90cfe3b..1e70cc9d0 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -12,7 +12,6 @@ For example, at the end of a build or at the admission control point to the prod - Images must be signed, and they must have a matching CycloneDX SBOM. - Images must be built by a CircleCI workflow and produce a signed SLSA provenance. - Tagged sources must be signed and verified by a set of individuals or processes. -- Released binaries must be built by Azure DevOps from a specific git repository and have unsigned SLSA provenance. For the detailed initiative description, see **[initiatives](../../valint/initiatives)** section. @@ -36,7 +35,7 @@ For the detailed initiative description, see **[initiatives](../../valint/initia - To explore other evidence types, use commands `valint slsa` or `valint evidence`. - Specify `-o attest` for signed evidence. -3. Verify the SBOM against a rule. [Scribe Sample Rule Catalogue](#sample-rule-catalogue) will be used as a default rule bundle for `valint`. +3. Verify the SBOM against an existing rule from a catalog. [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as a default rule bundle for `valint`. ```bash valint verify busybox:latest --rule sbom/complete-licenses@v2/rules @@ -76,7 +75,7 @@ For the detailed initiative description, see **[initiatives](../../valint/initia
- If you want to use a specific (say, early-access) version of this catalogue, use `--bundle-tag` flag for `valint`: + If you want to use a specific (say, early-access) version of this catalog, use `--bundle-tag` flag for `valint`: ```bash valint verify busybox:latest --bundle-tag v2.0.0 --rule sbom/complete-licenses@v2/rules @@ -86,7 +85,7 @@ For the detailed initiative description, see **[initiatives](../../valint/initia ### Targetless Run - Some of the rules in this catalogue can also be run in "targetless" mode, + Some of the rules in this catalog can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../../platforms/overview). @@ -366,9 +365,9 @@ The results of the initiative verification are also presented in a table format. - `RULE LIST`: The list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In the parentheses, the rule's result is shown in the format `rule_id(level->result)`. - `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". -## Modifying Rules in This Catalogue +## Modifying Rules in This Catalog -Each rule in this catalogue consists of a `rego` script and `yaml` configuration file. +Each rule in this catalog consists of a `rego` script and `yaml` configuration file. In order to run a rule, its script file should be referred by a rule config. Each `.yaml` represents such a config and is ready for use. If you modify or add your own rules, don't forget to fulfill this requirement. If you fork this ruleset or create your own, in order to use it you need to specify its location in `valint` flag `--bundle` either in cmd args or a `valint.yaml` config file: @@ -377,7 +376,7 @@ If you fork this ruleset or create your own, in order to use it you need to spec valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sbom/complete-licenses@v2/rules ``` -## Sample Rule Catalogue +## Sample Rule Catalog | Rule | Description | Additional Info | | --- | --- | --- | diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 3cd08ac99..773e14240 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -13,9 +13,8 @@ toc_max_heading_level: 3 Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` that your supply chain must comply with. The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluatoin results and references to the verified assets and evidences. An initiative consists of a set of `controls`, each of which in turn consists of a set of `rules` and is verified if all of them are evaluated and verified. -A `rule` is verified if ANY `evidence` is found that complies with the `rule` configuration and setting. -Rules can reuse from the existing ones from a bundle or be defined inline. +Rules can reuse the existing ones from a bundle or be defined inline. ## Initiative config format @@ -591,6 +590,6 @@ fail-on-missing-evidence: true ... ``` -### Unicode symbols in rule results +### Unicode strings in rule results To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. THis would result in replacing rule levels and results in `valint` logs with emojis. From b42be277d282af483ee517a527daf33327e20e3b Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 6 Feb 2025 09:27:04 +0200 Subject: [PATCH 024/191] added defaults to rule/initiative configs --- docs/valint/initiatives.md | 38 +++++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 773e14240..446d259a4 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -60,12 +60,14 @@ controls: - **Required:** No - **Description:** The minimum version of Valint required to run the initiative. - **Example:** `"2.0.0"` +- **Default**: No `valint` version matching check is performed #### `id` - **Type:** String - **Required:** No -- **Description:** A unique identifier for the initiative. Cannot contain the `::` symbol. If no ID is provided, it is generated from the name. +- **Description:** A unique identifier for the initiative. Cannot contain the `::` string. If no ID is provided, it is generated from the name. +- **Default**: No `id` is provided, the value is calculated from the `name` field #### `name` @@ -78,42 +80,49 @@ controls: - **Type:** String - **Required:** No - **Description:** The version of the initiative. +- **Default**: If no value is provided, iniitiative versioning is not applied. #### `description` - **Type:** String - **Required:** No - **Description:** A brief description of the initiative. +- **Default**: If no value is provided, the value is ommited in the output data. #### `help` - **Type:** String (URL) - **Required:** No - **Description:** A URL pointing to the help or documentation for the initiative. +- **Default**: If no value is provided, the value is ommited in the output data. #### `defaults` - **Type:** Object - **Required:** No - **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. +- **Default**: If no value is provided, the rules' values are used. ##### `defaults.level` - **Type:** String - **Required:** No - **Description:** Rule level to use for all rules in the initiative +- **Default**: If no value is provided, the original rules' levels are used. ##### `defaults.evidence` - **Type:** Object - **Required:** No -- **Description:** Evidence lookup parameters. Any parameters supported by the `rule.evidence` field can be used here. +- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. +- **Default**: If no value is provided, the rules' values are used. #### `env` - **Type:** Object - **Required:** No - **Description:** File-wise environment variables for the template engine. +- **Default**: If no value is provided, only the vars from the actual environment are used. #### `controls` @@ -131,7 +140,7 @@ controls: - **Type:** String - **Required:** No -- **Description:** A unique identifier for the control. Cannot contain the `::` symbol. If no ID is provided, it is generated from the name. +- **Description:** A unique identifier for the control. Cannot contain the `::` string. If no ID is provided, it is generated from the name. ##### `controls[].description` @@ -143,6 +152,7 @@ controls: - **Type:** Boolean - **Required:** No +- **Default:** `false` - **Description:** Indicates whether the control should be disabled. If set to `true`, the control will not be evaluated. ##### `controls[].when` @@ -150,12 +160,14 @@ controls: - **Type:** Object - **Required:** No - **Description:** Optional filters for when the control should be run. +- **Default**: If no value is provided, no user-defined control filters are applied. ###### `controls[].when.gate` - **Type:** String - **Required:** No - **Description:** The type of gate to run the control on. +- **Default**: If no value is provided, the control will run on all gates. ##### `controls[].rules` @@ -252,19 +264,22 @@ with: {} - **Type:** String - **Required:** No - **Description:** The minimum version of Valint required to run the initiative. +- **Default**: No `valint` version matching check is performed. - **Example:** `"2.0.0"` #### `disable` - **Type:** Boolean - **Required:** No +- **Default:** `false` - **Description:** Indicates whether the rule should be disabled. If set to `true`, the rule will not be evaluated. #### `id` - **Type:** String - **Required:** No -- **Description:** A unique identifier for the rule. Cannot contain the `::` symbol. Must be unique within the initiative. If no ID is provided, it is generated from the name. +- **Description:** A unique identifier for the rule. Cannot contain the `::` string. Must be unique within the initiative. If no ID is provided, it is generated from the name. +- **Default**: If no value is provided, it is generated from the name. #### `name` @@ -277,78 +292,91 @@ with: {} - **Type:** String - **Required:** No - **Description:** The path to a custom external script, if used. Should be relative to the rule file. +- **Default**: If no value is provided, no external script file is used for the rule. #### `uses` - **Type:** String - **Required:** No -- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@/rules`. +- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@/rules`. When used, the current rule's values will override the external rule's ones. +- **Default**: If no value is provided, no external rule is used as a base rule. #### `description` - **Type:** String - **Required:** No - **Description:** A brief description of the rule. +- **Default**: If no value is provided, the value is ommited in the output data. #### `help` - **Type:** String (URL) - **Required:** No - **Description:** A URL pointing to the help or documentation for the rule. +- **Default**: If no value is provided, the value is ommited in the output data. #### `labels` - **Type:** Array of Strings - **Required:** No - **Description:** A list of user-specified labels for the rule itself. +- **Default**: No labels used. #### `level` - **Type:** String - **Required:** No - **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. +- **Default**: `error` #### `require-scribe-api` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the Scribe API is required. +- **Default**: `false` #### `fail-on-missing-evidence` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the open result if no evidence is found. +- **Default**: `false` #### `skip-evidence` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule should skip evidence downloading and go straight to the rule evaluation. Can be helpful for rules that don't require evidence, like API rules. +- **Default**: `false` #### `aggregate-results` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule results should be aggregated. If set to `true`, the rule will return a single result for all the violations found. +- **Default**: `false #### `evidence` - **Type:** Object - **Required:** No - **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. +- **Default**: No user specified options will be used for the evidence lookup. ##### `evidence.filter-by` - **Type:** List of Strings - **Required:** No - **Description:** A list of parameters in the environment to filter the evidence by (see [Evidence Lookup](#evidence-lookup)). +- **Default**: `[target, product]` #### `with` - **Type:** Object - **Required:** No - **Description:** Rule input, depending on the rule script. +- **Default**: Depends on the rule script. Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). From 928e8434288cfb9b4cedc078aff58bf44d082a33 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 6 Feb 2025 09:47:32 +0200 Subject: [PATCH 025/191] small changes following @dn suggestions --- docs/valint/initiatives.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 446d259a4..241617700 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -319,7 +319,7 @@ with: {} - **Type:** Array of Strings - **Required:** No -- **Description:** A list of user-specified labels for the rule itself. +- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. - **Default**: No labels used. #### `level` @@ -382,7 +382,7 @@ Examples of rules and initiatives can be found in the [sample-policies bundle](h ## How to adopt an initiative? -An initiative is defined as a file that can be consumed locally or from a git bundle. To run an initiative, one first needs to create the required evidences: +An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required evidences: 1. Generate an SBOM @@ -421,7 +421,7 @@ To run a part of an initiative filtered by gate type, use the following command: valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P --gate-type Build --gate-name "Build of My Product" ``` -## Using private bundle +## Using a private bundle Rules and initiatives can be provided locally or reused either from the public Scribe bundle or a private bundle managed by the user. By default, the public Scribe bundle is used. To use a private bundle instead, the following rules should be followed: @@ -620,4 +620,4 @@ fail-on-missing-evidence: true ### Unicode strings in rule results -To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. THis would result in replacing rule levels and results in `valint` logs with emojis. +To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. This would result in replacing rule levels and results in `valint` logs with emojis. From e9aba982982ff9ba458b8a7279dbd2e9151a0df4 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 11 Feb 2025 16:53:04 +0200 Subject: [PATCH 026/191] refactor initiatives guide --- docs/guides/enforcing-sdlc-initiative.md | 250 +++++++++-------------- 1 file changed, 91 insertions(+), 159 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 1e70cc9d0..451006c00 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -13,11 +13,11 @@ For example, at the end of a build or at the admission control point to the prod - Images must be built by a CircleCI workflow and produce a signed SLSA provenance. - Tagged sources must be signed and verified by a set of individuals or processes. -For the detailed initiative description, see **[initiatives](../../valint/initiatives)** section. +For the detailed initiative description, see **[initiatives](../valint/initiatives)** section. ## Quickstart -### Running a single rule verification +### Creating an SBOM 1. Install `valint`: @@ -25,20 +25,85 @@ For the detailed initiative description, see **[initiatives](../../valint/initia curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -t valint ``` -2. Create an SBOM of a type you want to verify +2. Create an SBOM of a type you want to verify. For a Docker image the command would be: + + ```bash + valint bom busybox:latest -o statement --product-key -- product-version --scribe.client-secret + ``` + + It's also possible to create an SBOM from a git repository (if git authentication is required, provide it with the `--git-auth` flag): + + ```bash + valint bom git:path/togit/repo -o statement --product-key -- product-version --scribe.client-secret + ``` + + And from a file: + + ```bash + valint bom file:/path/to/file.artifact -o statement --product-key -- product-version --scribe.client-secret + ``` + +Alternatively, you can use GitHub actions, as described in details in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md). + +### Verifying an initiative + +1. Create an image SBOM as described in [Creating an SBOM](#creating-an-sbom). + +2. Verify the SBOM against an initiative. Let's take the SSDF initiative provided in the [Scribe Sample Catalog](#sample-rule-catalog): + + ```bash + valint verify busybox:latest --initiative ssdf@v2/initiatives --product-key -- product-version --scribe.client-secret + ``` + + As a result, you will see the output table of the initiative verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. + +
+ + Initiative results ```bash - valint bom busybox:latest -o statement + [2025-01-28 17:28:29] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: + ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ + ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ + │ PS.2 │ Image-verifiable │ error │ false │ pass │ Evidence signature verified │ busybox:1.36.1 │ + ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ + │ PS.3.2 │ SBOM archived │ error │ false │ pass │ Evidence signature verified │ busybox:1.36.1 │ + ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ + │ CONTROL RESULT │ │ │ │ PASS │ │ │ + └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ + Evaluation Target Name 'index.docker.io/library/busybox:latest' + + [2025-01-28 17:28:29] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: + ┌──────────────────────────────────────────────────────────────────┐ + │ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ + ├───────────────────┬───────────────┬─────────────────────┬────────┤ + │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ + ├───────────────────┼───────────────┼─────────────────────┼────────┤ + │ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ + │ │ │ PS.3.2(error->pass) │ │ + ├───────────────────┼───────────────┼─────────────────────┼────────┤ + │ INITIATIVE RESULT │ │ │ PASS │ + └───────────────────┴───────────────┴─────────────────────┴────────┘ ``` - Additional options: - - To explore other evidence types, use commands `valint slsa` or `valint evidence`. - - Specify `-o attest` for signed evidence. +
-3. Verify the SBOM against an existing rule from a catalog. [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as a default rule bundle for `valint`. + > Note that only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically and no result was generated for them. + > To verify the whole SSDF initiative, you need to run GitHub discovery, see [platforms discovery](../platforms/overview). + +### Running a single rule verification + +Similar to [initiatives](#verifying-an-initiative), you can verify a single rule. Let's take as an example the `sbom-require-complete-license-set` rule from the [Scribe Sample Catalog](#sample-rule-catalog): + +1. Create an image SBOM as described in [Creating an SBOM](#creating-an-sbom). + +2. Verify the SBOM against an existing rule from the bundle. [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as a default rule bundle for `valint`. ```bash - valint verify busybox:latest --rule sbom/complete-licenses@v2/rules + valint verify busybox:latest --rule sbom/complete-licenses@v2/rules --product-key -- product-version --scribe.client-secret ``` As a result, you will see the output table of the rule verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. @@ -75,13 +140,8 @@ For the detailed initiative description, see **[initiatives](../../valint/initia
- If you want to use a specific (say, early-access) version of this catalog, use `--bundle-tag` flag for `valint`: - - ```bash - valint verify busybox:latest --bundle-tag v2.0.0 --rule sbom/complete-licenses@v2/rules - ``` - - > By default, `valint` uses the version of the catalog matching the version of the `valint` binary. + > Note that the rule was put in the `client-initiative` initiative. To change that, you can use the `--initiative-name` and `--initiative-id` flags. + > It was also put in the `default` control. This cannot be changed unless you provide a full initiative config with custom names and IDs for your controls. ### Targetless Run @@ -99,17 +159,17 @@ For the detailed initiative description, see **[initiatives](../../valint/initia Then, create an evidence from this report: ```bash - valint evidence results.sarif --product-name ubuntu --product-version 24.04 + valint evidence results.sarif --product-key -- product-version --scribe.client-secret ``` And finally, verify the evidence against the rule. Note that we don't need to provide `valint `with the target report: ```bash - valint verify --rule sarif/trivy/verify-trivy-report@v2/rules --product-name ubuntu --product-version 24.04 + valint verify --rule sarif/trivy/verify-trivy-report@v2/rules --product-key -- product-version --scribe.client-secret ``` - Valint will use the latest evidence for the specified product name and version that meets the other rule requirements. - In our example, the rule required for an evidence created by the "Trivy Vulnerability Scanner" tool, + `valint` will use the latest evidence for the specified product name and version that meets the other rule requirements. + In our example, the rule needs an evidence created by the "Trivy Vulnerability Scanner" tool, so `valint` was able to find it just by this partial context.
@@ -140,140 +200,13 @@ For the detailed initiative description, see **[initiatives](../../valint/initia
-### Verify Initiative - -Similar to a single rule, one can verify an initiative. Let's take as an example the SSDF initiative available in the sample bundle as `ssdf@v2/initiatives`. -The following command will *try to* verify all rules in the initiative: - -```bash -valint verify busybox:latest --initiative ssdf@v2/initiatives -``` - -
- -Initiative results - -```bash -[2025-01-28 17:28:29] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ -├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ CONTROL RESULT │ │ │ │ PASS │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ -Evaluation Target Name 'index.docker.io/library/busybox:latest' - -[2025-01-28 17:28:29] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────┐ -│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ -├───────────────────┬───────────────┬─────────────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────┼───────────────┼─────────────────────┼────────┤ -│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ -│ │ │ PS.3.2(error->pass) │ │ -├───────────────────┼───────────────┼─────────────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ PASS │ -└───────────────────┴───────────────┴─────────────────────┴────────┘ -``` - -
- -Note that only the rules that are applicable to the target and the provided inputs were verified. Other rules were disabled with a warning: - -```syslog -[2025-01-28 17:28:27] WARN rule: [PS.1.1::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found -[2025-01-28 17:28:27] WARN rule: [PS.1.3::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found -[2025-01-28 17:28:27] WARN rule: [PS.1.5::SSDF-ORG::SSDF] failed to evaluate rule args, Err: no policy args found -[2025-01-28 17:28:27] WARN control: [SSDF-ORG::SSDF] no rules enabled, skipping control -[2025-01-28 17:28:27] WARN rule: [PS.1.2::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found -[2025-01-28 17:28:27] WARN rule: [PS.1.4::SSDF-REPO::SSDF] failed to evaluate rule args, Err: no policy args found -``` - -In the SSDF example, to enable other rules verification we need to run [platforms discovery](../../platforms/overview) for GitHub organizations and repositories first. -After the discovery is ready, we need to also use the `platforms` util to verify the initiative on them. -`platforms` will provide the necessary arguments for `valint` to verify the discovered assets. - -
- -Initiative results - -### For GitHub organization - -```bash -[2025-01-28 17:50:36] INFO Control "SSDF-ORG. SSDF ORG" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-ORG. SSDF ORG" Evaluation Summary │ -├────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.1 │ Enforce 2FA │ error │ true │ pass │ 2FA authentication is enabled │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.3 │ Limit admins │ error │ true │ fail │ 9 admins | 3 max allowed │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ FAIL │ │ │ -└────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ - -[2025-01-28 17:50:36] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: -┌───────────────────────────────────────────────────────────────────┐ -│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ -├───────────────────┬───────────────┬──────────────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-ORG │ SSDF ORG │ PS.1.1(error->pass), │ fail │ -│ │ │ PS.1.3(error->fail), │ │ -│ │ │ PS.1.5(error->fail) │ │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ FAIL │ -└───────────────────┴───────────────┴──────────────────────┴────────┘ -``` - -### For GitHub repository - -```bash -[2025-01-28 17:50:36] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: -┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary │ -├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────────────────────────┬───────────────────────────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/my-repo (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/my-repo (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ FAIL │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘ - -[2025-01-28 17:50:36] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: -┌───────────────────────────────────────────────────────────────────┐ -│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ -├───────────────────┬───────────────┬──────────────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-REPO │ SSDF REPO │ PS.1.2(error->fail), │ fail │ -│ │ │ PS.1.4(error->pass) │ │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ FAIL │ -└───────────────────┴───────────────┴──────────────────────┴────────┘ -``` - -
- -Note that in this case `valint` filtered out `SSDF-IMAGE` rules because it wasn't provided with the right target. - ### Whole initiative verification -If one wants to verify an initiative on all the existing evidences, they need to provide `valint` with the `--all-evidence` flag. +If you want to verify an initiative on all the existing evidences, provide `valint` with the `--all-evidence` flag. It disables most of rule filterings and for each rule verifies all the matching evidences. ```bash -valint verify --initiative ssdf@v2/initiatives --all-evidence --product-name busybox --product-version v1.36.1 +valint verify --initiative ssdf@v2/initiatives --all-evidence --product-key -- product-version --scribe.client-secret ```
@@ -365,18 +298,12 @@ The results of the initiative verification are also presented in a table format. - `RULE LIST`: The list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In the parentheses, the rule's result is shown in the format `rule_id(level->result)`. - `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". -## Modifying Rules in This Catalog - -Each rule in this catalog consists of a `rego` script and `yaml` configuration file. -In order to run a rule, its script file should be referred by a rule config. Each `.yaml` represents such a config and is ready for use. If you modify or add your own rules, don't forget to fulfill this requirement. - -If you fork this ruleset or create your own, in order to use it you need to specify its location in `valint` flag `--bundle` either in cmd args or a `valint.yaml` config file: +## Sample Rule Catalog -```bash -valint verify busybox:latest --bundle https://github.com/scribe-public/sample-policies --rule sbom/complete-licenses@v2/rules -``` +We provide a set of sample rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. +To use a different version of this catalog, use the `--bundle-tag` valint flag. -## Sample Rule Catalog +To use a custom rule catalog, you can specify the path to the catalog in the `--bundle` flag (may it be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo. | Rule | Description | Additional Info | | --- | --- | --- | @@ -415,6 +342,11 @@ Most of the policy rules in this bundle consist of two files: a `.yaml` and a `. The first is a rule configuration file that should be referenced by on runtime or merged to the actual `valint.yaml`. The second is a rego script that contains the actual verifyer code. It can be used as is or merged to the `.yaml` using `script` option. +#### Modifying rules in the Catalog + +Each rule in this catalog consists of a `rego` script and `yaml` configuration file. +In order to run a rule, its script file should be referred by a rule config. Each `.yaml` represents such a config and is ready for use. + ### SBOM An example of creating an SBOM evidence: From 5308aadc2174d8968a7578dda2ac790cb815d7d7 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 11 Feb 2025 17:20:48 +0200 Subject: [PATCH 027/191] fix --- docs/guides/enforcing-sdlc-initiative.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 451006c00..6cab03965 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -148,7 +148,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule Some of the rules in this catalog can also be run in "targetless" mode, meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. No target for premilinary analysis needed. - This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../../platforms/overview). + This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../platforms/overview). As an example, let's run `trivy` to create a SARIF report: From 2cec32c89f50f684bf22a78cffc9ee0c50b6d6a2 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 11 Feb 2025 17:39:38 +0200 Subject: [PATCH 028/191] multiline valint --- docs/guides/enforcing-sdlc-initiative.md | 32 ++++++++++++++++++------ 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 6cab03965..b4bd0f1df 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -28,19 +28,25 @@ For the detailed initiative description, see **[initiatives](../valint/initiativ 2. Create an SBOM of a type you want to verify. For a Docker image the command would be: ```bash - valint bom busybox:latest -o statement --product-key -- product-version --scribe.client-secret + valint bom busybox:latest -o statement \ + --product-key -- product-version \ + --scribe.client-secret ``` It's also possible to create an SBOM from a git repository (if git authentication is required, provide it with the `--git-auth` flag): ```bash - valint bom git:path/togit/repo -o statement --product-key -- product-version --scribe.client-secret + valint bom git:path/togit/repo -o statement \ + --product-key -- product-version \ + --scribe.client-secret ``` And from a file: ```bash - valint bom file:/path/to/file.artifact -o statement --product-key -- product-version --scribe.client-secret + valint bom file:/path/to/file.artifact -o statement \ + --product-key -- product-version \ + --scribe.client-secret ``` Alternatively, you can use GitHub actions, as described in details in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md). @@ -52,7 +58,9 @@ Alternatively, you can use GitHub actions, as described in details in [Setting u 2. Verify the SBOM against an initiative. Let's take the SSDF initiative provided in the [Scribe Sample Catalog](#sample-rule-catalog): ```bash - valint verify busybox:latest --initiative ssdf@v2/initiatives --product-key -- product-version --scribe.client-secret + valint verify busybox:latest --initiative ssdf@v2/initiatives \ + --product-key -- product-version \ + --scribe.client-secret ``` As a result, you will see the output table of the initiative verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. @@ -103,7 +111,9 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule 2. Verify the SBOM against an existing rule from the bundle. [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as a default rule bundle for `valint`. ```bash - valint verify busybox:latest --rule sbom/complete-licenses@v2/rules --product-key -- product-version --scribe.client-secret + valint verify busybox:latest --rule sbom/complete-licenses@v2/rules \ + --product-key -- product-version \ + --scribe.client-secret ``` As a result, you will see the output table of the rule verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. @@ -159,13 +169,17 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule Then, create an evidence from this report: ```bash - valint evidence results.sarif --product-key -- product-version --scribe.client-secret + valint evidence results.sarif \ + --product-key -- product-version \ + --scribe.client-secret ``` And finally, verify the evidence against the rule. Note that we don't need to provide `valint `with the target report: ```bash - valint verify --rule sarif/trivy/verify-trivy-report@v2/rules --product-key -- product-version --scribe.client-secret + valint verify --rule sarif/trivy/verify-trivy-report@v2/rules \ + --product-key -- product-version \ + --scribe.client-secret ``` `valint` will use the latest evidence for the specified product name and version that meets the other rule requirements. @@ -206,7 +220,9 @@ If you want to verify an initiative on all the existing evidences, provide `vali It disables most of rule filterings and for each rule verifies all the matching evidences. ```bash -valint verify --initiative ssdf@v2/initiatives --all-evidence --product-key -- product-version --scribe.client-secret +valint verify --initiative ssdf@v2/initiatives --all-evidence \ + --product-key -- product-version \ + --scribe.client-secret ```
From 44d3a320281ee3c0c425961791cc7ef096d510bb Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 12 Feb 2025 15:04:34 +0200 Subject: [PATCH 029/191] multiline valint --- docs/valint/initiatives.md | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 241617700..0c4461358 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -387,38 +387,51 @@ An initiative is defined as a file that can be consumed locally or from an exter 1. Generate an SBOM ```bash -valint bom : --product-key --product-version -P +valint bom : \ + --product-key -- product-version \ + --scribe.client-secret ``` 2. Generate SLSA Provenance ```bash -valint slsa : --product-key --product-version -P +valint slsa : \ + --product-key -- product-version \ + --scribe.client-secret ``` 3. Create generic evidences from 3rd party tool reports: ```bash -valint evidence --product-key --product-version -P +valint evidence \ + --product-key -- product-version \ + --scribe.client-secret ``` ------------------- Then, a local initiative can be run with the following command: ```bash -valint verify --initiative initiative.yaml --product-key --product-version -P +valint verify --initiative initiative.yaml \ + --product-key -- product-version \ + --scribe.client-secret ``` To run an initiative from a git bundle, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P +valint verify --initiative my-initiative@v2/initiatives \ + --product-key -- product-version \ + --scribe.client-secret ``` To run a part of an initiative filtered by gate type, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives --product-key --product-version -P --gate-type Build --gate-name "Build of My Product" +valint verify --initiative my-initiative@v2/initiatives \ + --product-key -- product-version \ + --scribe.client-secret \ + --gate-type Build --gate-name "Build of My Product" ``` ## Using a private bundle @@ -573,7 +586,9 @@ List of supported functions: One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: ```bash -valint verify --initiative my-initiative@v2/initiatives --product-key --product-version --all-evidence +valint verify --initiative my-initiative@v2/initiatives --all-evidence \ + --product-key -- product-version \ + --scribe.client-secret ``` If template args are used within the initiative, they should be defined through built-in functions that disable filtering when the `--all-evidence` flag is used. For example, the following example filters evidence by label only when the `--all-evidence` flag is not used: From 198df9557b792477970e6200caa8a74b42d9a621 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 3 Mar 2025 16:19:27 +0200 Subject: [PATCH 030/191] fixes & improvements --- docs/valint/initiatives.md | 154 ++++++++++++++++++++++++++++++------- 1 file changed, 128 insertions(+), 26 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 0c4461358..96322f836 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -100,14 +100,14 @@ controls: - **Type:** Object - **Required:** No -- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. +- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. it is recommended to start adopting initiative with the `defaults.signed` value set to `false` and move it to `true` when certificates and keys are deployed. - **Default**: If no value is provided, the rules' values are used. ##### `defaults.level` - **Type:** String - **Required:** No -- **Description:** Rule level to use for all rules in the initiative +- **Description:** Rule level to use for all rules in the initiative. It is recommended to start with a `warning` level and only after the security controls have been adopted move it to "error". - **Default**: If no value is provided, the original rules' levels are used. ##### `defaults.evidence` @@ -319,28 +319,28 @@ with: {} - **Type:** Array of Strings - **Required:** No -- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. +- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be ran if at least one of it's labels matches one of the `--rule-label` values. - **Default**: No labels used. #### `level` - **Type:** String - **Required:** No -- **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. +- **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. The levels affect how rule results affect the overall initiative result: `valint` run overall would fail only if there are `error` level violations. Results on Scribe Hub are also displayed according to the levels. - **Default**: `error` #### `require-scribe-api` - **Type:** Boolean - **Required:** No -- **Description:** Indicates whether the Scribe API is required. +- **Description:** Indicates whether the Scribe API is required. See the details in the [Rules that require Scribe API](#rules-that-require-scribe-api) section. - **Default**: `false` #### `fail-on-missing-evidence` - **Type:** Boolean - **Required:** No -- **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the open result if no evidence is found. +- **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the `open` result if no evidence is found. - **Default**: `false` #### `skip-evidence` @@ -361,7 +361,7 @@ with: {} - **Type:** Object - **Required:** No -- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. +- **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. See the [Evidence Lookup](#evidence-lookup) section for more details. - **Default**: No user specified options will be used for the evidence lookup. ##### `evidence.filter-by` @@ -507,29 +507,106 @@ These parameters can be set manually by the user or automatically derived from t Parameters that can be derived automatically are categorized into three context groups: "target," "pipeline", and "product". By default, the "target" and "product" groups are enabled for each rule. -1. `target` context group specifies parameters that can be derived from the provided target. Those parameters are: - * `target_type` - the type of the target provided (e.g., image, git, generic etc.) - * `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) +1. `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo, etc). These parameters are: + - `target_type` - the type of the target provided (e.g., image, git, generic etc.) + - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) > If this parameter is set and no target provided, the rule is disabled with a warning. -2. `pipeline` context group specifies parameters that can be derived from the running environment. Those parameters are: - * `context_type` - type of the environment (e.g., local, github, etc.) - * `git_url` - git url of the repository (if any) - * `git_commit` - git commit of the current repository state (if any) - * `run_id` - run id - * `build_num` - build number +2. `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: + - `context_type` - type of the environment (e.g., local, github, etc.) + - `git_url` - git url of the repository (if any) + - `git_commit` - git commit of the current repository state (if any) + - `run_id` - run id + - `build_num` - build number -3. `product` context group specifies product parameters that can be derived from the command line arguments. Those parameters are: - * `name` - name of the product - * `product_version` - version of the product - * `predicate_type` - type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) +3. `product` context group specifies product parameters that can be derived from the command line arguments. These parameters are: + - `name` - name of the product + - `product_version` - version of the product + - `predicate_type` - type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. -By default `target` and `product` groups are used. +By default, `target` and `product` groups are used. The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. -In addition, one can manually specify any parameters that they want to be matched by an evidence. For example, these can be `git_url` or `timestamp`. +In addition, one can manually specify any parameters that they want to be matched by an evidence. +In the most rules, the following parameters would be used to define the type of the attestation: + +- `signed` -- to specify if the evidence is required to be signed (when set to `false`, both signed and unsigned evidences are accepted and signature verification for the signed ones failure doesn't affect the rule result) +- `content_body_type` -- to defined the content type of the attestation, for example, `cyclonedx-json`, `generic`, `slsa`. +- `target_type` -- the type of the target that was used to create the evidence, for example, `container` for docker images, `git` for git repositories, `policy-results` for `valint` SARIF attestations, `data` for generic data files. +- `predicate_type`: the type of the predicate used in a `generic` evidence, usually a URI, for example, `http://scribesecurity.com/evidence/discovery/v0.1`, `http://docs.oasis-open.org/sarif/sarif/2.1.0`. + +The following example requires an unsigned attestation of a Scribe Security discovery evidence: + +```yaml +... +evidence: + signed: false + content_body_type: generic + target_type: data + predicate_type: http://scribesecurity.com/evidence/discovery/v0.1 +... +``` + +
+ Full list of specified parameters + +The parameters are named the same way as they are in the evidence context. + +```yaml +name +context_type +input_scheme +input_name +input_tag +predicate_type +product_version +pipeline_name +gate_type +gate_name +deliverable +tool +parser +tool_version +tool_vendor +content_body_type +format_type +format_version +format_encoding +labels +signed + +workflow +job_name +run_id +build_num +actor + +git_url +git_branch +git_tag +git_commit +git_ref +git_uuid + +sbomtype +sbomgroup +sbomname +sbomversion +sbompurl +sbomcomponents + +target_git_url +target_git_branch +target_git_tag +target_git_commit +target_git_ref +target_type +``` + +
+ If more than one evidence is found, the newest one is used. @@ -576,10 +653,29 @@ To simplify the rule-args input, the rules template engine has built-in function List of supported functions: -* `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below -* `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name` -* `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used -* `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead +- `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below +- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name` +- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used +- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead + +
+ Example + +In the following rule, `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: + +```yaml +... +with: + defaults: + evidence: + labels: + - '{{ asset .Args.MyAsset }}' +... +``` + +When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will use the `asset=MyAssetValue` label for the evidence lookup. + +
### Whole product evaluation @@ -603,6 +699,9 @@ with: ... ``` +Also, in this mode the target provided doesn't affect evidence lookup, as `valint` tries to find all the matching evidence for the rules. +For the rules that failed to find any evidence, the `open` result is returned. + ### Rules that don't require evidence If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule config: @@ -623,6 +722,9 @@ require-scribe-api: true ... ``` +`valint` will try to reach the Scribe API and wait for it to be ready. Waiting timeout is set by the `--timeout` flag and defaults to 2 minutes. +If the API is not ready, the rule will produce the `open` result the same way as when no evidence is found. This can be changed with the `fail-on-missing-evidence` flag, see the [Rules that should fail on missing evidence](#rules-that-should-fail-on-missing-evidence) section. + ### Rules that should fail on missing evidence By default, if no evidence for a rule found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used: From 8de3f1d184daeac387b5fd235f612d4c40fb088b Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 3 Mar 2025 17:52:22 +0200 Subject: [PATCH 031/191] fixes & improvements --- docs/valint/initiatives.md | 57 ++++++++++++++++++++++++++------------ 1 file changed, 39 insertions(+), 18 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 96322f836..f0c7f5d11 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -504,14 +504,14 @@ asset := scribe.get_asset_data(input.evidence) In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. These parameters can be set manually by the user or automatically derived from the context. -Parameters that can be derived automatically are categorized into three context groups: "target," "pipeline", and "product". -By default, the "target" and "product" groups are enabled for each rule. +Parameters that can be derived automatically are categorized into three context groups: `target,` `pipeline`, and `product`. +By default, the `target` and `product` groups are enabled for each rule. 1. `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo, etc). These parameters are: - `target_type` - the type of the target provided (e.g., image, git, generic etc.) - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) - > If this parameter is set and no target provided, the rule is disabled with a warning. + > _If this parameter is set and no target provided, the rule is disabled with a warning._ 2. `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: - `context_type` - type of the environment (e.g., local, github, etc.) @@ -529,13 +529,17 @@ User can specify any combination of these three groups or a special value `none` By default, `target` and `product` groups are used. The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. -In addition, one can manually specify any parameters that they want to be matched by an evidence. -In the most rules, the following parameters would be used to define the type of the attestation: +--- + +In addition, one can ***manually*** specify any parameters that they want to be matched by an evidence. +In most of the rules, the following parameters would be used to define the type of the attestation: -- `signed` -- to specify if the evidence is required to be signed (when set to `false`, both signed and unsigned evidences are accepted and signature verification for the signed ones failure doesn't affect the rule result) -- `content_body_type` -- to defined the content type of the attestation, for example, `cyclonedx-json`, `generic`, `slsa`. -- `target_type` -- the type of the target that was used to create the evidence, for example, `container` for docker images, `git` for git repositories, `policy-results` for `valint` SARIF attestations, `data` for generic data files. -- `predicate_type`: the type of the predicate used in a `generic` evidence, usually a URI, for example, `http://scribesecurity.com/evidence/discovery/v0.1`, `http://docs.oasis-open.org/sarif/sarif/2.1.0`. +| Field | Description | Examples | +|--------------------|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| +| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned evidences are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | +| `content_body_type`| Defines the content type of the attestation. | `cyclonedx-json`, `generic`, `slsa` | +| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIF attestations
`data` for generic data files | +| `predicate_type` | The type of the predicate used in a `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | The following example requires an unsigned attestation of a Scribe Security discovery evidence: @@ -550,9 +554,9 @@ evidence: ```
- Full list of specified parameters + Full list of supported parameters -The parameters are named the same way as they are in the evidence context. +The parameters are named the same way as they are in the evidence context. ```yaml name @@ -613,17 +617,34 @@ If more than one evidence is found, the newest one is used.
Usage -An example of using the `target` context group and a specific timestamp value is shown below: +An example of a rule that requires a signed CycloneDX SBOM evidence and uses target and product contexts would look like this: ```yaml config-type: rule -name: my_rule +name: "My Rule" +id: my-rule + evidence: signed: true - content_body_type: cyclonedx - timestamp: "2023-11-16T09:46:25+02:00" # manually specified timestamp + content_body_type: "cyclonedx-json" + target_type: "container" filter-by: - - target + - target + - product +``` + +When running this rule on the `alpine:latest` image target for the `MyProduct` product of the `v1.0.0` version, the evidence lookup would be performed with the following parameters: + +```json +{ + "name": "MyProduct", + "product_version": "v1.0.0", + "content_body_type": "cyclonedx-json", + "signed": true, + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "target_type": "container", + "sbomversion": "sha256:8ca4688f4f356596b5ae539337c9941abc78eda10021d35cbc52659c74d9b443" +} ```
@@ -699,8 +720,8 @@ with: ... ``` -Also, in this mode the target provided doesn't affect evidence lookup, as `valint` tries to find all the matching evidence for the rules. -For the rules that failed to find any evidence, the `open` result is returned. +Also, in this mode, the provided target doesn't affect evidence lookup, as `valint` tries to find all matching evidence for the rules. +For the rules that fail to find any evidence, the `open` result is returned. ### Rules that don't require evidence From d4c91e830ce681e55fee0a367fcb717743bf80d8 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 3 Mar 2025 19:03:33 +0200 Subject: [PATCH 032/191] grammar fixes --- docs/valint/initiatives.md | 178 ++++++++++++++++++------------------- 1 file changed, 89 insertions(+), 89 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index f0c7f5d11..65ae891e4 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -1,6 +1,6 @@ --- -sidebar_label: "Adopting intiatives" -title: Adopting intiatives +sidebar_label: "Adopting initiatives" +title: Adopting initiatives author: viktor kartashov - Scribe sidebar_position: 5 date: December 10, 2024 @@ -10,11 +10,12 @@ toc_max_heading_level: 3 ## What is an initiative? -Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` that your supply chain must comply with. The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluatoin results and references to the verified assets and evidences. +Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` with which your supply chain must comply. +The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluation results and references the verified assets and attestations. An initiative consists of a set of `controls`, each of which in turn consists of a set of `rules` and is verified if all of them are evaluated and verified. -Rules can reuse the existing ones from a bundle or be defined inline. +Rules can reuse existing ones from a bundle or be defined inline. ## Initiative config format @@ -30,7 +31,7 @@ help: defaults: evidence: signed: - content_body_type: content_body_type> + content_body_type: filter-by: [] env: @@ -60,14 +61,14 @@ controls: - **Required:** No - **Description:** The minimum version of Valint required to run the initiative. - **Example:** `"2.0.0"` -- **Default**: No `valint` version matching check is performed +- **Default:** No `valint` version matching check is performed. #### `id` - **Type:** String - **Required:** No - **Description:** A unique identifier for the initiative. Cannot contain the `::` string. If no ID is provided, it is generated from the name. -- **Default**: No `id` is provided, the value is calculated from the `name` field +- **Default:** If no `id` is provided, the value is calculated from the `name` field. #### `name` @@ -80,49 +81,49 @@ controls: - **Type:** String - **Required:** No - **Description:** The version of the initiative. -- **Default**: If no value is provided, iniitiative versioning is not applied. +- **Default:** If no value is provided, initiative versioning is not applied. #### `description` - **Type:** String - **Required:** No - **Description:** A brief description of the initiative. -- **Default**: If no value is provided, the value is ommited in the output data. +- **Default:** If no value is provided, it is omitted in the output data. #### `help` - **Type:** String (URL) - **Required:** No - **Description:** A URL pointing to the help or documentation for the initiative. -- **Default**: If no value is provided, the value is ommited in the output data. +- **Default:** If no value is provided, it is omitted in the output data. #### `defaults` - **Type:** Object - **Required:** No -- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. it is recommended to start adopting initiative with the `defaults.signed` value set to `false` and move it to `true` when certificates and keys are deployed. -- **Default**: If no value is provided, the rules' values are used. +- **Description:** Optional parameters to override the existing evidence lookup and other parameters for each rule in the initiative. It is recommended to start adopting the initiative with the `defaults.signed` value set to `false` and set it to `true` when certificates and keys are deployed. +- **Default:** If no value is provided, the rules' values are used. ##### `defaults.level` - **Type:** String - **Required:** No -- **Description:** Rule level to use for all rules in the initiative. It is recommended to start with a `warning` level and only after the security controls have been adopted move it to "error". -- **Default**: If no value is provided, the original rules' levels are used. +- **Description:** Rule level to use for all rules in the initiative. It is recommended to start with a `warning` level and only after the security controls have been adopted, set it to "error". +- **Default:** If no value is provided, the original rules' levels are used. ##### `defaults.evidence` - **Type:** Object - **Required:** No - **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. -- **Default**: If no value is provided, the rules' values are used. +- **Default:** If no value is provided, the rules' values are used. #### `env` - **Type:** Object - **Required:** No -- **Description:** File-wise environment variables for the template engine. -- **Default**: If no value is provided, only the vars from the actual environment are used. +- **Description:** File-wide environment variables for the template engine. +- **Default:** If no value is provided, only the variables from the actual environment are used. #### `controls` @@ -160,25 +161,25 @@ controls: - **Type:** Object - **Required:** No - **Description:** Optional filters for when the control should be run. -- **Default**: If no value is provided, no user-defined control filters are applied. +- **Default:** If no value is provided, no user-defined control filters are applied. ###### `controls[].when.gate` - **Type:** String - **Required:** No -- **Description:** The type of gate to run the control on. -- **Default**: If no value is provided, the control will run on all gates. +- **Description:** The type of gate on which to run the control. +- **Default:** If no value is provided, the control will run on all gates. ##### `controls[].rules` - **Type:** Array of Objects -- **Description:** A list of rules for the control. For the details, see the [Rules](#rule-config-format) section below. +- **Description:** A list of rules for the control. For details, see the [Rules](#rule-configuration-format) section below. > For `valint` configuration details, see the [configuration](./configuration.md) section. > > For PKI configuration, see the [attestations](./attestations.md) section. -An example of an initiative could be: +An example of an initiative is: ```yaml config-type: initiative @@ -186,7 +187,7 @@ required-valint-version: "2.0.0" id: my-initiative name: "My Initiative" version: "v1.0.0" -description: "This initiative enforces a couple of simple checks on a Docker image" +description: "This initiative enforces a couple of simple checks on Docker images" defaults: evidence: @@ -209,8 +210,8 @@ controls: level: warning with: identity: - emails: - - my@email.com + emails: + - my@email.com banned-licenses: - "GPL-2.0" - "GPL-3.0" @@ -222,9 +223,9 @@ controls: uses: sbom/evidence-exists@v2/rules ``` -## Rule config format +## Rule configuration format -Every rule that is used separately via the `--rule` arg or as part of an initiative should be defined as YAML: +Each rule that is used separately via the `--rule` argument or as part of an initiative should be defined in YAML: ```yaml config-type: rule @@ -264,7 +265,7 @@ with: {} - **Type:** String - **Required:** No - **Description:** The minimum version of Valint required to run the initiative. -- **Default**: No `valint` version matching check is performed. +- **Default:** No `valint` version matching check is performed. - **Example:** `"2.0.0"` #### `disable` @@ -279,7 +280,7 @@ with: {} - **Type:** String - **Required:** No - **Description:** A unique identifier for the rule. Cannot contain the `::` string. Must be unique within the initiative. If no ID is provided, it is generated from the name. -- **Default**: If no value is provided, it is generated from the name. +- **Default:** If no value is provided, it is generated from the name. #### `name` @@ -292,97 +293,97 @@ with: {} - **Type:** String - **Required:** No - **Description:** The path to a custom external script, if used. Should be relative to the rule file. -- **Default**: If no value is provided, no external script file is used for the rule. +- **Default:** If no value is provided, no external script file is used for the rule. #### `uses` - **Type:** String - **Required:** No - **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@/rules`. When used, the current rule's values will override the external rule's ones. -- **Default**: If no value is provided, no external rule is used as a base rule. +- **Default:** If no value is provided, no external rule is used as a base rule. #### `description` - **Type:** String - **Required:** No - **Description:** A brief description of the rule. -- **Default**: If no value is provided, the value is ommited in the output data. +- **Default:** If no value is provided, the value is omitted in the output data. #### `help` - **Type:** String (URL) - **Required:** No - **Description:** A URL pointing to the help or documentation for the rule. -- **Default**: If no value is provided, the value is ommited in the output data. +- **Default:** If no value is provided, it is omitted in the output data. #### `labels` - **Type:** Array of Strings - **Required:** No -- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be ran if at least one of it's labels matches one of the `--rule-label` values. -- **Default**: No labels used. +- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. +- **Default:** No labels used. #### `level` - **Type:** String - **Required:** No - **Description:** The level of the rule. Can be `error`, `warning`, or `note`. Default is `error`. The levels affect how rule results affect the overall initiative result: `valint` run overall would fail only if there are `error` level violations. Results on Scribe Hub are also displayed according to the levels. -- **Default**: `error` +- **Default:** `error` #### `require-scribe-api` - **Type:** Boolean - **Required:** No -- **Description:** Indicates whether the Scribe API is required. See the details in the [Rules that require Scribe API](#rules-that-require-scribe-api) section. -- **Default**: `false` +- **Description:** Indicates whether the Scribe API is required. See the details in the [Rules that require the Scribe API](#rules-that-require-the-scribe-api) section. +- **Default:** `false` #### `fail-on-missing-evidence` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule should fail if evidence is missing. If set to `false` (default), the rule will have the `open` result if no evidence is found. -- **Default**: `false` +- **Default:** `false` #### `skip-evidence` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule should skip evidence downloading and go straight to the rule evaluation. Can be helpful for rules that don't require evidence, like API rules. -- **Default**: `false` +- **Default:** `false` #### `aggregate-results` - **Type:** Boolean - **Required:** No - **Description:** Indicates whether the rule results should be aggregated. If set to `true`, the rule will return a single result for all the violations found. -- **Default**: `false +- **Default:** `false` #### `evidence` - **Type:** Object - **Required:** No - **Description:** Evidence lookup parameters. Any field from the evidence context can be used here. See the [Evidence Lookup](#evidence-lookup) section for more details. -- **Default**: No user specified options will be used for the evidence lookup. +- **Default:** No user-specified options will be used for the evidence lookup. ##### `evidence.filter-by` - **Type:** List of Strings - **Required:** No - **Description:** A list of parameters in the environment to filter the evidence by (see [Evidence Lookup](#evidence-lookup)). -- **Default**: `[target, product]` +- **Default:** `[target, product]` #### `with` - **Type:** Object - **Required:** No - **Description:** Rule input, depending on the rule script. -- **Default**: Depends on the rule script. +- **Default:** Depends on the rule script. Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). ## How to adopt an initiative? -An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required evidences: +An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required attestations: 1. Generate an SBOM @@ -445,11 +446,11 @@ To use a private bundle instead, the following rules should be followed: valint verify ... --bundle https://github.com/scribe-public/sample-policies ... ``` -2. If git authentication is required, it can be provided either in the git url or through the `--bundle-auth` flag. +2. If git authentication is required, it can be provided either in the git URL or through the `--bundle-auth` flag. -3. A specific branch, tag or commit can be provided using the `--bundle-branch`, `--bundle-tag` or `--bundle-commit` flags respectively. +3. A specific branch, tag, or commit can be provided using the `--bundle-branch`, `--bundle-tag`, or `--bundle-commit` flags respectively. -4. File structure within the bundle is up to the administrator, but when referencing the rules in initiative configs, the path should be relative to the bundle root and at least one level deep. +4. The file structure within the bundle is up to the administrator, but when referencing the rules in initiative configs, the path should be relative to the bundle root and at least one level deep. For example, this is how to reference a rule from the public Scribe bundle: ```yaml @@ -467,9 +468,9 @@ Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, Rules are defined as a combination of a `.yaml` configuration file and a `.rego` script. The `.yaml` file contains the rule configuration, while the `.rego` script contains the rule logic. The rule configuration is described above along with the initiative configuration. -The rego script gets two inputs: the verifying evidence as `input.evidence` and configurable args as `input.config.args`, the latter is specified in the rule config as `with` object. +The rego script gets two inputs: verifying evidence as `input.evidence` and configurable args as `input.config.args`, the latter is specified in the rule config as a `with` object. -Rego script should produce an output object of the following format: +The rego script should produce an output object in the following format: ```go package verify @@ -502,46 +503,46 @@ asset := scribe.get_asset_data(input.evidence) ### Evidence Lookup -In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. +In order to run a policy rule, `valint` requires relevant evidence, which can be found in storage using a number of parameters. These parameters can be set manually by the user or automatically derived from the context. -Parameters that can be derived automatically are categorized into three context groups: `target,` `pipeline`, and `product`. +Parameters that can be derived automatically are categorized into three context groups: `target`, `pipeline`, and `product`. By default, the `target` and `product` groups are enabled for each rule. -1. `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo, etc). These parameters are: +1. The `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo, etc). These parameters are: - `target_type` - the type of the target provided (e.g., image, git, generic etc.) - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) - > _If this parameter is set and no target provided, the rule is disabled with a warning._ + > _If this parameter is set and no target is provided, the rule is disabled with a warning._ -2. `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: - - `context_type` - type of the environment (e.g., local, github, etc.) - - `git_url` - git url of the repository (if any) - - `git_commit` - git commit of the current repository state (if any) - - `run_id` - run id - - `build_num` - build number +2. The `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: + - `context_type` - the type of the environment (e.g., local, github, etc.) + - `git_url` - the git URL of the repository (if any) + - `git_commit` - the git commit of the current repository state (if any) + - `run_id` - the run ID + - `build_num` - the build number -3. `product` context group specifies product parameters that can be derived from the command line arguments. These parameters are: - - `name` - name of the product - - `product_version` - version of the product - - `predicate_type` - type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) +3. The `product` context group specifies product parameters that can be derived from the command line arguments. These parameters are: + - `name` - the name of the product + - `product_version` - the version of the product + - `predicate_type` - the type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) -User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. -By default, `target` and `product` groups are used. +Users can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. +By default, the `target` and `product` groups are used. The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. ---- +------------------- -In addition, one can ***manually*** specify any parameters that they want to be matched by an evidence. -In most of the rules, the following parameters would be used to define the type of the attestation: +In addition, one can _**manually**_ specify any parameters that they want to be matched by evidence. +In most of the rules, the following parameters would be used to define the type of attestation: | Field | Description | Examples | |--------------------|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| -| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned evidences are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | +| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned attestations are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | | `content_body_type`| Defines the content type of the attestation. | `cyclonedx-json`, `generic`, `slsa` | | `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIF attestations
`data` for generic data files | -| `predicate_type` | The type of the predicate used in a `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | +| `predicate_type` | The type of the predicate used in `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | -The following example requires an unsigned attestation of a Scribe Security discovery evidence: +The following example requires an unsigned attestation of Scribe Security discovery evidence: ```yaml ... @@ -554,7 +555,7 @@ evidence: ```
- Full list of supported parameters + Full list of supported parameters The parameters are named the same way as they are in the evidence context. @@ -611,13 +612,12 @@ target_type
- -If more than one evidence is found, the newest one is used. +If more than one piece of evidence is found, the newest one is used.
- Usage + Usage -An example of a rule that requires a signed CycloneDX SBOM evidence and uses target and product contexts would look like this: +An example of a rule that requires signed CycloneDX SBOM evidence and uses target and product contexts would look like this: ```yaml config-type: rule @@ -651,7 +651,7 @@ When running this rule on the `alpine:latest` image target for the `MyProduct` p ### Template arguments -Rules can have template arguments that can be used to simplify the rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided in the runtime: +Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided at runtime: ```yaml @@ -666,23 +666,23 @@ with: To specify those, `valint` should be run with args `--rule-args Token=MyToken,Owner=MyOwner,Repo=MyRepo,Branch=MyBranch`. -When required template arg is not specified, the rule will be disabled with a warning. +When a required template argument is not specified, the rule will be disabled with a warning. #### Built-in functions -To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of such functions is to disable filtering when the `--all-evidence` flag is used, see below. +To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of these functions is to disable filtering when the `--all-evidence` flag is used, see below. List of supported functions: - `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below -- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name` -- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used -- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead +- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name`. +- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used. +- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead.
Example -In the following rule, `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: +In the following rule, the `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: ```yaml ... @@ -725,7 +725,7 @@ For the rules that fail to find any evidence, the `open` result is returned. ### Rules that don't require evidence -If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule config: +If a rule doesn't require any evidence to be verified, the `skip-evidence` flag can be used in the rule configuration: ```yaml ... @@ -733,7 +733,7 @@ skip-evidence: true ... ``` -### Rules that require Scribe API +### Rules that require the Scribe API If a rule requires an API call to be verified, it can use the `require-scribe-api` flag to ensure that all the uploaded attestations are processed and the API is ready to be used: @@ -743,12 +743,12 @@ require-scribe-api: true ... ``` -`valint` will try to reach the Scribe API and wait for it to be ready. Waiting timeout is set by the `--timeout` flag and defaults to 2 minutes. +`valint` will try to reach the Scribe API and wait for it to be ready. The waiting timeout is set by the `--timeout` flag and defaults to 2 minutes. If the API is not ready, the rule will produce the `open` result the same way as when no evidence is found. This can be changed with the `fail-on-missing-evidence` flag, see the [Rules that should fail on missing evidence](#rules-that-should-fail-on-missing-evidence) section. ### Rules that should fail on missing evidence -By default, if no evidence for a rule found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used: +By default, if no evidence for a rule is found, it returns an "open" result, meaning that there was insufficient information to decide whether there are any violations. If a rule should fail in that case, the `fail-on-missing-evidence` flag can be used: ```yaml ... @@ -758,4 +758,4 @@ fail-on-missing-evidence: true ### Unicode strings in rule results -To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag in the runtime. This would result in replacing rule levels and results in `valint` logs with emojis. +To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag at runtime. This would result in replacing rule levels and results in `valint` logs with emojis. From ed76126576a25c156e81aaae14b2c7a7d6b6d644 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 3 Mar 2025 19:05:22 +0200 Subject: [PATCH 033/191] fixes --- docs/valint/initiatives.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 65ae891e4..551dd4e84 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -537,10 +537,10 @@ In most of the rules, the following parameters would be used to define the type | Field | Description | Examples | |--------------------|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| -| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned attestations are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | +| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned attestations are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | | `content_body_type`| Defines the content type of the attestation. | `cyclonedx-json`, `generic`, `slsa` | -| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIF attestations
`data` for generic data files | -| `predicate_type` | The type of the predicate used in `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | +| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIF attestations
`data` for generic data files | +| `predicate_type` | The type of the predicate used in `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | The following example requires an unsigned attestation of Scribe Security discovery evidence: From e35f2db253bec078fbe52a8be571066de98bc5d7 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 3 Mar 2025 19:17:19 +0200 Subject: [PATCH 034/191] grammar fixes --- docs/guides/enforcing-sdlc-initiative.md | 44 ++++++++++++------------ 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index b4bd0f1df..5a16a1818 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -7,13 +7,13 @@ toc_max_heading_level: 5 --- You can use Scribe to apply policies at different points along your SDLC. -For example, at the end of a build or at the admission control point to the production cluster. Use cases for example: +For example, at the end of a build or at the admission control point to the production cluster. Use cases include: - Images must be signed, and they must have a matching CycloneDX SBOM. -- Images must be built by a CircleCI workflow and produce a signed SLSA provenance. +- Images must be built by a CircleCI workflow and produce signed SLSA provenance. - Tagged sources must be signed and verified by a set of individuals or processes. -For the detailed initiative description, see **[initiatives](../valint/initiatives)** section. +For a detailed initiative description, see the **[initiatives](../valint/initiatives)** section. ## Quickstart @@ -25,7 +25,7 @@ For the detailed initiative description, see **[initiatives](../valint/initiativ curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -t valint ``` -2. Create an SBOM of a type you want to verify. For a Docker image the command would be: +2. Create an SBOM of the type you want to verify. For a Docker image, the command would be: ```bash valint bom busybox:latest -o statement \ @@ -36,7 +36,7 @@ For the detailed initiative description, see **[initiatives](../valint/initiativ It's also possible to create an SBOM from a git repository (if git authentication is required, provide it with the `--git-auth` flag): ```bash - valint bom git:path/togit/repo -o statement \ + valint bom git:path/to/git/repo -o statement \ --product-key -- product-version \ --scribe.client-secret ``` @@ -49,7 +49,7 @@ For the detailed initiative description, see **[initiatives](../valint/initiativ --scribe.client-secret ``` -Alternatively, you can use GitHub actions, as described in details in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md). +Alternatively, you can use GitHub actions, as described in detail in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md). ### Verifying an initiative @@ -63,7 +63,7 @@ Alternatively, you can use GitHub actions, as described in details in [Setting u --scribe.client-secret ``` - As a result, you will see the output table of the initiative verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. + As a result, you will see the output table of the initiative verification. A detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section.
@@ -99,8 +99,8 @@ Alternatively, you can use GitHub actions, as described in details in [Setting u
- > Note that only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically and no result was generated for them. - > To verify the whole SSDF initiative, you need to run GitHub discovery, see [platforms discovery](../platforms/overview). + > Note that only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically, and no result was generated for them. + > To verify the whole SSDF initiative, you need to run GitHub discovery. See [platforms discovery](../platforms/overview). ### Running a single rule verification @@ -108,7 +108,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule 1. Create an image SBOM as described in [Creating an SBOM](#creating-an-sbom). -2. Verify the SBOM against an existing rule from the bundle. [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as a default rule bundle for `valint`. +2. Verify the SBOM against an existing rule from the bundle. The [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as the default rule bundle for `valint`. ```bash valint verify busybox:latest --rule sbom/complete-licenses@v2/rules \ @@ -116,7 +116,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule --scribe.client-secret ``` - As a result, you will see the output table of the rule verification. Detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. + As a result, you will see the output table of the rule verification. A detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section.
@@ -134,7 +134,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule └───────────────────────────────────┴───────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────┴────────────────┘ ``` - You will also see the result table of the initiative evaluation: + You will also see the results table of the initiative evaluation: ```bash ┌─────────────────────────────────────────────────────────────────────────────────────────────┐ @@ -156,9 +156,9 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ### Targetless Run Some of the rules in this catalog can also be run in "targetless" mode, - meaning that the evidence will be looked up based only on the product name and version and options specified in the rule config. - No target for premilinary analysis needed. - This is usually helpful for 3rd party reports, such as security scans and [platforms discoveries](../platforms/overview). + meaning that the evidence will be looked up based only on the product name, version, and options specified in the rule config. + No target for preliminary analysis is needed. + This is usually helpful for third-party reports, such as security scans and [platform discoveries](../platforms/overview). As an example, let's run `trivy` to create a SARIF report: @@ -166,7 +166,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule trivy image --format sarif --output results.sarif ubuntu:latest ``` - Then, create an evidence from this report: + Then, create evidence from this report: ```bash valint evidence results.sarif \ @@ -174,7 +174,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule --scribe.client-secret ``` - And finally, verify the evidence against the rule. Note that we don't need to provide `valint `with the target report: + Finally, verify the evidence against the rule. Note that we don't need to provide `valint` with the target report: ```bash valint verify --rule sarif/trivy/verify-trivy-report@v2/rules \ @@ -216,8 +216,8 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ### Whole initiative verification -If you want to verify an initiative on all the existing evidences, provide `valint` with the `--all-evidence` flag. -It disables most of rule filterings and for each rule verifies all the matching evidences. +If you want to verify an initiative on all existing attestations, provide `valint` with the `--all-evidence` flag. +It disables using of target for evidence filtering and verifies all matching attestations for each rule. ```bash valint verify --initiative ssdf@v2/initiatives --all-evidence \ @@ -293,7 +293,7 @@ valint verify --initiative ssdf@v2/initiatives --all-evidence \
-In this case no rule was disabled and all of them were verified. +In this case, no rule was disabled, and all of them were verified. ### Reading the Results @@ -311,7 +311,7 @@ The results of the initiative verification are also presented in a table format. - `CONTROL ID`: The unique identifier of the control. - `CONTROL NAME`: The name of the control. -- `RULE LIST`: The list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In the parentheses, the rule's result is shown in the format `rule_id(level->result)`. +- `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level. - `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". ## Sample Rule Catalog @@ -319,7 +319,7 @@ The results of the initiative verification are also presented in a table format. We provide a set of sample rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. To use a different version of this catalog, use the `--bundle-tag` valint flag. -To use a custom rule catalog, you can specify the path to the catalog in the `--bundle` flag (may it be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo. +To use a custom rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo. | Rule | Description | Additional Info | | --- | --- | --- | From ad1b318d4ee3fa544b96dd954a0559cef8921865 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 5 Mar 2025 18:46:10 +0200 Subject: [PATCH 035/191] updates --- docs/guides/enforcing-sdlc-initiative.md | 42 +++++++------------ .../gatekeeper-provider.md | 14 +++---- docs/valint/initiatives.md | 18 ++++---- 3 files changed, 30 insertions(+), 44 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 5a16a1818..c2d4830e0 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -33,21 +33,7 @@ For a detailed initiative description, see the **[initiatives](../valint/initiat --scribe.client-secret ``` - It's also possible to create an SBOM from a git repository (if git authentication is required, provide it with the `--git-auth` flag): - - ```bash - valint bom git:path/to/git/repo -o statement \ - --product-key -- product-version \ - --scribe.client-secret - ``` - - And from a file: - - ```bash - valint bom file:/path/to/file.artifact -o statement \ - --product-key -- product-version \ - --scribe.client-secret - ``` +See [Getting started with valint](../valint/getting-started-valint.md) for more information on the `bom` command. Alternatively, you can use GitHub actions, as described in detail in [Setting up an integration in GitHub](../quick-start/set-up-integration/set-up-github.md). @@ -58,7 +44,7 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up 2. Verify the SBOM against an initiative. Let's take the SSDF initiative provided in the [Scribe Sample Catalog](#sample-rule-catalog): ```bash - valint verify busybox:latest --initiative ssdf@v2/initiatives \ + valint verify busybox:latest --initiative ssdf@v2 \ --product-key -- product-version \ --scribe.client-secret ``` @@ -111,7 +97,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule 2. Verify the SBOM against an existing rule from the bundle. The [Scribe Sample Rule Catalog](#sample-rule-catalog) will be used as the default rule bundle for `valint`. ```bash - valint verify busybox:latest --rule sbom/complete-licenses@v2/rules \ + valint verify busybox:latest --rule sbom/complete-licenses@v2 \ --product-key -- product-version \ --scribe.client-secret ``` @@ -177,7 +163,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule Finally, verify the evidence against the rule. Note that we don't need to provide `valint` with the target report: ```bash - valint verify --rule sarif/trivy/verify-trivy-report@v2/rules \ + valint verify --rule sarif/trivy/verify-trivy-report@v2 \ --product-key -- product-version \ --scribe.client-secret ``` @@ -220,7 +206,7 @@ If you want to verify an initiative on all existing attestations, provide `valin It disables using of target for evidence filtering and verifies all matching attestations for each rule. ```bash -valint verify --initiative ssdf@v2/initiatives --all-evidence \ +valint verify --initiative ssdf@v2 --all-evidence \ --product-key -- product-version \ --scribe.client-secret ``` @@ -374,7 +360,7 @@ valint bom ubuntu:latest -o statement To verify the evidence against the rule, run: ```bash -valint verify ubuntu:latest -i statement-cyclonedx-json --rule sbom/rule_config@v2/rules +valint verify ubuntu:latest -i statement-cyclonedx-json --rule sbom/rule_config@v2 ``` #### Require SBOM Signature @@ -472,7 +458,7 @@ valint bom ubuntu:latest -o statement To verify the evidence against the rule: ```bash -valint verify ubuntu:latest -i statement --rule images/rule_config@v2/rules +valint verify ubuntu:latest -i statement --rule images/rule_config@v2 ``` #### Disallow Container Shell Entrypoint @@ -539,7 +525,7 @@ valint bom git:https://github.com/golang/go -o statement To verify the evidence against the rule: ```bash -valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v2/rules +valint verify git:https://github.com/golang/go -i statement --rule git/rule_config@v2 ``` #### Restrict Coding Permissions @@ -580,7 +566,7 @@ valint slsa ubuntu:latest -o statement Example of verifying a SLSA statement: ```bash -valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v2/rules +valint verify ubuntu:latest -i statement-slsa --rule slsa/rule_config@v2 ``` #### Verify that artifact was created by the specified builder @@ -683,7 +669,7 @@ valint evidence ubuntu-cve.json -o statement Verify the attestation against the rule: ```bash -valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2/rules +valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2 ``` ###### Running Trivy On Docker Container Rootfs @@ -773,7 +759,7 @@ valint evidence my-image-dockerfile.json -o statement Verify the attestation against the rule: ```bash -valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v2/rules +valint verify my-image-dockerfile.json -i statement-generic --rule sarif/report-iac-errors@v2 ``` The only configurable parameter in [report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/report-iac-errors.yaml) is `violations_threshold`, which is the maximum number of errors allowed in the report: @@ -814,7 +800,7 @@ with: Then, run `valint verify` as usual: ```bash -valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v2/rules +valint verify semgrep-report.sarif -i statement-generic --rule sarif/verify-semgrep-report@v2 ``` If any violations found, the output will contain their description, including the violated rule and the file where the violation was found. @@ -824,7 +810,7 @@ If any violations found, the output will contain their description, including th This rule ([verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-tool-evidence.yaml)) allows to verify the existence of an evidence of SARIF report created by a specified tool. By default, the rule checks for an evidence created out of _any_ SARIF report. To specify a tool, use the `tool` parameter in the `evidence` section of the rule configuration. For example, to verify that there is an evidence of a SARIF report created by `trivy`, use the following configuration: ```yaml -uses: sarif/verify-tool-evidence@v2/rules +uses: sarif/verify-tool-evidence@v2 evidence: tool: "Trivy Vulnerability Scanner" ``` @@ -842,5 +828,5 @@ Rego policy rules can be written either as snippets in the yaml file, or as sepa An example of such a rego script is given in the [verify-sarif.rego](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.rego) file, that is consumed by the [verify-sarif.yaml](https://github.com/scribe-public/sample-policies/tree/v2/v2/rules/sarif/verify-sarif.yaml) configuraion. To evaluate the rule, run ```bash -valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2/rules +valint verify ubuntu-cve.json -i statement-generic --rule sarif/verify-sarif@v2 ``` diff --git a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md index 1a4dc6153..03f1885fb 100644 --- a/docs/integrating-scribe/admission-controller/gatekeeper-provider.md +++ b/docs/integrating-scribe/admission-controller/gatekeeper-provider.md @@ -212,7 +212,7 @@ select: name: require_signed_images rules: - name: error_on_unsigned_image - uses: sbom/artifact-signed@v2/rules + uses: sbom/artifact-signed@v2 level: error ``` @@ -364,7 +364,7 @@ select: name: cluster-policy rules: - name: fresh-image - uses: images/fresh-image@v2/rules + uses: images/fresh-image@v2 level: warning with: max_days: 356 @@ -390,7 +390,7 @@ select: name: cluster-policy rules: - name: fresh-image - uses: images/fresh-image@v2/rules + uses: images/fresh-image@v2 level: warning with: max_days: 356 @@ -415,7 +415,7 @@ select: name: pipeline-scanners rules: - name: check-vulnerabilities - uses: sarif/verify-sarif@v2/rules + uses: sarif/verify-sarif@v2 evidence: tool: "Trivy Vulnerability Scanner" with: @@ -464,7 +464,7 @@ select: name: pipeline-scanners rules: - name: check-vulnerabilities - uses: sarif/verify-sarif@v2/rules + uses: sarif/verify-sarif@v2 evidence: tool: "Trivy Vulnerability Scanner" with: @@ -535,7 +535,7 @@ select: name: default-provider-policy rules: - name: warn_on_unsigned_image - uses: sbom/artifact-signed@v2/rules + uses: sbom/artifact-signed@v2 level: "warning" ``` @@ -699,7 +699,7 @@ select: name: require_signed_images rules: - name: error_on_unsigned_image - uses: sbom/artifact-signed@v2/rules + uses: sbom/artifact-signed@v2 level: error ``` diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 551dd4e84..22d2e5d01 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -198,7 +198,7 @@ controls: when: gate: "Build" rules: - uses: sbom/blocklist-packages@v2/rules + uses: sbom/blocklist-packages@v2 with: blocklist: - "liblzma5@5.6.0" @@ -206,7 +206,7 @@ controls: - "xz-utils@5.6.0" - "xz-utils@5.6.1" - name: "my-rule-2" - uses: sbom/banned-licenses@v2/rules + uses: sbom/banned-licenses@v2 level: warning with: identity: @@ -220,7 +220,7 @@ controls: gate: "Deploy" rules: - name: "my-rule-3" - uses: sbom/evidence-exists@v2/rules + uses: sbom/evidence-exists@v2 ``` ## Rule configuration format @@ -421,7 +421,7 @@ valint verify --initiative initiative.yaml \ To run an initiative from a git bundle, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives \ +valint verify --initiative my-initiative@v2 \ --product-key -- product-version \ --scribe.client-secret ``` @@ -429,7 +429,7 @@ valint verify --initiative my-initiative@v2/initiatives \ To run a part of an initiative filtered by gate type, use the following command: ```bash -valint verify --initiative my-initiative@v2/initiatives \ +valint verify --initiative my-initiative@v2 \ --product-key -- product-version \ --scribe.client-secret \ --gate-type Build --gate-name "Build of My Product" @@ -456,11 +456,11 @@ For example, this is how to reference a rule from the public Scribe bundle: ```yaml ... rules: - - uses: sbom/blocklist-packages@v2/rules + - uses: sbom/blocklist-packages@v2 ... ``` -Here `sbom/blocklist-packages@v2/rules` means that the rule path within the bundle is`v2/rules/sbom/blocklist-packages.yaml`. +Here `sbom/blocklist-packages@v2` means that the rule path within the bundle is`v2/rules/sbom/blocklist-packages.yaml`. Note that the `.yaml` extension is omitted in the path and replaced with `@v2`, which is used here as a version tag. ## Rule configuration @@ -651,7 +651,7 @@ When running this rule on the `alpine:latest` image target for the `MyProduct` p ### Template arguments -Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2/rules` relies on several arguments provided at runtime: +Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2` relies on several arguments provided at runtime: ```yaml @@ -703,7 +703,7 @@ When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will u One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: ```bash -valint verify --initiative my-initiative@v2/initiatives --all-evidence \ +valint verify --initiative my-initiative@v2 --all-evidence \ --product-key -- product-version \ --scribe.client-secret ``` From d7720461a177fc0d3a3684e82aa4a2d6b08477f7 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 6 Mar 2025 15:16:13 +0200 Subject: [PATCH 036/191] updates --- docs/glossary.md | 41 +++++++++++++++++-- docs/guides/enforcing-sdlc-initiative.md | 26 ++++++------ docs/valint/initiatives.md | 51 ++++++++++++++++++------ 3 files changed, 90 insertions(+), 28 deletions(-) diff --git a/docs/glossary.md b/docs/glossary.md index c8d19f813..592af0802 100644 --- a/docs/glossary.md +++ b/docs/glossary.md @@ -3,24 +3,35 @@ sidebar_position: 16 sidebar_label: "Glossary" title: Glossary --- -### Code Integrity Validation + +### Asset + +An asset is a resource that is valuable to an organization. In the context of Scribe, an asset is a target from which you want to collect evidence. This could be an image, a file, a GIT repository, or a platform discovery target, like GitHub organization configuration or a K8s pod instance. + +### Code Integrity Validation + Code Integrity Validation is a test that verifies that files were not modified unlawfully between the source repository and the final image. In Scribe this test uses hash values generated during the evidence collection and so doesn't require looking at the actual code. Even a single bit changed in a file would generate a different hash value so by comparing hash values generated by files in the source repository and the ones in the final image we're able to identify and files that do not match. ### CycloneDX + OWASP CycloneDX is a lightweight Bill of Materials (BOM) standard designed for use in application security contexts and supply chain component analysis. The specification excels in: Software Bill of Materials (SBOM) Software-as-a-Service Bill of Materials (SaaSBOM), and Operations Bill of Materials (OBOM). You can read more about CycloneDX SBOM [here](https://cyclonedx.org/capabilities/sbom/ "OWASP CycloneDX SBOM"). ### Dependencies + A software dependency is a code library or package that is reused in a new piece of software. For example, a machine learning project written in Python might call a Python library to build models. The benefit of software dependencies is that they allow developers to more quickly deliver software by building on previous work. Most code dependencies are open source packages. Transitive dependencies are referring to 'a dependency of a dependency'. Since most code is built using other libraries that is true for your dependencies as well. That means that your dependencies have their own dependencies and so on down the line. This chain of dependencies is part of what is known as the software supply chain. ### DevSecOps + DevSecOps stands for development + security + operations. It's an approach that combines application development, security, operations and infrastructure as code (IaC) in an automated continuous integration/continuous delivery (CI/CD) pipeline. ### Evidence + In this context, evidence is proof of something that happened (or didn't happen) during the development process and/or build pipeline. This evidence would usually take the form of a log or file. In order to make sure that the evidence is trustworthy and unfalsifiable, it is considered a best practice to sign it cryptographically to turn it into an attestation. ### Evidence collection target + Scribe knows how to collect evidence from several entities: * An image - Image formats supported are currently docker manifest v2 and Oracle Cloud Infrastructure (OCI) * A folder @@ -32,20 +43,41 @@ Targeting one of these entities with the Scribe tool allows you to collect evide You can view which environments are supported by Scribe's tool [here](how-to-run-scribe/ci-integrations/ "integrating Scribe into a pipeline"). ### Hash Value + A hash value is a numeric value of a fixed length that uniquely identifies data. Hash values represent large amounts of data as much smaller numeric values. Since each piece of data generates a unique hash value these strings can be used in algorithms comparing data pieces or files. ### In-toto + In-toto is a framework built to secure the integrity of software supply chains. The framework was designed for securing the way in which software is developed, built, tested, and packaged (i.e., the software supply chain). In-toto attests to the integrity and verifiability of all the actions performed while writing code, compiling, testing, and deploying software. It does so by making it transparent to the user what steps were performed, by whom and in what order. As a result, given guidance by the group creating the software, in-toto allows the user to verify if a step in the supply chain was intended to be performed, if the step was performed by the right actor, and attests that materials (e.g., source code) were not tampered with between steps. You can read more about in-toto [here](https://in-toto.io/ "in-toto framework"). -### In-toto Attestation +### In-toto Attestation + An attestation is cryptographically signed piece of evidence. It's a mechanism for software to prove its identity and authenticity. The goal of attestation is to prove to a third party that the signed evidence is intact and trustworthy. An [in-toto attestation](https://github.com/in-toto/attestation "in-toto attestation GitHub link") is authenticated (cryptographically signed) metadata about one or more software artifacts, as per the [SLSA Attestation Model](https://github.com/slsa-framework/slsa/blob/main/docs/attestation-model.md "SLSA Attestation Model GitHub link"). -### In-toto Statement +### In-toto Statement + An in-toto Statement is almost identical to an in-toto attestation. The only difference is that the in-toto Statement is not cryptographically signed. Other than that it's packaged in exactly the same way as an [in-toto attestation](https://github.com/in-toto/attestation "in-toto attestation GitHub link"). +### Policy Bundle + +A policy bundle is a collection of [rules](#policy-rule) and [initiatives](#policy-initiative) that can be used to evaluate evidence. For example, a policy bundle could be a collection of security frameworks that are used to evaluate the security posture of an application. Scribe provides a [Sample Policy Bundle](https://github.com/scribe-public/sample-policies) that includes the SSDF.PS, SLSA L1 and L2 frameworks as well as a set of rules to verify a variety of security requirements on different types of attestations. + +### Policy Initiative + +An initiative is a high-level, abstract requirement that is comprised of a set of [controls](#policy-control). For example, a security framework such as SSDF can be represented as an initiative. + +### Policy Control + +A control is an abstract requirement that is comprised of a set of [rules](#policy-rule). For example, the SSDF.PS framework (initiative) requires a control for protecting access to the source code. + +### Policy Rule + +A rule is a single requirement that is, in the context of Scribe, a single check that can be performed on evidence. For example, the control described in the section above can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of these requirements is a rule. + ### SBOM + The software bill of materials (SBOM) lists all component parts and software dependencies involved in the development and delivery of an application. SBOMs are similar to bill of materials (BOMs) used in supply chains and manufacturing. There hasn’t been a common feature for all vendors in the IT industry to accurately describe the foundational code components on which an application is built. A typical SBOM would include licensing information, version numbers, component details, and vendors. A formal list of all the facts decreases risks for both the manufacturer and the user by allowing others to understand what’s in their software and act accordingly. SBOMs aren’t new to the software industry, but they’re becoming increasingly vital as development becomes more sophisticated and expensive. They’ve lately become a basic requirement in a number of businesses. @@ -53,6 +85,7 @@ A typical SBOM would include licensing information, version numbers, component d You can read more about it [here](https://scribesecurity.com/sbom/ "Read more about SBOM"). ### SLSA + The Supply chain Levels for Software Artifacts or SLSA (pronounced Salsa) is a security framework created by Google. It is a list of standards and controls meant to prevent tampering, improve file integrity, and secure packages and infrastructure in your projects, businesses, or enterprises. SLSA consists of common-sense security measures intended for embedding security throughout the development lifecycle. SLSA is meant to make it easier for the implementing organization to get information about its software source, build, and artifacts. At the same time, it’s meant to make it much harder for any malicious or threat actor, either within or outside of the organization, to make any unauthorized changes to files, processes, or artifacts. @@ -60,11 +93,13 @@ SLSA is meant to make it easier for the implementing organization to get informa You can read more about SLSA [here](https://slsa.dev/ "SLSA"). ### SLSA Provenance + Provenance is the place of origin or earliest known history of something. SLSA provenance is a claim that some entity produced one or more software artifacts by executing some recipe or procedure, using some other artifacts as input built to the SLSA standard. It’s the verifiable information about software artifacts describing where, when and how something was produced. You can read more about SLSA provenance and it's structure [here](https://slsa.dev/provenance/v0.2 "SLSA Provenance"). ### Software Supply Chain + The software supply chain refers to everything involved in the development of an application throughout the entire software development life cycle (SDLC). There are many factors to consider in this regard, including custom code (in-house components), open source dependencies and libraries (third-party components), DevOps tools and infrastructure that make up the CI/CD process, and finally developers and DevOps teams. You can read more about it [here](https://scribesecurity.com/software-supply-chain-security/ "Read more about Software Supply Chain"). diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index c2d4830e0..4a92ee1fe 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -76,8 +76,8 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up ├───────────────────┬───────────────┬─────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼─────────────────────┼────────┤ - │ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ - │ │ │ PS.3.2(error->pass) │ │ + │ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ + │ │ │ PS.3.2(pass) │ │ ├───────────────────┼───────────────┼─────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ PASS │ └───────────────────┴───────────────┴─────────────────────┴────────┘ @@ -128,7 +128,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ├───────────────────┬───────────────┬────────────────────────────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤ - │ default │ Default │ sbom-require-complete-license-set(error->pass) │ pass │ + │ default │ Default │ sbom-require-complete-license-set(pass) │ pass │ ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ PASS │ └───────────────────┴───────────────┴────────────────────────────────────────────────┴────────┘ @@ -192,7 +192,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ├───────────────────┬───────────────┬───────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼───────────────────────────┼────────┤ - │ default │ Default │ trivy-report(error->fail) │ fail │ + │ default │ Default │ trivy-report(fail) │ fail │ ├───────────────────┼───────────────┼───────────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ FAIL │ └───────────────────┴───────────────┴───────────────────────────┴────────┘ @@ -263,15 +263,15 @@ valint verify --initiative ssdf@v2 --all-evidence \ ├───────────────────┬───────────────┬──────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(error->pass), │ pass │ -│ │ │ PS.3.2(error->pass) │ │ +│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ +│ │ │ PS.3.2(pass) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-ORG │ SSDF ORG │ PS.1.1(error->pass), │ fail │ -│ │ │ PS.1.3(error->fail), │ │ -│ │ │ PS.1.5(error->fail) │ │ +│ SSDF-ORG │ SSDF ORG │ PS.1.1(pass), │ fail │ +│ │ │ PS.1.3(fail), │ │ +│ │ │ PS.1.5(fail) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-REPO │ SSDF REPO │ PS.1.2(error->fail), │ fail │ -│ │ │ PS.1.4(error->pass) │ │ +│ SSDF-REPO │ SSDF REPO │ PS.1.2(fail), │ fail │ +│ │ │ PS.1.4(pass) │ │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ FAIL │ └───────────────────┴───────────────┴──────────────────────┴────────┘ @@ -288,7 +288,7 @@ The results of the control verification are presented in a table format. The tab - `RULE ID`: The unique identifier of the rule. - `RULE NAME`: The name of the rule. - `LEVEL`: The severity level of the rule. Only rules with the "error" level can fail the control. -- `VERIFIED`: The boolean value indicating whether the evidence signature was verified. It may or may not fail the rule, based on the rule's requirements. +- `VERIFIED`: A boolean value indicating whether the evidence signature was verified. Verification failure causes the rule to fail only if the rule requires a signed attestation. - `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open". - `SUMMARY`: The reason for the rule result. - `TARGET`: The target asset of the rule verification. @@ -297,7 +297,7 @@ The results of the initiative verification are also presented in a table format. - `CONTROL ID`: The unique identifier of the control. - `CONTROL NAME`: The name of the control. -- `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level. +- `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`. - `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". ## Sample Rule Catalog diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 22d2e5d01..497044430 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -10,10 +10,9 @@ toc_max_heading_level: 3 ## What is an initiative? -Each `initiative` proposes to enforce a set of requirements (aka `rules`) grouped into `controls` with which your supply chain must comply. -The outcome of an initiative evaluation is an initiative result attestation, a report that details the rule evaluation results and references the verified assets and attestations. +An `initiative` is a high-level, abstract requirement that is comprised of a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that is comprised of a set of `rules`. For example, the SSDF.PS framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`. -An initiative consists of a set of `controls`, each of which in turn consists of a set of `rules` and is verified if all of them are evaluated and verified. +The outcome of an initiative evaluation is an initiative result report that details the rule evaluation results and references the verified assets and statements/attestations. `valint` produces initiative results in the SARIF format and uploads them as an in-toto statement of SARIF to Scribe Hub. Rules can reuse existing ones from a bundle or be defined inline. @@ -381,11 +380,31 @@ with: {} Examples of rules and initiatives can be found in the [sample-policies bundle](https://github.com/scribe-public/sample-policies). -## How to adopt an initiative? +An example of a rule is: + +```yaml +config-type: rule +id: require-sbom +name: Require SBOM Existence +path: require-sbom.rego + +description: Verify the SBOM exists as evidence. + +fail-on-missing-evidence: true + +evidence: + filter-by: + - product + - target + content_body_type: cyclonedx-json + signed: false +``` -An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required attestations: +This rule requires a CycloneDX SBOM to be present as evidence for the product and target. The rule accepts both signed and unsigned SBOMs and fails if no SBOM is found. It uses an external `rego` script to provide some additional logic (in this specific case, it's just used to fetch some additional data from the SBOM and return it in the result). -1. Generate an SBOM +## How to adopt an initiative? + +An initiative is defined as a file that can be consumed locally or from an external bundle. To run an initiative, one first needs to create the required statements and attestations, for example: ```bash valint bom : \ @@ -393,7 +412,13 @@ valint bom : \ --scribe.client-secret ``` -2. Generate SLSA Provenance +
+ +Additional options + +In addition, other type of statements can be created. See the [Getting started with valint](./getting-started-valint.md) guide for more details. + +- SLSA Provenance ```bash valint slsa : \ @@ -401,7 +426,7 @@ valint slsa : \ --scribe.client-secret ``` -3. Create generic evidences from 3rd party tool reports: +- Generic evidence from a 3rd party tool report: ```bash valint evidence \ @@ -409,6 +434,8 @@ valint evidence \ --scribe.client-secret ``` +
+ ------------------- Then, a local initiative can be run with the following command: @@ -533,16 +560,16 @@ The list of groups to be used should be provided to the `.evidence.filter- ------------------- In addition, one can _**manually**_ specify any parameters that they want to be matched by evidence. -In most of the rules, the following parameters would be used to define the type of attestation: +In most of the rules, the following parameters would be used to define the type of statement: | Field | Description | Examples | |--------------------|----------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| -| `signed` | Specifies if the evidence is required to be signed.
When set to `false`, both signed and unsigned attestations are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | +| `signed` | Specifies whether the evidence is required to be signed.
When set to `false`, both unsigned (statements) and signed (attestations) are accepted, and signature verification failure for the signed ones doesn't affect the rule result. | `true`, `false` | | `content_body_type`| Defines the content type of the attestation. | `cyclonedx-json`, `generic`, `slsa` | -| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIF attestations
`data` for generic data files | +| `target_type` | The type of the target that was used to create the evidence. | `container` for Docker images
`git` for Git repositories
`policy-results` for `valint` SARIFs
`data` for generic data files | | `predicate_type` | The type of the predicate used in `generic` evidence, usually a URI. | `http://scribesecurity.com/evidence/discovery/v0.1`
`http://docs.oasis-open.org/sarif/sarif/2.1.0` | -The following example requires an unsigned attestation of Scribe Security discovery evidence: +The following example requires an unsigned statement of Scribe Security discovery evidence: ```yaml ... From 828d96c817f73da1dce1483717dee4ba987c0d35 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 6 Mar 2025 15:50:52 +0200 Subject: [PATCH 037/191] * updated policy results page * removed the old policies page --- docs/guides/enforcing-sdlc-initiative.md | 23 +- docs/valint/policies.md | 835 ---------- docs/valint/policy-results.md | 1868 +++++++++++++++------- 3 files changed, 1263 insertions(+), 1463 deletions(-) delete mode 100644 docs/valint/policies.md diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 4a92ee1fe..bb346338d 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -49,7 +49,7 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up --scribe.client-secret ``` - As a result, you will see the output table of the initiative verification. A detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. + As a result, you will see the output table of the initiative verification. A detailed description of the fields is provided in the corresponding section of the [Policy Results](../valint/policy-results.md#policy-results-in-valint-logs) page.
@@ -102,7 +102,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule --scribe.client-secret ``` - As a result, you will see the output table of the rule verification. A detailed description of the fields is provided in the [Reading the Results](#reading-the-results) section. + As a result, you will see the output table of the rule verification. A detailed description of the fields is provided in the corresponding section of the [Policy Results](../valint/policy-results.md#policy-results-in-valint-logs) page.
@@ -281,25 +281,6 @@ valint verify --initiative ssdf@v2 --all-evidence \ In this case, no rule was disabled, and all of them were verified. -### Reading the Results - -The results of the control verification are presented in a table format. The table consists of the following columns: - -- `RULE ID`: The unique identifier of the rule. -- `RULE NAME`: The name of the rule. -- `LEVEL`: The severity level of the rule. Only rules with the "error" level can fail the control. -- `VERIFIED`: A boolean value indicating whether the evidence signature was verified. Verification failure causes the rule to fail only if the rule requires a signed attestation. -- `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open". -- `SUMMARY`: The reason for the rule result. -- `TARGET`: The target asset of the rule verification. - -The results of the initiative verification are also presented in a table format. The table consists of the following columns: - -- `CONTROL ID`: The unique identifier of the control. -- `CONTROL NAME`: The name of the control. -- `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`. -- `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". - ## Sample Rule Catalog We provide a set of sample rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. diff --git a/docs/valint/policies.md b/docs/valint/policies.md deleted file mode 100644 index 5c56ffbc2..000000000 --- a/docs/valint/policies.md +++ /dev/null @@ -1,835 +0,0 @@ ---- -sidebar_label: "Applying policies" -title: Applying policies -author: mikey strauss - Scribe -sidebar_position: 5 -date: April 5, 2021 -geometry: margin=2cm ---- - -# Policies - -Each `policy` proposes to enforce a set of requirements (aka `rules`) your supply chain must comply with. The outcome of a policy evaluation is a policy result attestation, a report that details the rule evaluatoin results and references to the provided evidence. -Policy configuration can be set under the main configuration `policies` section. - -A `policy` consists of a set of `rules` and is verified if all of them are evaluated and verified. -A `rule` is verified if ANY `evidence` is found that complies with the `rule` configuration and setting. - -### Usage - -Policies can be configured as part of Valint configuration file, under the `policies` section - -```yaml -attest: - cocosign: - policies: # Set of policies - grouping rules - - name: - rules: # Set of rule settings/configuration and input - - name: "" - path: "" # Specify if an external script is used - description: "A brief rule description" - aggregate-results: false # Aggregate all of the rule violations to a single SARIF result - labels: [] # list of user-specified labels - initiatives: [] # list of related initatives, like SLSA, SSDF, etc. - evidence: #Evidence lookup parameters - signed: false - format-type: - filter-by: [] # A group of Context fields to use for the evidence lookup - with: {} # rule input, depending on the rule type -``` - -Or as a separate file, referenced in `--policy` flag (Early Availability, [see below](#external-policy-configs---early-availability)) - -```yaml -defaults: - labels: [] - initiatives: [] - evidence: - signed: false - format-type: - filter-by: [] -env: # File-wise environment variables for the template engine (see below) - ENV_VAR_1: "value" -name: -rules: # Set of rule settings/configuration and input - - name: "" - path: "" # Specify if an external script is used - description: "A brief rule description" - aggregate-results: false # Aggregate all of the rule violations to a single SARIF result - labels: [] # list of user-specified labels - initiatives: [] # list of related initatives, like SLSA, SSDF, etc. - evidence: #Evidence lookup parameters - signed: false - format-type: - filter-by: [] # A group of Context fields to use for the evidence lookup - with: {} # rule input, depending on the rule type -``` - -> Note the `defaults` section, which allows you to override values for the underlying rules, including evidence lookup parameters (which are used as defaults), labels and initatives (both appended to the existing lists). - -> Also note file-wise `env` values, used by `valint` for the [templating engine](#templating-policy-params). - -A single rule can also be described in a separate file and referenced by `--rule` flag (Early Availability, [see below](#external-policy-configs---early-availability)) - -```yaml -name: "" -path: "" # Specify if an external script is used -description: "A brief rule description" -aggregate-results: false # Aggregate all of the rule violations to a single SARIF result -labels: [] # list of user-specified labels -initiatives: [] # list of related initatives, like SLSA, SSDF, etc. -evidence: #Evidence lookup parameters - signed: false - format-type: - filter-by: [] # A group of Context fields to use for the evidence lookup -with: {} # rule input, depending on the rule type -``` - -> For configuration details, see the [configuration](./configuration.md) section. - -> For PKI configuration, see the [attestations](https://scribe-security.netlify.app/docs/valint/attestations) section. - -### Policy - -Policy support the following fields: - -* `disable`, disable rule (default _false_). -* `name`, policy name (**required**). -* `rules`, list of policy rule configuration. - -The field `name` can be omitted. In this case, the policy will be evaluated as a default policy. -If `rules` section is empty, the whole policy will be omitted. - -# Policy rules - -A rule is a compliance check that you can configure to your specific organization's requirements. - -* `disable`, disable rule (default _false_). -* `name`, policy rule name (**required**). -* `type`, type of the rule, currently supporting only `verify-artifact` (which is used as a default and therefore can be omitted). -* `description`, rule description (_optional_). -* `labels`, list of user-specified labels (_optional_). -* `initiatives`, list of related initiatives, like SLSA, SSDF, etc. (_optional_). -* `path`, path to a custom rule script **OR** `script`, embedded rule script. -* `script-lang` script language, currently only `rego` is supported. -* `evidence`, match on evidence with a specified parameters (see full description below). -* `with`, rule-specific configuration parameters (for the detailed description, see the docs for the specific rule). - -> For `evidence` details, see [Rule Configuration](#configuration) section. -> For `with` details, see related rule section. - -## Verify Artifact rule type - ---- -A rule of Verify Artifact type verifies some properties of an artifact. Examples of such checks are: - -* Signed Evidence: The artifact should include signed or unsigned evidence, as specified by the `signed` field in the input. -* Signing Identity: The artifact should be signed by a specific identity, as specified by the `identity` fields in the input (for signed evidence). -* Evidence Format: The evidence format should follow the specified format(s) provided in the `format-type` field of the input. -* Origin of artifact: The artifact should originate from an expected source, as specified by the `evidence` [origin labels](##origin-context). -For instance, you can verify that an artifact is generated from a particular pipeline or repository. -* Artifact details: The rule applies to a specific artifact or any group of artifacts, as specified by the `evidence` [subject labels](##subject-context). -* Policy as code: The rule allows extension of the verification using custom scripts, as specified by the `path` or `script` input. - -### Use cases - -A rule of `verify-artifact` type can be used to enforce compliance with specific supply chain requirements, such as: - -* Images must be signed and have a matching CycloneDX SBOM. -* Images must be built by a CircleCI workflow and produce a signed SLSA provenance. -* Tagged sources must be signed and verified by a set of individuals or processes. -* Released binaries must be built by Azure DevOps on a specific git repository using unsigned SLSA provenance. - -### Configuration - -```yaml -- name: "" # Any user provided name - description: "A brief rule description" - aggregate-results: false # Aggregate all of the rule violations to a single SARIF result - evidence: - signed: # Define if target should be signed - format-type: "" # Expected evidence format - filter-by: [] # A group of Context fields to use for the evidence lookup - {environment-context} # Any Evidence Context field is also supported for matching - with: - identity: - emails: [] # Signed email identities - uris: [] # Signed URIs identities - common-names: [] # Signed common name identities - {custom script input} # Any rule-specific input - path: # OR script - script-lang: rego # Currently only rego is supported - script: | # OR path - package verify - - verify = v { - v := { - "allow": {Custom policy validation} - } - } -``` - -### Examples - -Copy the Examples into a file named `.valint.yaml` in the same directory as running Valint commands. - -> For configuration details, see [configuration](./configuration.md) section. - -
- Signed Images policy -In this example, the policy rule named `signed_image` will evaluate images where signed by `mycompony.com` using `attest-cyclondex-json` format. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: signed_image - evidence: - signed: true - format-type: cyclonedx - target_type: image - with: - identity: - common-names: - - mycompany.com -``` - -**Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence, requires signing capabilities. -valint bom busybox:latest -o attest - -# Verify policy (cache store) -valint verify busybox:latest -``` - -
- -
- Image SLSA provenance policy -In this example, the policy rule named `slsa_prov_rule` will evaluate images where signed by `bob@mycompany.com` or `alice@mycompany.com` using `attest-slsa` format. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: slsa_prov_rule - evidence: - signed: true - format-type: slsa - target_type: image - with: - identity: - emails: - - bob@mycompany.com - - alice@mycompany.com -``` - -***Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence, requires signing capabilities. -valint bom busybox:latest -o attest-slsa - -# Verify policy (cache store) -valint verify busybox:latest -``` - -
- -
- Signed tagged sourced rule -In this example, the policy rule named "tagged_git_rule" will evaluate sources' `mycompany/somerepo` tags where defined in the `main` branch and signed by `bob@mycompany.com`. - -> The policy requires only the **HEAD** of the git target to comply to the policy not the entire history. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: tagged_git_rule - evidence: - signed: true - format-type: slsa - target_type: git - target_git_url: git@github.com:mycompany/somerepo.git # Git url of the target. - branch: main - with: - identity: - emails: - - bob@mycompany.com -``` - -***Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence, requires signing capabilities. -valint bom git:github.com:your_org/your_repo.git --tag 0.1.3 -o attest-slsa - -# Verify policy (cache store) -valint verify git:github.com:your_org/your_repo.git --tag 0.1.3 -i statement-slsa -``` - -
- -
- Binary verification -In this example, the policy, named "binary_origin" enforces requirements on the binary `my_binary.exe` was Originated from which Azure DevOps triggered by the `https://dev.azure.com/mycompany/somerepo` repo. -The policy rule also enforces an unsigned SLSA provenance statement is produced as evidence. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: binary_origin - evidence: - signed: false - format-type: slsa - target_type: file - context_type: azure - git_url: https://dev.azure.com/mycompany/somerepo # Git url of the environment. - input_name: my_binary.exe -``` - -***Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence -valint bom file:my_binary.exe -o statement-slsa - -# Verify policy (cache store) -valint verify file:my_binary.exe -``` - -
- -
- 3rd party verification -In this example, the policy rule named "3rd-party-scan" will evaluate scanned `3rd-party-scan.json` file, Originated from Azure DevOps triggered by the `https://dev.azure.com/mycompany/somerepo` and signed by `bob@mycompany.com`. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: 3rd-party-rule - evidence: - signed: true - format-type: generic - target_type: generic - context_type: azure - git_url: https://dev.azure.com/mycompany/somerepo - git_branch: main - input_name: 3rd-party-scan.json - with: - identity: - emails: - - bob@mycompany.com -``` - -***Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence -valint evidence 3rd-party-scan.json -o attest --predicate-type https://scanner.com/scan_format - -# Verify policy (cache store) -valint verify 3rd-party-scan.json -i attest-generic --predicate-type https://scanner.com/scan_format -``` - -
- -### Policy as Code - -You can define custom policies for artifacts verified by the rule by attaching them as code. After the rule enforces the origin and subject of the evidence, you can further analyze and customize the content to meet your organization's requirements. - -### Usage - -The following rule verifies the predicate of the evidence in a custom Rego script embedded in the policy. - -```yaml -- name: signed_image_custom_policy - evidence: - signed: true - format-type: cyclonedx - target_type: image - with: - identity: - common-names: - - mycompany.com - script: | - package verify - default allow = false - verify = { - "allow": allow - } - - allow = { - input.evidence.predicate-type == "https://cyclonedx.org/bom" - } -``` - -#### Rego script - -In order to add a verification script you must provide a `verify` rule in your script. -A Rego script can be provided in two forms: as an embedded code snippet in the `script` section or as a dedicated file using the `path` field. - -> By default `valint` looks for a `.valint.rego` file. - -Use the following rule structure. - -```bash -package verify -default allow = false - -verify = { - "allow": false, - "violation": { - "type": "violation_type", - "details": [], - }, - "summary": [{ - "allow": false, - "violations": count(violations), - "reason": "some reason string" - }], -} -``` - -#### Input structure - -Script input has the following structure. - -```yaml -evidence: {Intoto-statment} -verifier: {verifier-context} -config: -args: {custom script input} -stores: - oci: {OCI store configuration} - cache: {Cache store configuration} - scribe: {Scribe store configuration} -``` - -> When using Signed Attestations, the Custom Rego script receives the raw In-toto statement along with the identity of the signer. - -#### Output structure - -Script output must provide the following structure. - -```json -{ - "allow": bool, # Required - "summary": [ # Optional - { - "allow": bool, - "type": "string", - "details": "string", - "violations": "int", - "reason": "string" - }, - ], - "errors": [], # Optional - "violation": [ # Optional - { - "type": "string", - "details": [{}], - }, - ] -} -``` - -### Examples - -Copy the Examples into a file named `.valint.yaml` and Copy Examples custom script into file name `.valint.rego`. -Files should be in the same directory as running Valint commands. - -> For configuration details, see [configuration](./configuration.md) section. -> You may also use `path` field to set a custom path for your script. - - -
- Custom package policy -In this example, the policy rule named `custom-package-policy` to verify a custom package requirements. -In the example Alpine packages are forbidden. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: signed_image - evidence: - signed: true - format-type: cyclonedx - target_type: image - script: | - package verify - import data.policies.sbom_parser as parser - default allow = false - - verify = v { - v := { - "allow": allow, - "violation": violation(input.evidence.predicate.bom.components), - } - } - - allow { - v := violation(input.evidence.predicate.bom.components) - count(v) == 0 - input.evidence.predicateType == "https://cyclonedx.org/bom" - } - - violation(components) = v { - v := { x | - some i - comp := components[i] - comp.type == "library" - comp.group == "apk" - x := comp["purl"] - } - } -``` - -**Command:** -Run the command on the required supply chain location. - -```bash -# Generate required evidence, requires signing capabilities. -valint bom busybox:latest -o attest - -# Verify policy (cache store) -valint verify busybox:latest -``` - -
- -## Default policy - -When no policy configuration is found, the signed artifact policy is used. - -By default, the following command runs a signature and identity verification on the target provided: - -```bash -valint verify [target] --input-format [attest, attest-slsa] \ - --email [email] --common-name --uri [uri] -``` - -In other words, the Signed Artifact policy allows you to verify signature compliance and format of artifacts in your supply chain. - -> For full command details, see [valint verify](#evidence-verification---verify-command) section. - -
- Default Policy Evaluation -The default policy can also be evaluated as the following policy configuration: - -```yaml -attest: - cocosign: - policies: - - name: default-policy - rules: - name: "default-rule" - evidence: - signed: true - format: ${current.content_type} # Populated by --input-format flag. - sbomversion: ${current.sbomversion} # Populated from the artifact version provided to verify command. - with: - identity: # Populated by `--email`, `--uri` and `--common-name flags sets -``` - -> For rule details, see [verify artifact rule](#verify-artifact-rule) section. - -
- -## Templating policy params - -The template engine for policy configuration provides users with a flexible mechanism to define and customize policies through the use of template arguments. These template arguments act as placeholders within the policy configuration, allowing users to dynamically substitute values before the policy is evaluated. - -Currently `valint` supports three groups of template arguments: - -1. Context-defined -Context arguments are derived from the evidence context, enabling users to directly reference any field within it. The syntax for referencing a context variable is as follows: `{{ .Context. }}`. -Replace `` with the specific variable name from the evidence context that you want to use. Foe example, `{{ .Context.git_commit }}`. - -2. Environment-defined -Environment arguments are derived from the environment variables. The syntax for referencing an environment variable is as follows: `{{ .Env. }}`. -Note that one can define file-wise environment variables in the policy configuration file under the `env` field. These variables will only be used for the template evaluations in the file where they are defined. - -3. User-defined -Users can pass custom arguments through the command line using the `--rule-args` flag. These user-defined arguments are then referenced in the policy configuration using the following syntax: `{{ .Args. }}`. - -For example, - -```bash -valint verify git:repo.git --rule-args "my_arg"="foo" -``` - -In the policy configuration: `{{ .Args.my_arg }}`. - -***Replacement and Error Handling*** - -Before a policy is evaluated, template engine performs a substitution of templated arguments with the corresponding values. -If the replacement process encounters an issue, such as no value provided for a variable used by the configuration, an error is issued and policy evaluation is halted. - -
- Usage - -This example demonstrates the use of template arguments in a policy configuration. The policy requires that the evidence is generated from a specific git repository and branch. The git repository and branch should beare passed as arguments to the policy using the `--rule-args` flag as `--rule-args git_url= --rule-args git_branch=`. The target_type is passed as a field from the evidence context. - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: my_rule - with: - signed: true - format-type: cyclonedx - target_type: '{{ .Context.target_type }}' - git_url: '{{ .Args.git_url }}' - git_branch: '{{ .Args.git_branch }}' -``` - -
- -## Filtering Policy Rules (Early Availability) - -Since policy rules can be labeled with user-defined labels and also can be a part of one ore more initiatives, it's possible to filter them by these parameters on runtime. For this purpose, `valint` has flags `--rule-label` and `--initiative` respectively. - -When using these flags, `valint` will only evaluate the rules that match the provided labels and/or initiatives. In order to be run, a rule should match all the provided labels and/or any of the initiatives. If a rule doesn't match the requirements, it will be disabled. Similarly, if no rules in a policy match the requirements, the policy will be omitted. - -## Evidence Lookup - -In order to run a policy rule, `valint` requires relevant evidence, which can be found in a storage using a number of parameters. These parameters can be set manually by the user or automatically derived from the context. Parameters that can be derived automatically are categorized into three context groups: "target," "pipeline", and "product". - -1. `target` context group specifies parameters that can be derived from the target provided (if any). Those parameters are: - * `target_type` - the type of the target provided (e.g., image, git, generic etc.) - * `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) - -2. `pipeline` context group specifies parameters that can be derived from the running environment. Those parameters are: - * `context_type` - type of the environment (e.g., local, github, etc.) - * `git_url` - git url of the repository (if any) - * `git_commit` - git commit of the current repository state (if any) - * `run_id` - run id - * `build_num` - build number - -3. `product` context group specifies product parameters that can be derived from the command line arguments. Those parameters are: - * `name` - name of the product - * `product_version` - version of the product - * `predicate_type` - type of the predicate (e.g., https://cyclonedx.org/bom, https://slsa.dev/provenance/v0.1, etc.) - -User can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. -By default `target` and `product` groups are used. -The list of groups to be used should be provided to the `attest.cocosign.policies..rules..evidence.filter-by` field in the configuration file. - -In addition, one can manually specify any parameters that they want to be matched by an evidence. For example, these can be `git_url` or `timestamp`. - -If more than one evidence is found, the newest one is used. - -
- Usage - -An example of using the `target` context group and a specific timestamp value is shown below: - -```yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: my_rule - evidence: - signed: true - format-type: cyclonedx - timestamp: "2023-11-16T09:46:25+02:00" # manually specified timestamp - filter-by: - - target -``` - -
- -### Targetless Run - -Using `evidence` field it's possible to run a policy rule without providing a target. In this case, the evidence will be looked up using the provided parameters for each rule and no values from any target will be used (simply, the `filter-by: target` flag will be ignored). -To be able to run `valint verify` in targetless mode, the `evidence` field in a rule config should describe the needed evidence well enough. -In the following example, the newest evidence of `target_type: image` for the provided product (defined by the name & version) will be used. - -```yaml -# my_policy.yaml -attest: - cocosign: - policies: - - name: my_policy - rules: - - name: my_rule - evidence: - signed: true - format-type: cyclonedx - target_ttpe: image - filter-by: - - product - with: - identity: - emails: - - my@email.com -``` - -```bash -valint bom busybox:latest -o attest --product-key my_product --product-version 1.0.0 -``` - -```bash -valint verify --product-key my_product --product-version 1.0.0 -c my_policy.yaml -``` - -## External policy configs - Early Availability - -Policy or rule configuration can be set not only in the main configuration file but also in external files. This can be useful when you want to reuse the same policy configuration for different targets or as a part of a configuration bundle or when you just want to keep your main configuration file clean. - -External policy/rule configuration can be set in a separate file and then referenced in the cmd args via the `--policy/--rule` flag correspondingly or in the main configuration file via the `attest.policy_configs` field of type `[]string`. - -Each extermal configuration should represent an entry to `attest.cocosign.policies` or to `attest.cocosign.policies[].rules` field of the main configuration file. - -For example, a policy configuration defined by the following file: - -```yaml -attest: - cocosign: - policies: - - name: default - rules: - - name: "default-rule" - evidence: - signed: true - format-type: cyclonedx - with: - identity: - emails: - - my@email.com -``` - -Can be represented in an external `policy` file like - -```yaml -name: default -rules: - - name: "default-rule" - evidence: - signed: true - format-type: cyclonedx - with: - identity: - emails: - - my@email.com -``` - -or in an external `rule` file like - -```yaml -name: "default-rule" -evidence: - signed: true - format-type: cyclonedx -with: - identity: - emails: - - my@email.com -``` - -One can reference several policies/rules configs per `valint verify` run. - -When using `--policy/--rule` flag, `valint` will first lookup the config in local FS and if not found, will try to use a config from the bundle (if used). - -### Bundle policy configs - Early Availability - -Policy configurations along with the corresponding rego scripts can be bundled together in a directory or a git repo and then referenced in the cmd args via the `--bundle` flag or in the main configuration file via the `attest.bundle` field. -In case of using a git repo, it's possible to also specify a branch and a commit or a tag to be used with `--git-branch`, `--git-commit` and `--git-tag` options respectively. The repo would be cloned automatically by `valint`. -For the GitHub authentication, a token can be provided via `GITHUB_TOKEN` environment variable or as part of url like `@github.com`. - -To reference a policy/rule in a bundle, the relative path to the bundle root should be provided in the `--policy/--rule` flag correspondingly. - -#### Default bundle - -By default, `valint` defaults to work with [scribe-public/sample-policies](https://github.com/scribe-public/sample-policies) as a bundle. One can use its rules out of the box by providing the rule name in the `--policy/--rule` flags. If no `--policy` or `--rule` flag is provided or the `--skip-bundle` flag is used, no bundle will be downloaded. - -#### Reusing bundle rules - -The "uses" flag in rule descriptions allows users to utilize external configurations from a bundle as a base for creating custom rules. This feature simplifies reusing of bundle rules with different parameters. - -For example, lets reuse bundle config `v1/images/fresh-image.yaml`. Let's create a local rule config file: - -```yaml -uses: images/fresh-image@v1 -with: - max_days: 1000 -``` - -Note that the config file extension is applied by `valint` automatically, there's no need to specify it. - -The value `with.max_days: 1000` will override the default from the bundle config, the other values will remain the same. If needed, one can override any other value from the bundle config. - -It's also possible to create a policy config utilizing multiple bundle rules: - -```yaml -rules: - - uses: images/fresh-image@v1 - with: - max_days: 1000 - - uses: images/forbid-large-images@v1 -``` - -Such policy configs can later be referenced in the `--policy` flag (see examples below). - -### Examples - -To run an external policy, say, on a docker image target, first we need to create an image SBOM: - -```bash -valint bom busybox:latest -o attest -``` - -Then, if we have a policy rule like - -```yaml -name: "default-rule" -evidence: - signed: true - format-type: cyclonedx -with: - identity: - emails: - - my@email.com -``` - -saved in `path/to/rule.yaml`, we can run the policy: - -```bash -valint verify busybox:latest --rule /path/to/rule.yaml -``` - -If the rule is a part of a bundle and the path in the bundle looks like `v1/images/rule.yaml`, then we can run it like - -```bash -valint verify busybox:latest --bundle https://github.com/user/bundle --git-tag v1.0.0 --rule images/rule@v1 -``` - -An example of policy evaluation results can be found in the [policy results](policy-results) section. diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md index 2d051de99..dd8951b2b 100644 --- a/docs/valint/policy-results.md +++ b/docs/valint/policy-results.md @@ -36,6 +36,27 @@ It's also possible to determine how policy results are included in the output. T +## Policy results in valint logs + +After policy evaluation, the results are shown in the output log as a table. This table provides a quick overview of the evaluation results for each rule, as well as the overall control results. For an example of the output, see the [Example](#example) section. + +The results of the control verification are presented in a table format. The table consists of the following columns: + +* `RULE ID`: The unique identifier of the rule. +* `RULE NAME`: The name of the rule. +* `LEVEL`: The severity level of the rule. Only rules with the "error" level can fail the control. +* `VERIFIED`: A boolean value indicating whether the evidence signature was verified. Verification failure causes the rule to fail only if the rule requires a signed attestation. +* `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open". +* `SUMMARY`: The reason for the rule result. +* `TARGET`: The target asset of the rule verification. + +The results of the initiative verification are also presented in a table format. The table consists of the following columns: + +* `CONTROL ID`: The unique identifier of the control. +* `CONTROL NAME`: The name of the control. +* `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`. +* `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". + ## Example To illustrate the process of creating attestations and evaluating policy results, consider the following example. In this case, we'll create a signed SBOM (Software Bill of Materials) evidence for the busybox image and then evaluate it against a policy named image-fresh. @@ -48,29 +69,45 @@ valint bom busybox:latest -o attest We first use `valint bom` command generates a signed SBOM evidence for the busybox image using the default output format, which is an in-toto statement (attest). -Evaluate Policy: +Evaluate Initiative: ```bash -valint verify busybox:latest -i attest --rule v1/images/image-fresh.yaml +valint verify busybox:latest --initiative ssdf@v2 ``` -Next we use `valint verify` command to evaluate the busybox image against the specified policy rule (`image-fresh.yaml`). -> The `--rule` option is currently in Early Availability. -After executing these commands, the results of the policy evaluation are displayed in the output log as a table, summarizing the evaluation for each rule: +Next we use `valint verify` command to evaluate the busybox image against the corresponding set of rules from the SSDF.PS initiative. + +After executing these commands, the results of the evaluation are displayed in the output log as a table, summarizing the evaluation for each rule: After policy evaluation, the results are shown in the output log as a table: ```bash -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Policy "default" Evaluation Summary │ -├─────────────────────────┬────────┬────────────────────────┬───────────────────┬──────────────────────────────────────────────┤ -│ RULE NAME │ SIGNED │ SIGNATURE VERIFICATION │ POLICY EVALUATION │ COMMENT │ -├─────────────────────────┼────────┼────────────────────────┼───────────────────┼──────────────────────────────────────────────┤ -│ fresh-image │ true │ passed │ passed │ 1/1 evidence origin and signature verified, │ -│ │ │ │ │ image is new enough │ -├─────────────────────────┼────────┼────────────────────────┼───────────────────┼──────────────────────────────────────────────┤ -│ AGGREGATE POLICY RESULT │ │ │ PASSED │ │ -└─────────────────────────┴────────┴────────────────────────┴───────────────────┴──────────────────────────────────────────────┘ +INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ +Evaluation Target Name 'index.docker.io/library/busybox:latest' + +INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────┐ +│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summ │ +│ ary │ +├───────────────────┬───────────────┬──────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────┼────────┤ +│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ +│ │ │ PS.3.2(pass) │ │ +├───────────────────┼───────────────┼──────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴───────────────┴──────────────┴────────┘ ``` Moreover, the Sarif result is produced and dispatched as evidence, providing the option for it to be signed based on specific requirements. This signing capability enhances the integrity and authenticity of the generated evidence, ensuring a secure and verifiable representation of the policy evaluation results. @@ -97,611 +134,1228 @@ Results are also presented as a SARIF report inside an in-toto statement. ```json { - "_type": "https://in-toto.io/Statement/v0.1", - "predicateType": "http://docs.oasis-open.org/sarif/sarif/2.1.0", - "subject": [ - { - "name": "", - "digest": { - "sha256": "0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216" - } - } - ], - "predicate": { - "environment": { - "hostname": "runner_1", - "user": "username", - "name": "busybox", - "product_version": "v0.1", - "timestamp": "2024-01-23T15:47:22+02:00", - "input_scheme": "docker", - "input_name": "busybox", - "input_tag": "latest", - "content_type": "statement-sarif", - "context_type": "local", - "predicate_type": "http://docs.oasis-open.org/sarif/sarif/2.1.0", - "tool": "valint", - "tool_version": "1.0.0-18", - "format_type": "sarif", - "format_version": "2.1.0", - "format_encoding": "json", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" - ], - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "size": 4261550, - "platform": "linux/amd64", - "target_type": "policy-results", - "sbomgroup": "generic", - "sbomname": "index.docker.io/library/busybox:latest", - "sbomversion": "sha256:0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216", - "sbomhashs": [ - "sha256-0aad8ad1c18814a2389319186fdd0473e78ca8cd69a36a8d322bfda3fdbb5216" - ], - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "policies": [ - "my_policy", - "default" - ], - "rules": [ - "signed_image", - "fresh-image" - ], - "rule_types": [ - "verify-artifact", - "verify-artifact" - ], - "allow": true, - "policy-scripts": { - "": "", - "fresh-image.rego": "e90241897259b16872cbcb61acad6b8cc61898b11f73d8b7f4a3f58c7d5f1319" - } - }, - "mimeType": "application/json", - "content": { - "version": "2.1.0", - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", - "runs": [ + "_type": "https://in-toto.io/Statement/v0.1", + "predicateType": "http://docs.oasis-open.org/sarif/sarif/2.1.0", + "subject": [ { - "tool": { - "driver": { - "informationUri": "https://scribesecurity.com", - "name": "valint", - "rules": [ - { - "id": "signed_image", - "name": "my_policy", - "shortDescription": { - "text": "my_policy.signed_image" - }, - "fullDescription": { - "text": "" - }, - "defaultConfiguration": { - "level": "error" - }, - "help": { - "text": "my_policy.signed_image", - "markdown": "## rule details\n\u003e **Signed evidence:** yes\n\u003e **Format:** attest-cyclonedx-json\n\n\n### **Match criteria**\n```yaml\nname: busybox\nproduct_version: v0.1\ncontent_type: attest-cyclonedx-json\npredicate_type: https://cyclonedx.org/bom/v1.4\ntarget_type: image\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\n```\n\n\n### **Verified Evidence**\n```yaml\nhostname: runner_1\nuser: username\nname: busybox\nproduct_version: v0.1\ntimestamp: \"2024-01-23T15:43:58+02:00\"\ninput_scheme: docker\ninput_name: busybox\ninput_tag: latest\ncontent_type: attest-cyclonedx-json\ncontext_type: local\npredicate_type: https://cyclonedx.org/bom/v1.4\ntool: valint\ntool_version: 1.0.0-18\ntool_vendor: Scribe Security\nformat_type: cyclonedx\nformat_version: \"1.4\"\nformat_encoding: json\ngit_url: https://github.com/scribe-security/valint.git\ngit_branch: main\ngit_tag: v1.0.0-17\ngit_commit: 0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45\ngit_ref: refs/heads/main\nimageID: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nrepoDigest:\n - busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\ntag:\n - latest\n - 1.36.1\n - latest\nsize: 4261550\nplatform: linux/amd64\ntarget_type: image\nsbomgroup: image\nsbomname: index.docker.io/library/busybox:latest\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbomhashs:\n - sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\n - sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbompurl: pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64\nref: /home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json\nstore: cache\n```\n" - }, - "properties": { - "initiatives": null, - "labels": null, - "policy-name": "my_policy", - "rule-type": "verify-artifact", - "tags": [ - "attest-cyclonedx-json", - "image", - "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "https://cyclonedx.org/bom/v1.4", - "scribe", - "policy", - "busybox", - "v0.1", - "local", - "latest" - ] - } - }, - { - "id": "fresh-image", - "name": "default", - "shortDescription": { - "text": "A rule to verify that the image is not older than a threshold" - }, - "fullDescription": { - "text": "The Verify Artifact rule enforces a custom policy script" - }, - "defaultConfiguration": { - "level": "error" - }, - "help": { - "text": "A rule to verify that the image is not older than a threshold", - "markdown": "## rule details\n\u003e **Description:** A rule to verify that the image is not older than a threshold\n\u003e **Signed evidence:** yes\n\u003e **Format:** attest-cyclonedx-json\n\u003e **Script:** /home/username/scribe/sample-policies/v1/images/fresh-image.rego\n\n\n### **Match criteria**\n```yaml\nname: busybox\nproduct_version: v0.1\ncontent_type: attest-cyclonedx-json\npredicate_type: https://cyclonedx.org/bom/v1.4\ntarget_type: image\n```\n\n\n### **Policy arguments**\n```yaml\nmax_days: 1830\n```\n\n\n### **Verified Evidence**\n```yaml\nhostname: runner_1\nuser: username\nname: busybox\nproduct_version: v0.1\ntimestamp: \"2024-01-23T15:43:58+02:00\"\ninput_scheme: docker\ninput_name: busybox\ninput_tag: latest\ncontent_type: attest-cyclonedx-json\ncontext_type: local\npredicate_type: https://cyclonedx.org/bom/v1.4\ntool: valint\ntool_version: 1.0.0-18\ntool_vendor: Scribe Security\nformat_type: cyclonedx\nformat_version: \"1.4\"\nformat_encoding: json\ngit_url: https://github.com/scribe-security/valint.git\ngit_branch: main\ngit_tag: v1.0.0-17\ngit_commit: 0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45\ngit_ref: refs/heads/main\nimageID: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nrepoDigest:\n - busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\ntag:\n - latest\n - 1.36.1\n - latest\nsize: 4261550\nplatform: linux/amd64\ntarget_type: image\nsbomgroup: image\nsbomname: index.docker.io/library/busybox:latest\nsbomversion: sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbomhashs:\n - sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79\n - sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\nsbompurl: pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64\nref: /home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json\nstore: cache\n```\n" - }, - "properties": { - "initiatives": [ - "client-policy" - ], - "labels": [ - "images", - "sample-policy-bundle" - ], - "policy-name": "default", - "rule-type": "verify-artifact", - "tags": [ - "policy", - "busybox", - "sample-policy-bundle", - "v0.1", - "attest-cyclonedx-json", - "local", - "image", - "scribe", - "client-policy", - "images" - ] - } - } - ], - "semanticVersion": "1.0.0-18", - "version": "1.0.0-18" + "name": "", + "digest": { + "sha256": "3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104" } - }, - "invocations": [ - { - "commandLine": "valint verify busybox:latest --bundle=/home/username/scribe/sample-policies/ --config=/home/username/scribe/valint/valint2.yaml --policy=[v1/images/fresh-image.yaml] --product-key=busybox --product-version=v0.1 --verbose=2", - "executionSuccessful": true, - "exitSignalName": "passed" + } + ], + "predicate": { + "environment": { + "hostname": "thinkpad", + "user": "viktor", + "labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "timestamp": "2025-03-06T15:36:53+02:00", + "input_name": "busybox", + "input_tag": "latest", + "content_type": "statement-sarif", + "content_body_type": "sarif", + "context_type": "local", + "predicate_type": "http://docs.oasis-open.org/sarif/sarif/2.1.0", + "tool": "valint", + "tool_version": "1.5.18", + "format_type": "sarif", + "format_version": "2.1.0", + "format_encoding": "json", + "git_url": "https://github.com/scribe-security/valint.git", + "git_branch": "feat/sh-5802_initiatives_config", + "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", + "git_ref": "refs/heads/feat/sh-5802_initiatives_config", + "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "repoDigest": [ + "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + ], + "tag": [ + "latest", + "1.36.1", + "latest" + ], + "size": 4261550, + "platform": "linux/amd64", + "created": "2023-07-18T23:19:33.655005962Z", + "file_id": "sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "file_path": "index.docker.io/library/busybox:latest", + "target_type": "policy-results", + "sbomtype": "container", + "sbomgroup": "data", + "sbomname": "index.docker.io/library/busybox:latest", + "sbomversion": "sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "sbomhashs": [ + "sha256-3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104" + ], + "sbompurl": "pkg:data/index.docker.io/library/busybox:latest@sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "initiative": { + "name": "SSDF Client Initiative", + "id": "SSDF", + "version": "1.0.0", + "description": "Evaluate PS rules from the SSDF initiative", + "url": "https://csrc.nist.gov/pubs/sp/800/218/final", + "fingerprint": "788a0897074facf3eb9572dc04172e4db8ca30582fe02b2d31c93d3428d38043" + }, + "controls": [ + "SSDF-IMAGE::SSDF" + ], + "rules": [ + "PS.2::SSDF-IMAGE::SSDF", + "PS.3.2::SSDF-IMAGE::SSDF" + ], + "allow": true, + "rule-scripts": { + "artifact-signed.rego": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", + "data.rego": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474" + }, + "bundle_info": { + "git_branch": "v2", + "git_target": "/home/viktor/.cache/valint/.tmp/git_tmp_3916451226", + "git_repo": "https://github.com/scribe-public/sample-policies.git", + "git_ref": "refs/heads/v2", + "git_commit": "fcf251b0d3910a9679be812cf4a87a4e86e0aafc" } - ], - "results": [ - { - "properties": { - "verify-artifact.signed_image": [ - { - "content_type": "attest-cyclonedx-json", - "context_type": "local", - "format_encoding": "json", - "format_type": "cyclonedx", - "format_version": "1.4", - "git_branch": "main", - "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45", - "git_ref": "refs/heads/main", - "git_tag": "v1.0.0-17", - "git_url": "https://github.com/scribe-security/valint.git", - "hostname": "runner_1", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "input_name": "busybox", - "input_scheme": "docker", - "input_tag": "latest", - "name": "busybox", - "platform": "linux/amd64", - "predicate_type": "https://cyclonedx.org/bom/v1.4", - "product_version": "v0.1", - "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" - ], - "sbomgroup": "image", - "sbomhashs": [ - "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", - "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" - ], - "sbomname": "index.docker.io/library/busybox:latest", - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "size": 4261550, - "store": "cache", - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "target_type": "image", - "timestamp": "2024-01-23T15:43:58+02:00", - "tool": "valint", - "tool_vendor": "Scribe Security", - "tool_version": "1.0.0-18", - "user": "username" - } - ] - }, - "ruleId": "signed_image", - "ruleIndex": 0, - "kind": "pass", - "level": "note", - "message": { - "text": "Rule passed verify-artifact because 1/1 evidence origin and signature verified", - "markdown": "Rule passed verify-artifact because 1/1 evidence origin and signature verified" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "URL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "PRODUCT" - } - }, + }, + "mimeType": "application/json", + "content": { + "version": "2.1.0", + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "runs": [ { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" + "tool": { + "driver": { + "informationUri": "https://scribesecurity.com", + "name": "valint", + "rules": [ + { + "id": "PS.2::SSDF-IMAGE::SSDF", + "name": "Image-verifiable", + "shortDescription": { + "text": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "fullDescription": { + "text": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true, + "target_type": "container" + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] + } + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.2 Provide a mechanism to verify the integrity of the image", + "markdown": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF IMAGE", + "file-hash": "a8db33184159e89d7a8bd843d64e215c3af73958e281893f0a3ef1715287c131", + "labels": [ + "SSDF", + "SBOM", + "Blueprint" + ], + "rego-hash": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", + "rule-hash": "04ff5b7a55fcf138f420837d38c5029cb9a82202dc77063fe06b24851744e673" + } + }, + { + "id": "PS.3.2::SSDF-IMAGE::SSDF", + "name": "SBOM archived", + "shortDescription": { + "text": "PS.3.2 Archive SBOM" + }, + "fullDescription": { + "text": "PS.3.2 Archive SBOM" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] + } + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.3.2 Archive SBOM", + "markdown": "PS.3.2 Archive SBOM" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF IMAGE", + "file-hash": "926477da64e501041207be467f9ee194b19b81305116c15cb3043a6214290a20", + "labels": [ + "SSDF", + "SBOM", + "Blueprint" + ], + "rego-hash": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", + "rule-hash": "892641a5829f5104dbd4a8a8d7e39f67a96b32eaf0363685997a27bd85e87459" + } + }, + { + "id": "PS.1.1::SSDF-ORG::SSDF", + "name": "Enforce 2FA", + "shortDescription": { + "text": "PS.1 Require 2FA for accessing code" + }, + "fullDescription": { + "text": "PS.1 Require 2FA for accessing code" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": false + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.1 Require 2FA for accessing code", + "markdown": "PS.1 Require 2FA for accessing code" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF ORG", + "file-hash": "973ab95c2e10dbc7f30239ba863856db4b63e80006e9bcaac00663ba109cd955", + "labels": [ + "SSDF", + "GitHub", + "Organization" + ], + "rego-hash": "7886079cbb1645876dc699c59ed1a313d50fed2d303003def656093685504f8e", + "rule-hash": "3a562d2a6d9c2b4f2543e53c7877d770ae4cc526afb466090eef58dd86beacb9" + } + }, + { + "id": "PS.1.3::SSDF-ORG::SSDF", + "name": "Limit admins", + "shortDescription": { + "text": "PS.1 Restrict the maximum number of organization admins" + }, + "fullDescription": { + "text": "PS.1 Restrict the maximum number of organization admins" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "max_admins": 3 + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.1 Restrict the maximum number of organization admins", + "markdown": "PS.1 Restrict the maximum number of organization admins" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF ORG", + "file-hash": "d06ae8fa2d1c9b5368742ce74cc08ce8c2a51c00b15cb56e30ac66897cce4d99", + "labels": [ + "SSDF", + "Blueprint", + "GitHub", + "Organization" + ], + "rego-hash": "6db3e98fb06073d449477ab08f08bd7c507578d5be89c1ec74edc56c2f7e52b8", + "rule-hash": "b5ef81aca0c597cf2019b2652feb17ba0257b90551a2000962dd4e84149fe724" + } + }, + { + "id": "PS.1.5::SSDF-ORG::SSDF", + "name": "Require signoff on web commits", + "shortDescription": { + "text": "PS.1 Require contributors to sign when committing to Github through the web interface" + }, + "fullDescription": { + "text": "PS.1 Require contributors to sign when committing to Github through the web interface" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": true + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.1 Require contributors to sign when committing to Github through the web interface", + "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF ORG", + "file-hash": "87e452e4adfd2f96320a19529be38c3636c9018b2c93b162fd7f47b72152f0ec", + "labels": [ + "SSDF", + "GitHub", + "Organization" + ], + "rego-hash": "56fea30cb520fff9d9d32ba0926857b521d8e1b5b971d081b0283ea2ae206fd8", + "rule-hash": "f9bad566b0b69003b19fcdb0e28448d1491c5da3700ea9b47ac7c6d10082bccb" + } + }, + { + "id": "PS.3.1::SSDF-REPO::SSDF", + "name": "Code archived", + "shortDescription": { + "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" + }, + "fullDescription": { + "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "labels": null, + "signed": false + } + }, + "input-args": { + "allow": true, + "description": "Since the code is within a repository, it is archived.", + "reason": "The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository.", + "short_description": "Code is archived.", + "violations": [ + { + "violation1": "thing 1" + }, + { + "something2": [ + "some", + "thing" + ], + "violation2": "thing 2" + } + ] + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n", + "markdown": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF REPO", + "file-hash": "6f5ec45673d0172e0b9213fb695e5315b5072c0355e5648a5babf5661fce902f", + "labels": [ + "SSDF" + ], + "rego-hash": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474", + "rule-hash": "49b62752968edd1f0e536dc584cc69a6bf00e5b8ee2f1768307716c097c08b1a" + } + }, + { + "id": "PS.1.2::SSDF-REPO::SSDF", + "name": "Branch protected", + "shortDescription": { + "text": "PS.1 Require branch protection for the repository" + }, + "fullDescription": { + "text": "PS.1 Require branch protection for the repository" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "branches": [ + "main", + "master" + ], + "desired_protected": true + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.1 Require branch protection for the repository", + "markdown": "PS.1 Require branch protection for the repository" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF REPO", + "file-hash": "8778a4509cf0f8c93c57f3dc106ebe00a865ee3c2deb0f5aa57e2d1b67c91164", + "labels": [ + "SSDF", + "GitHub", + "Repository" + ], + "rego-hash": "76018c06ddb321ab19e9fae6d3fdf4ebd1b04f4425239c724081f6fb8d914647", + "rule-hash": "49f62941f62a7607efd7c086f7d3734985405e3f514e9dd0daf4a4bd3c1fff8e" + } + }, + { + "id": "PS.1.4::SSDF-REPO::SSDF", + "name": "Repo private", + "shortDescription": { + "text": "PS.1 Assure the repository is private" + }, + "fullDescription": { + "text": "PS.1 Assure the repository is private" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": true + } + } + } + }, + "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", + "help": { + "text": "PS.1 Assure the repository is private", + "markdown": "PS.1 Assure the repository is private" + }, + "properties": { + "conditions": {}, + "control-name": "SSDF REPO", + "file-hash": "9330a8fe3aa89fa06d5f5ec52d844e345e0420a99ac3ea2ddbdc4266bdacee18", + "labels": [ + "SSDF", + "GitHub", + "Repository" + ], + "rego-hash": "d39b92225c2fbf94d2874c2e47cc1384175730db23ae9006404ee385f97385ff", + "rule-hash": "d6c637d07a348636d5e68d440f4f26908bc71ac4b42cf0b5029d1dd043f679db" + } + } + ], + "semanticVersion": "1.5.18", + "version": "1.5.18" + } }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "NAME" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "PURL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "REF" - } - } - ] - }, - { - "properties": { - "verify-artifact.fresh-image": [ - { - "content_type": "attest-cyclonedx-json", - "context_type": "local", - "format_encoding": "json", - "format_type": "cyclonedx", - "format_version": "1.4", - "git_branch": "main", - "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45", - "git_ref": "refs/heads/main", - "git_tag": "v1.0.0-17", - "git_url": "https://github.com/scribe-security/valint.git", - "hostname": "runner_1", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "input_name": "busybox", - "input_scheme": "docker", - "input_tag": "latest", - "name": "busybox", - "platform": "linux/amd64", - "predicate_type": "https://cyclonedx.org/bom/v1.4", - "product_version": "v0.1", - "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + "invocations": [ + { + "commandLine": "valint verify busybox:latest --bundle-branch=v2 --initiative=ssdf@v2", + "executionSuccessful": true, + "exitCode": 0, + "exitCodeDescription": "valint exited with 0, control evaluation result is: pass" + } ], - "sbomgroup": "image", - "sbomhashs": [ - "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", - "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + "results": [ + { + "properties": { + "asset": { + "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "asset-name": "busybox:1.36.1", + "asset-type": "image" + }, + "evidence": { + "content_body_type": "cyclonedx-json", + "content_type": "attest-cyclonedx-json", + "context_type": "local", + "created": "2023-07-18T23:19:33.655005962Z", + "email_addresses": [ + "victor.kartashov@gmail.com" + ], + "extra_labels": [ + "component-group=dep", + "component-group=base_image", + "component-group=metadata", + "component-group=packages", + "signer=victor.kartashov@gmail.com", + "signer-issuer=sigstore-intermediate" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "feat/sh-5802_initiatives_config", + "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", + "git_ref": "refs/heads/feat/sh-5802_initiatives_config", + "git_url": "https://github.com/scribe-security/valint.git", + "hostname": "thinkpad", + "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "input_name": "busybox", + "input_scheme": "docker", + "input_tag": "latest", + "issuer": "sigstore-intermediate", + "labels": [ + "component-group=base_image", + "component-group=dep", + "component-group=metadata", + "component-group=packages", + "signer-issuer=sigstore-intermediate", + "signer=victor.kartashov@gmail.com" + ], + "platform": "linux/amd64", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "ref": "/home/viktor/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", + "repoDigest": [ + "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + ], + "sbomcomponents": [ + "base_image", + "dep", + "metadata", + "packages" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", + "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + ], + "sbomname": "index.docker.io/library/busybox:latest", + "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "signed": true, + "size": 4261550, + "store": "cache", + "tag": [ + "latest", + "1.36.1", + "latest" + ], + "target_type": "container", + "timestamp": "2025-03-06T15:35:50+02:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "1.5.18", + "user": "viktor" + } + }, + "ruleId": "PS.3.2::SSDF-IMAGE::SSDF", + "ruleIndex": 1, + "kind": "pass", + "level": "note", + "message": { + "text": "1/1 evidence origin and signature verified. Evidence signature verified", + "markdown": "1/1 evidence origin and signature verified. Evidence signature verified" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "URL" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "busybox" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "NAME" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "PURL" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "%2Fhome%2Fviktor%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "REF" + } + } + ], + "fingerprints": { + "sha256/v1": "3b1ea9e86542f89ba143f8bc12567da7a520e0f0b478a3284b6da62a29271591" + } + }, + { + "properties": { + "asset": { + "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "asset-name": "busybox:1.36.1", + "asset-type": "image" + }, + "evidence": { + "content_body_type": "cyclonedx-json", + "content_type": "attest-cyclonedx-json", + "context_type": "local", + "created": "2023-07-18T23:19:33.655005962Z", + "email_addresses": [ + "victor.kartashov@gmail.com" + ], + "extra_labels": [ + "component-group=dep", + "component-group=base_image", + "component-group=metadata", + "component-group=packages", + "signer=victor.kartashov@gmail.com", + "signer-issuer=sigstore-intermediate" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "feat/sh-5802_initiatives_config", + "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", + "git_ref": "refs/heads/feat/sh-5802_initiatives_config", + "git_url": "https://github.com/scribe-security/valint.git", + "hostname": "thinkpad", + "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "input_name": "busybox", + "input_scheme": "docker", + "input_tag": "latest", + "issuer": "sigstore-intermediate", + "labels": [ + "component-group=base_image", + "component-group=dep", + "component-group=metadata", + "component-group=packages", + "signer-issuer=sigstore-intermediate", + "signer=victor.kartashov@gmail.com" + ], + "platform": "linux/amd64", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "ref": "/home/viktor/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", + "repoDigest": [ + "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + ], + "sbomcomponents": [ + "base_image", + "dep", + "metadata", + "packages" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", + "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + ], + "sbomname": "index.docker.io/library/busybox:latest", + "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "signed": true, + "size": 4261550, + "store": "cache", + "tag": [ + "latest", + "1.36.1", + "latest" + ], + "target_type": "container", + "timestamp": "2025-03-06T15:35:50+02:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "1.5.18", + "user": "viktor" + } + }, + "ruleId": "PS.2::SSDF-IMAGE::SSDF", + "ruleIndex": 0, + "kind": "pass", + "level": "note", + "message": { + "text": "1/1 evidence origin and signature verified. Evidence signature verified", + "markdown": "1/1 evidence origin and signature verified. Evidence signature verified" + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "URL" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "busybox" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "NAME" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "PURL" + } + }, + { + "physicalLocation": { + "artifactLocation": { + "uri": "%2Fhome%2Fviktor%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" + }, + "region": { + "startLine": 1 + } + }, + "message": { + "text": "REF" + } + } + ], + "fingerprints": { + "sha256/v1": "f537ff644900611fcbcf28880e796911e3c93c4759edce3cfbf9bb383edd1c00" + } + } ], - "sbomname": "index.docker.io/library/busybox:latest", - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "size": 4261550, - "store": "cache", - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "target_type": "image", - "timestamp": "2024-01-23T15:43:58+02:00", - "tool": "valint", - "tool_vendor": "Scribe Security", - "tool_version": "1.0.0-18", - "user": "username" - } - ] - }, - "ruleId": "fresh-image", - "ruleIndex": 1, - "kind": "pass", - "level": "note", - "message": { - "text": "Rule passed verify-artifact because 1/1 evidence origin and signature verified", - "markdown": "Rule passed verify-artifact because 1/1 evidence origin and signature verified" - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "URL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "PRODUCT" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "NAME" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" + "automationDetails": { + "id": "valint/1741268214" }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "PURL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "REF" - } - } - ] - }, - { - "properties": { - "verify-artifact.fresh-image": [ - { - "content_type": "attest-cyclonedx-json", - "context_type": "local", - "format_encoding": "json", - "format_type": "cyclonedx", - "format_version": "1.4", - "git_branch": "main", - "git_commit": "0a80c9d5372ecfbf4ff20a728f9ce5e68b371f45", - "git_ref": "refs/heads/main", - "git_tag": "v1.0.0-17", - "git_url": "https://github.com/scribe-security/valint.git", - "hostname": "runner_1", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "input_name": "busybox", - "input_scheme": "docker", - "input_tag": "latest", - "name": "busybox", - "platform": "linux/amd64", - "predicate_type": "https://cyclonedx.org/bom/v1.4", - "product_version": "v0.1", - "ref": "/home/username/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" - ], - "sbomgroup": "image", - "sbomhashs": [ - "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", - "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + "policies": [ + { + "fullDescription": { + "text": "SSDF IMAGE control evaluation" + }, + "name": "SSDF IMAGE", + "rules": [ + { + "id": "PS.2::SSDF-IMAGE::SSDF", + "shortDescription": { + "text": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true, + "target_type": "container" + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] + } + } + } + } + } + }, + { + "id": "PS.3.2::SSDF-IMAGE::SSDF", + "shortDescription": { + "text": "PS.3.2 Archive SBOM" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] + } + } + } + } + } + } + ], + "shortDescription": { + "text": "SSDF IMAGE control evaluation" + }, + "properties": { + "conditions": {}, + "id": "SSDF-IMAGE::SSDF" + } + }, + { + "fullDescription": { + "text": "SSDF ORG control evaluation" + }, + "name": "SSDF ORG", + "rules": [ + { + "id": "PS.1.1::SSDF-ORG::SSDF", + "shortDescription": { + "text": "PS.1 Require 2FA for accessing code" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": false + } + } + } + } + }, + { + "id": "PS.1.3::SSDF-ORG::SSDF", + "shortDescription": { + "text": "PS.1 Restrict the maximum number of organization admins" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "max_admins": 3 + } + } + } + } + }, + { + "id": "PS.1.5::SSDF-ORG::SSDF", + "shortDescription": { + "text": "PS.1 Require contributors to sign when committing to Github through the web interface" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": true + } + } + } + } + } + ], + "shortDescription": { + "text": "SSDF ORG control evaluation" + }, + "properties": { + "conditions": {}, + "id": "SSDF-ORG::SSDF" + } + }, + { + "fullDescription": { + "text": "SSDF REPO control evaluation" + }, + "name": "SSDF REPO", + "rules": [ + { + "id": "PS.3.1::SSDF-REPO::SSDF", + "shortDescription": { + "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" + }, + "defaultConfiguration": { + "enabled": true, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "labels": null, + "signed": false + } + }, + "input-args": { + "allow": true, + "description": "Since the code is within a repository, it is archived.", + "reason": "The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository.", + "short_description": "Code is archived.", + "violations": [ + { + "violation1": "thing 1" + }, + { + "something2": [ + "some", + "thing" + ], + "violation2": "thing 2" + } + ] + } + } + } + } + }, + { + "id": "PS.1.2::SSDF-REPO::SSDF", + "shortDescription": { + "text": "PS.1 Require branch protection for the repository" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "branches": [ + "main", + "master" + ], + "desired_protected": true + } + } + } + } + }, + { + "id": "PS.1.4::SSDF-REPO::SSDF", + "shortDescription": { + "text": "PS.1 Assure the repository is private" + }, + "defaultConfiguration": { + "enabled": false, + "level": "error", + "parameters": { + "properties": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": true + } + } + } + } + } + ], + "shortDescription": { + "text": "SSDF REPO control evaluation" + }, + "properties": { + "conditions": {}, + "id": "SSDF-REPO::SSDF" + } + } ], - "sbomname": "index.docker.io/library/busybox:latest", - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "size": 4261550, - "store": "cache", - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "target_type": "image", - "timestamp": "2024-01-23T15:43:58+02:00", - "tool": "valint", - "tool_vendor": "Scribe Security", - "tool_version": "1.0.0-18", - "user": "username" - } - ] - }, - "ruleId": "fresh-image", - "ruleIndex": 1, - "kind": "pass", - "level": "note", - "message": { - "text": "Rule passed because image is new enough.", - "markdown": "Rule passed because image is new enough." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "URL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "PRODUCT" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "NAME" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" - }, - "region": { - "startLine": 1 + "properties": { + "verifier-context": { + "hostname": "thinkpad", + "user": "viktor", + "labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "timestamp": "2025-03-06T15:36:53+02:00", + "input_name": "busybox", + "input_tag": "latest", + "content_type": "statement-sarif", + "content_body_type": "sarif", + "context_type": "local", + "predicate_type": "http://scribesecurity.com/evidence/generic/v0.1", + "git_url": "https://github.com/scribe-security/valint.git", + "git_branch": "feat/sh-5802_initiatives_config", + "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", + "git_ref": "refs/heads/feat/sh-5802_initiatives_config", + "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "repoDigest": [ + "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + ], + "tag": [ + "latest", + "1.36.1", + "latest" + ], + "size": 4261550, + "platform": "linux/amd64", + "created": "2023-07-18T23:19:33.655005962Z", + "target_type": "policy-results", + "sbomtype": "container", + "sbomgroup": "container", + "sbomname": "index.docker.io/library/busybox:latest", + "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "sbomhashs": [ + "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", + "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + ], + "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "initiative": { + "name": "SSDF Client Initiative", + "id": "SSDF", + "version": "1.0.0", + "description": "Evaluate PS rules from the SSDF initiative", + "url": "https://csrc.nist.gov/pubs/sp/800/218/final", + "fingerprint": "788a0897074facf3eb9572dc04172e4db8ca30582fe02b2d31c93d3428d38043" + }, + "controls": [ + "SSDF-IMAGE::SSDF" + ], + "rules": [ + "PS.2::SSDF-IMAGE::SSDF", + "PS.3.2::SSDF-IMAGE::SSDF" + ], + "allow": true, + "rule-scripts": { + "artifact-signed.rego": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", + "data.rego": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474" + }, + "bundle_info": { + "git_branch": "v2", + "git_target": "/home/viktor/.cache/valint/.tmp/git_tmp_3916451226", + "git_repo": "https://github.com/scribe-public/sample-policies.git", + "git_ref": "refs/heads/v2", + "git_commit": "fcf251b0d3910a9679be812cf4a87a4e86e0aafc" + } + } } - }, - "message": { - "text": "PURL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "%2Fhome%2Fusername%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" - }, - "region": { - "startLine": 1 - } - }, - "message": { - "text": "REF" - } } - ] - } - ], - "automationDetails": { - "id": "valint/1706017642" - }, - "properties": { - "verifier-context": { - "hostname": "runner_1", - "user": "username", - "name": "busybox", - "product_version": "v0.1", - "timestamp": "2024-01-23T15:47:22+02:00", - "input_scheme": "docker", - "input_name": "busybox", - "input_tag": "latest", - "content_type": "statement-sarif", - "context_type": "local", - "predicate_type": "https://cyclonedx.org/bom/v1.4", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" - ], - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "size": 4261550, - "platform": "linux/amd64", - "target_type": "policy-results", - "sbomgroup": "image", - "sbomname": "index.docker.io/library/busybox:latest", - "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "sbomhashs": [ - "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", - "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" - ], - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "policies": [ - "my_policy", - "default" - ], - "rules": [ - "signed_image", - "fresh-image" - ], - "rule_types": [ - "verify-artifact", - "verify-artifact" - ], - "allow": true, - "policy-scripts": { - "": "", - "fresh-image.rego": "e90241897259b16872cbcb61acad6b8cc61898b11f73d8b7f4a3f58c7d5f1319" - } - } - } + ] } - ] } - } } ``` From 27742d401473efce199feae46623f4000602caa5 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 11:14:44 +0200 Subject: [PATCH 038/191] SSDF.PS -> SSDF --- docs/glossary.md | 4 ++-- docs/valint/initiatives.md | 2 +- docs/valint/policy-results.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/glossary.md b/docs/glossary.md index 592af0802..36f6a81d1 100644 --- a/docs/glossary.md +++ b/docs/glossary.md @@ -62,7 +62,7 @@ An in-toto Statement is almost identical to an in-toto attestation. The only dif ### Policy Bundle -A policy bundle is a collection of [rules](#policy-rule) and [initiatives](#policy-initiative) that can be used to evaluate evidence. For example, a policy bundle could be a collection of security frameworks that are used to evaluate the security posture of an application. Scribe provides a [Sample Policy Bundle](https://github.com/scribe-public/sample-policies) that includes the SSDF.PS, SLSA L1 and L2 frameworks as well as a set of rules to verify a variety of security requirements on different types of attestations. +A policy bundle is a collection of [rules](#policy-rule) and [initiatives](#policy-initiative) that can be used to evaluate evidence. For example, a policy bundle could be a collection of security frameworks that are used to evaluate the security posture of an application. Scribe provides a [Sample Policy Bundle](https://github.com/scribe-public/sample-policies) that includes the SSDF, SLSA L1 and L2 frameworks as well as a set of rules to verify a variety of security requirements on different types of attestations. ### Policy Initiative @@ -70,7 +70,7 @@ An initiative is a high-level, abstract requirement that is comprised of a set o ### Policy Control -A control is an abstract requirement that is comprised of a set of [rules](#policy-rule). For example, the SSDF.PS framework (initiative) requires a control for protecting access to the source code. +A control is an abstract requirement that is comprised of a set of [rules](#policy-rule). For example, the SSDF framework (initiative) requires a control for protecting access to the source code. ### Policy Rule diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 497044430..674742c83 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -10,7 +10,7 @@ toc_max_heading_level: 3 ## What is an initiative? -An `initiative` is a high-level, abstract requirement that is comprised of a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that is comprised of a set of `rules`. For example, the SSDF.PS framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`. +An `initiative` is a high-level, abstract requirement that is comprised of a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that is comprised of a set of `rules`. For example, the SSDF framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`. The outcome of an initiative evaluation is an initiative result report that details the rule evaluation results and references the verified assets and statements/attestations. `valint` produces initiative results in the SARIF format and uploads them as an in-toto statement of SARIF to Scribe Hub. diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md index dd8951b2b..483f0804f 100644 --- a/docs/valint/policy-results.md +++ b/docs/valint/policy-results.md @@ -75,7 +75,7 @@ Evaluate Initiative: valint verify busybox:latest --initiative ssdf@v2 ``` -Next we use `valint verify` command to evaluate the busybox image against the corresponding set of rules from the SSDF.PS initiative. +Next we use `valint verify` command to evaluate the busybox image against the corresponding set of rules from the SSDF initiative. After executing these commands, the results of the evaluation are displayed in the output log as a table, summarizing the evaluation for each rule: From b2acc2879038dd69451bc4df776fa83c84a5fb35 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 15:43:18 +0200 Subject: [PATCH 039/191] added some clarifications --- docs/valint/initiatives.md | 42 +++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 674742c83..e0d0f0572 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -66,7 +66,7 @@ controls: - **Type:** String - **Required:** No -- **Description:** A unique identifier for the initiative. Cannot contain the `::` string. If no ID is provided, it is generated from the name. +- **Description:** A unique identifier for the initiative. It cannot contain the `::` string. IDs can be seen in the UI and are needed in Scribe Hub to define rule uniqueness. If no ID is provided, it is generated from the name. - **Default:** If no `id` is provided, the value is calculated from the `name` field. #### `name` @@ -159,14 +159,14 @@ controls: - **Type:** Object - **Required:** No -- **Description:** Optional filters for when the control should be run. +- **Description:** Optional filters for when the control should be run. Currently only `gate` filters are supported (see below). - **Default:** If no value is provided, no user-defined control filters are applied. ###### `controls[].when.gate` - **Type:** String - **Required:** No -- **Description:** The type of gate on which to run the control. +- **Description:** The type of gate on which to run the control. This value is used to filter controls when the `--gate-type` input is provided to `valint`. - **Default:** If no value is provided, the control will run on all gates. ##### `controls[].rules` @@ -319,7 +319,7 @@ with: {} - **Type:** Array of Strings - **Required:** No -- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. +- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. Label filters are used within the whole initiative, regardless of the controls. - **Default:** No labels used. #### `level` @@ -445,10 +445,10 @@ valint verify --initiative initiative.yaml \ --scribe.client-secret ``` -To run an initiative from a git bundle, use the following command: +To run an initiative from the [Scribe sample bundle](https://github.com/scribe-public/sample-policies), use the following command: ```bash -valint verify --initiative my-initiative@v2 \ +valint verify --initiative ssdf@v2 \ --product-key -- product-version \ --scribe.client-secret ``` @@ -456,7 +456,7 @@ valint verify --initiative my-initiative@v2 \ To run a part of an initiative filtered by gate type, use the following command: ```bash -valint verify --initiative my-initiative@v2 \ +valint verify --initiative ssdf@v2 \ --product-key -- product-version \ --scribe.client-secret \ --gate-type Build --gate-name "Build of My Product" @@ -530,13 +530,14 @@ asset := scribe.get_asset_data(input.evidence) ### Evidence Lookup -In order to run a policy rule, `valint` requires relevant evidence, which can be found in storage using a number of parameters. +In order to run a policy rule, `valint` requires relevant evidence, which can be found in storage using several parameters. These parameters can be set manually by the user or automatically derived from the context. -Parameters that can be derived automatically are categorized into three context groups: `target`, `pipeline`, and `product`. + +Parameters that can be derived automatically by `valint` are categorized into three context groups: `target`, `pipeline`, and `product`. By default, the `target` and `product` groups are enabled for each rule. -1. The `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo, etc). These parameters are: - - `target_type` - the type of the target provided (e.g., image, git, generic etc.) +1. The `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo or a file). These parameters are: + - `target_type` - the type of the target provided (e.g., image, git, generic, etc.) - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) > _If this parameter is set and no target is provided, the rule is disabled with a warning._ @@ -545,17 +546,17 @@ By default, the `target` and `product` groups are enabled for each rule. - `context_type` - the type of the environment (e.g., local, github, etc.) - `git_url` - the git URL of the repository (if any) - `git_commit` - the git commit of the current repository state (if any) - - `run_id` - the run ID - - `build_num` - the build number + - `run_id` - the run ID (if any) + - `build_num` - the build number (if any) 3. The `product` context group specifies product parameters that can be derived from the command line arguments. These parameters are: - - `name` - the name of the product - - `product_version` - the version of the product - - `predicate_type` - the type of the predicate (e.g., [CycloneDX](https://cyclonedx.org/bom), [SLSA](https://slsa.dev/provenance/v0.1), etc.) + - `name` - the name of the product (provided to `valint` as a `--product-key` argument) + - `product_version` - the version of the product (provided to `valint` as a `--product-version` argument) Users can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. By default, the `target` and `product` groups are used. -The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. +The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. Any value provided overrides the default list. +See the usage example below for more details. ------------------- @@ -674,6 +675,13 @@ When running this rule on the `alpine:latest` image target for the `MyProduct` p } ``` +In this example, + +- The `name` (stands for _product name_) and `product_version` fields were fetched from the `valint` input because the `filter-by: product` value was set in the rule config. +- The `sbomversion` field was set as a result of target analysis because the `filter-by: target` value was set in the rule config. +- The `content_body_type`, `target_type`, and `signed` fields were explicitly specified in the rule config. +- The `predicate_type` field was set to the default value for CycloneDX SBOMs (based on the `cyclonedx-json` value for `content_body_type`). +
### Template arguments From 77c29bfebdc0d60e477deb169ce2457ebcd0460d Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 15:44:01 +0200 Subject: [PATCH 040/191] added new Rule filtering section --- docs/valint/initiatives.md | 190 +++++++++++++++++++++++++++++++++++++ 1 file changed, 190 insertions(+) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index e0d0f0572..a3f3f397e 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -733,6 +733,196 @@ When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will u
+### Rule filtering + +When running an initiative, there are several options to decide which rules will be evaluated. Some of the criteria are used by `valint` automatically based on the context, while others can be specified by the user. + +The following criteria are used by `valint` automatically: + +- Rules that have the `filter-by: target` value set in the config (see the [Evidence Lookup](#evidence-lookup) section) are disabled if no target is provided to the `valint verify` command. +- Rules that use some of the built-in functions for template arguments are disabled if the required arguments are not provided, see the [Built-in functions](#built-in-functions) section above. + +The only exception for both of these is when the `--all-evidence` flag is used, see the [Whole product evaluation](#whole-product-evaluation) section below. + +The following criteria can be specified by the user: + +- The `when.gate` field is used to filter the controls by the gate type provided to the `valint verify` command using the `--gate-type` flag. When this flag is used, only controls with the matching gate and controls that don't have a gate filter are run. This feature works on the control level only. +- The `rule.labels` field is used to filter the rules by the labels provided to the `valint verify` command using the `--rule-label` flag. This feature works on the rule level only and filters out the rules that don't have any matching labels regardless of the control they belong to. + +
+ Gate Filtering Example + +In the following initiative example, + +- The "MyBuildControl" control will be evaluated only when the `--gate-type Build` flag is used or no gate type is provided. +- The "MyDeployControl" control will be evaluated only when the `--gate-type Deploy` flag is used or no gate type is provided. +- The "MyGenericControl" control will be evaluated regardless of the gate type. + +```yaml +config-type: initiative +id: "my-initiative" +name: "My Initiative" + +controls: +# The following control matches the Build gate type + - name: "Any critical or high severity vulnerability breaks the build" + id: "MyBuildControl" + when: + gate: Build + rules: + - uses: api/scribe-api-cve@v2 + with: + superset: + cve: + severity: 6 + max: 0 + +# The following control matches the Deploy gate type + - name: "Root and Admin users prevent image deployment" + id: "MyDeployControl" + when: + gate: Deploy + rules: + - uses: images/banned-users@v2 + with: + users: + - "root" + - "admin" + +# The following control doesn't have a gate filter and will be evaluated regardless of the gate type + - name: "Require signed SBOM" + id: "MyGenericControl" + rules: + - uses: sbom/artifact-signed@v2 +``` + +```bash +# Running on the Build gate type +$ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Build +... +INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +├───────────────────┬──────────────────────────────────────────────────────────────┬───────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤ +│ MyBuildControl │ Any critical or high severity vulnerability breaks the build │ scribe-cve(pass) │ pass │ +├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤ +│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │ +├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴──────────────────────────────────────────────────────────────┴───────────────────┴────────┘ +``` + +```bash +# Running on the Deploy gate type +$ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Deploy +... +INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +├───────────────────┬───────────────────────────────────────────────┬─────────────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ MyDeployControl │ Root and Admin users prevent image deployment │ sbom-disallowed-users(pass) │ pass │ +├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │ +├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴───────────────────────────────────────────────┴─────────────────────────────┴────────┘ +``` + +```bash +# Running without the gate type +$ valint verify alpine:latest --initiative my-initiative@v2 +... +INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +├───────────────────┬──────────────────────────────────────────────────────────────┬─────────────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ MyBuildControl │ Any critical or high severity vulnerability breaks the build │ scribe-cve(pass) │ pass │ +├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ MyDeployControl │ Root and Admin users prevent image deployment │ sbom-disallowed-users(pass) │ pass │ +├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ MyGenericControl │ Require signed SBOM │ sbom-signed(pass) │ pass │ +├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴──────────────────────────────────────────────────────────────┴─────────────────────────────┴────────┘ +``` + +
+ +
+ Rule Label Filtering Example + +In the following initiative example, the "MyRule" rule will be evaluated only when the `--rule-label` flag is used with the `MyLabel` value or no label is provided. + +```yaml +config-type: initiative +id: "my-initiative" +name: "My Initiative" + +controls: + - name: "My Control" + rules: + - name: "My Rule" + id: "MyRule" + labels: + - "MyLabel" + uses: sbom/blocklist-packages@v2 + with: + blocklist: + - "liblzma5@5.6.0" + - "liblzma5@5.6.1" + - "xz-utils@5.6.0" + - "xz-utils@5.6.1" + - name: "My Rule 2" + id: "MyRule2" + uses: sbom/banned-licenses@v2 + level: warning + with: + blocklist: + - "GPL-2.0" + - "GPL-3.0" +``` + +```bash +# Running with the rule label +$ valint verify alpine:latest --initiative my-initiative@v2 --rule-label MyLabel +... +INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────┐ +│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬──────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────────┼────────┤ +│ My Control │ My Control │ MyRule(pass), │ pass │ +├───────────────────┼───────────────┼──────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴───────────────┴──────────────────┴────────┘ +``` + +```bash +# Running without the rule label +$ valint verify alpine:latest --initiative my-initiative@v2 +... +INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────┐ +│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +├───────────────────┬───────────────┬──────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼──────────────────┼────────┤ +│ My Control │ My Control │ MyRule(pass), │ pass │ +│ │ │ MyRule2(warning) │ │ +├───────────────────┼───────────────┼──────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────┴───────────────┴──────────────────┴────────┘ +``` + +
+ ### Whole product evaluation One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: From 5f6d422f8ff00c85994f6c91f9d7600cbd3e5431 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 15:45:43 +0200 Subject: [PATCH 041/191] added additional links --- docs/valint/initiatives.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index a3f3f397e..52d6faf08 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -166,7 +166,7 @@ controls: - **Type:** String - **Required:** No -- **Description:** The type of gate on which to run the control. This value is used to filter controls when the `--gate-type` input is provided to `valint`. +- **Description:** The type of gate on which to run the control. This value is used to filter controls when the `--gate-type` input is provided to `valint`. See the [Rule filtering](#rule-filtering) section below for more details. - **Default:** If no value is provided, the control will run on all gates. ##### `controls[].rules` @@ -319,7 +319,7 @@ with: {} - **Type:** Array of Strings - **Required:** No -- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. Label filters are used within the whole initiative, regardless of the controls. +- **Description:** A list of user-specified labels for the rule itself. These labels can be used for filtering out the rules to be run with the `--rule-label` valint flag. A rule will be run if at least one of its labels matches one of the `--rule-label` values. Label filters are used within the whole initiative, regardless of the controls. See the [Rule filtering](#rule-filtering) section below for more details. - **Default:** No labels used. #### `level` From d0b6531654518c81b57554ceffbcb3b44bad1bb2 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 16:52:36 +0200 Subject: [PATCH 042/191] updated initiative introduction section --- docs/valint/initiatives.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 52d6faf08..c4529b80e 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -10,13 +10,21 @@ toc_max_heading_level: 3 ## What is an initiative? -An `initiative` is a high-level, abstract requirement that is comprised of a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that is comprised of a set of `rules`. For example, the SSDF framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`. +An `initiative` is a high-level, abstract requirement that comprises a set of `controls`. For example, a security framework such as SSDF can be represented as an `initiative`. A `control` is an abstract requirement that comprises a set of `rules`. For example, the SSDF framework (initiative) requires a `control` of protecting access to the source code. This `control` can be materialized by requiring MFA, limiting the number and identity of admins, and requiring the source code repository to be private -- each of the requirements is a `rule`. -The outcome of an initiative evaluation is an initiative result report that details the rule evaluation results and references the verified assets and statements/attestations. `valint` produces initiative results in the SARIF format and uploads them as an in-toto statement of SARIF to Scribe Hub. +The outcome of an initiative evaluation is an initiative result report that details the rule evaluation results and references the verified assets and statements/attestations. `valint` produces initiative results in the SARIF format and uploads them as an in-toto statement of SARIF to Scribe Hub. For more details on this, see the [Initi] [Policy Results](./policy-results.md) page. -Rules can reuse existing ones from a bundle or be defined inline. +Rules can be defined inline in the initiative config or reuse existing ones from a bundle. See the [Rule configuration](#rule-configuration-format), [Initiative configuration](#initiative-configuration), and [Using a private bundle](#using-a-private-bundle) sections for more details. -## Initiative config format +### Evidence + +Scribe rules operate on evidence; each rule consumes evidence previously created. Each rule specifies which evidence it requires by providing criteria for fetching the evidence. This allows for abstracting the rules and avoiding the need to know an exact evidence id; so instead of specifying "use the SBOM of alpine@sha:ab87ehk..." the user can specify "use the SBOM created in this pipeline", or "use the SBOM of this product". See the [Evidence Lookup](#evidence-lookup) section for more details. + +### Gates + +Initiative evaluation may require evaluating different rules in different locations in the supply chain. For example, an SBOM of a built image would be tested for vulnerabilities on the build pipeline, while evaluating DAST results would happen on a different testing pipeline. Scribe initiatives support specifying for each control the gate it should be evaluated at; when evaluating an initiative the user can specify the "current location" - the gate that should be evaluated. A gate is defined by its name (serves for human readability of the results, optional) and type (required to use the filtering feature). See the [Rule filtering](#rule-filtering) section for more details. + +## Initiative configuration ```yaml config-type: initiative @@ -298,7 +306,7 @@ with: {} - **Type:** String - **Required:** No -- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@/rules`. When used, the current rule's values will override the external rule's ones. +- **Description:** A reference to a rule in a bundle that should be used as a base rule. The format is `@`. When used, the current rule's values will override the external rule's ones. - **Default:** If no value is provided, no external rule is used as a base rule. #### `description` From 4df00c339520437073bf42ec0cfaf74d23ffb5e0 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 9 Mar 2025 17:10:38 +0200 Subject: [PATCH 043/191] small text adjustment --- docs/valint/initiatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index c4529b80e..b57882593 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -568,7 +568,7 @@ See the usage example below for more details. ------------------- -In addition, one can _**manually**_ specify any parameters that they want to be matched by evidence. +In addition, one can specify other parameters that they want to be matched by evidence. In most of the rules, the following parameters would be used to define the type of statement: | Field | Description | Examples | From 068290070459b85ab9a0c3d8d36dca2bac4f15ba Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 10 Mar 2025 13:37:00 +0200 Subject: [PATCH 044/191] updated policy results tables --- docs/guides/enforcing-sdlc-initiative.md | 34 ++++++++++++------------ docs/valint/initiatives.md | 20 +++++++------- docs/valint/policy-results.md | 34 ++++++++++++------------ 3 files changed, 44 insertions(+), 44 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index bb346338d..67de72df2 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -56,9 +56,9 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up Initiative results ```bash - [2025-01-28 17:28:29] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: + INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ + │ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ @@ -68,11 +68,10 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ │ CONTROL RESULT │ │ │ │ PASS │ │ │ └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ - Evaluation Target Name 'index.docker.io/library/busybox:latest' - [2025-01-28 17:28:29] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: + INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────┐ - │ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ + │ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ ├───────────────────┬───────────────┬─────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼─────────────────────┼────────┤ @@ -81,6 +80,7 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up ├───────────────────┼───────────────┼─────────────────────┼────────┤ │ INITIATIVE RESULT │ │ │ PASS │ └───────────────────┴───────────────┴─────────────────────┴────────┘ + Evaluation Target Name 'index.docker.io/library/busybox:latest' ```
@@ -110,7 +110,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ```bash ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ Control "default. Default" Evaluation Summary │ + │ [default] Control "Default" Evaluation Summary │ ├───────────────────────────────────┬───────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────┬────────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────┤ @@ -124,7 +124,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ```bash ┌─────────────────────────────────────────────────────────────────────────────────────────────┐ - │ Initiative "client-initiative. client-initiative" Evaluation Summary │ + │ [client-initiative] Initiative "client-initiative" Evaluation Summary │ ├───────────────────┬───────────────┬────────────────────────────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼────────────────────────────────────────────────┼────────┤ @@ -178,7 +178,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ```bash ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ Control "default. Default" Evaluation Summary │ + │ [default] Control "Default" Evaluation Summary │ ├────────────────┬──────────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────┬───────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ @@ -188,7 +188,7 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule └────────────────┴──────────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────┴───────────────┘ ┌────────────────────────────────────────────────────────────────────────┐ - │ Initiative "client-initiative. client-initiative" Evaluation Summary │ + │ [client-initiative] Initiative "client-initiative" Evaluation Summary │ ├───────────────────┬───────────────┬───────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼───────────────────────────┼────────┤ @@ -216,9 +216,9 @@ valint verify --initiative ssdf@v2 --all-evidence \ Initiative results ```bash -[2025-01-28 18:13:23] INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: +INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ +│ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ @@ -229,9 +229,9 @@ valint verify --initiative ssdf@v2 --all-evidence \ │ CONTROL RESULT │ │ │ │ PASS │ │ │ └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ -[2025-01-28 18:13:23] INFO Control "SSDF-ORG. SSDF ORG" Evaluation Summary: +INFO SSDF-ORG: Control "SSDF ORG" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-ORG. SSDF ORG" Evaluation Summary │ +│ [SSDF-ORG] Control "SSDF ORG" Evaluation Summary │ ├────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ @@ -244,9 +244,9 @@ valint verify --initiative ssdf@v2 --all-evidence \ │ CONTROL RESULT │ │ │ │ FAIL │ │ │ └────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ -[2025-01-28 18:13:23] INFO Control "SSDF-REPO. SSDF REPO" Evaluation Summary: +INFO SSDF-REPO: Control "SSDF REPO" Evaluation Summary: ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-REPO. SSDF REPO" Evaluation Summary | +│ [SSDF-REPO] Control "SSDF REPO" Evaluation Summary | ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────────────────────────┬───────────────────────────────────────| │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET | ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ @@ -257,9 +257,9 @@ valint verify --initiative ssdf@v2 --all-evidence \ │ CONTROL RESULT │ │ │ │ FAIL │ │ │ └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘ -[2025-01-28 18:13:23] INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: +INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────────┐ -│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summary │ +│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ ├───────────────────┬───────────────┬──────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼──────────────────────┼────────┤ diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index b57882593..8af6bf746 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -808,9 +808,9 @@ controls: # Running on the Build gate type $ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Build ... -INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +INFO [my-initiative] Initiative "My Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +│ [my-initiative] Initiative "My Initiative" Evaluation Summary │ ├───────────────────┬──────────────────────────────────────────────────────────────┬───────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼──────────────────────────────────────────────────────────────┼───────────────────┼────────┤ @@ -826,9 +826,9 @@ INFO Initiative "my-initiative. My Initiative" Evaluation Summary: # Running on the Deploy gate type $ valint verify alpine:latest --initiative my-initiative@v2 --gate-type Deploy ... -INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +INFO [my-initiative] Initiative "My Initiative" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +│ [my-initiative] Initiative "My Initiative" Evaluation Summary │ ├───────────────────┬───────────────────────────────────────────────┬─────────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────────────────────────────────────┼─────────────────────────────┼────────┤ @@ -844,9 +844,9 @@ INFO Initiative "my-initiative. My Initiative" Evaluation Summary: # Running without the gate type $ valint verify alpine:latest --initiative my-initiative@v2 ... -INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +INFO [my-initiative] Initiative "My Initiative" Evaluation Summary: ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +│ [my-initiative] Initiative "My Initiative" Evaluation Summary │ ├───────────────────┬──────────────────────────────────────────────────────────────┬─────────────────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼──────────────────────────────────────────────────────────────┼─────────────────────────────┼────────┤ @@ -900,9 +900,9 @@ controls: # Running with the rule label $ valint verify alpine:latest --initiative my-initiative@v2 --rule-label MyLabel ... -INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +INFO [my-initiative] Initiative "My Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────┐ -│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +│ [my-initiative] Initiative "My Initiative" Evaluation Summary │ ├───────────────────┬───────────────┬──────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼──────────────────┼────────┤ @@ -916,9 +916,9 @@ INFO Initiative "my-initiative. My Initiative" Evaluation Summary: # Running without the rule label $ valint verify alpine:latest --initiative my-initiative@v2 ... -INFO Initiative "my-initiative. My Initiative" Evaluation Summary: +INFO [my-initiative] Initiative "My Initiative" Evaluation Summary: ┌───────────────────────────────────────────────────────────────┐ -│ Initiative "my-initiative. My Initiative" Evaluation Summary │ +│ [my-initiative] Initiative "My Initiative" Evaluation Summary │ ├───────────────────┬───────────────┬──────────────────┬────────┤ │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ ├───────────────────┼───────────────┼──────────────────┼────────┤ diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md index 483f0804f..02877563b 100644 --- a/docs/valint/policy-results.md +++ b/docs/valint/policy-results.md @@ -82,9 +82,9 @@ After executing these commands, the results of the evaluation are displayed in t After policy evaluation, the results are shown in the output log as a table: ```bash -INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: +INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary │ +│ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ @@ -94,20 +94,20 @@ INFO Control "SSDF-IMAGE. SSDF IMAGE" Evaluation Summary: ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ │ CONTROL RESULT │ │ │ │ PASS │ │ │ └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ -Evaluation Target Name 'index.docker.io/library/busybox:latest' -INFO Initiative "SSDF. SSDF Client Initiative" Evaluation Summary: -┌───────────────────────────────────────────────────────────┐ -│ Initiative "SSDF. SSDF Client Initiative" Evaluation Summ │ -│ ary │ -├───────────────────┬───────────────┬──────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────┼───────────────┼──────────────┼────────┤ -│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ -│ │ │ PS.3.2(pass) │ │ -├───────────────────┼───────────────┼──────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ PASS │ -└───────────────────┴───────────────┴──────────────┴────────┘ +INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: +┌───────────────────────────────────────────────────────────────┐ +│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ +│ │ +├───────────────────────┬───────────────┬──────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────────┼───────────────┼──────────────┼────────┤ +│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ +│ │ │ PS.3.2(pass) │ │ +├───────────────────────┼───────────────┼──────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ PASS │ +└───────────────────────┴───────────────┴──────────────┴────────┘ +Evaluation Target Name 'index.docker.io/library/busybox:latest' ``` Moreover, the Sarif result is produced and dispatched as evidence, providing the option for it to be signed based on specific requirements. This signing capability enhances the integrity and authenticity of the generated evidence, ensuring a secure and verifiable representation of the policy evaluation results. @@ -117,10 +117,10 @@ Moreover, the Sarif result is produced and dispatched as evidence, providing the ```bash # Create a signed SBOM (Software Bill of Materials) evidence for the 'busybox' image -valint bom busybox:latest -o attest +valint bom busybox:latest -o attest # Verify signed evidence for 'busybox' and export a signed evidence for Policy results -valint verify busybox:latest -i attest -o attest +valint verify busybox:latest -i attest -o attest ``` In this example, we generate a signed SBOM evidence for the 'busybox' image using the valint bom command. Subsequently, the valint verify command evaluates the signed evidence for 'busybox' (`-i attest`) and the -o flag to export a signed evidence for Policy results (`-o attest`). From eabf1413e4a7248c5bf22b84220c4ddb490c362f Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 10 Mar 2025 13:42:08 +0200 Subject: [PATCH 045/191] update --- docs/valint/initiatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 8af6bf746..8c4f0318f 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -265,7 +265,7 @@ with: {} - **Type:** String - **Required:** Yes -- **Description:** Specifies the type of configuration. For rules, this should be set to `rule`. +- **Description:** Specifies the type of configuration. For rule configuration files, this should be set to `rule`. For rules defined inline in the initiative config, this field is omitted. #### `required-valint-version` From 06d9bc8e7b54a13f59c5d6711cb291655df662dc Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 12 Mar 2025 10:24:41 +0200 Subject: [PATCH 046/191] docusaurus admonision messages for the initiatives --- docs/guides/enforcing-sdlc-initiative.md | 18 +++++++++++++----- docs/valint/initiatives.md | 13 +++++++++---- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 67de72df2..44aebcf7f 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -85,8 +85,12 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up
- > Note that only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically, and no result was generated for them. - > To verify the whole SSDF initiative, you need to run GitHub discovery. See [platforms discovery](../platforms/overview). + :::info + Only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically, and no result was generated for them. + ::: + :::info + To verify the whole SSDF initiative, you need to run GitHub discovery. See [platforms discovery](../platforms/overview). + ::: ### Running a single rule verification @@ -136,8 +140,10 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule
- > Note that the rule was put in the `client-initiative` initiative. To change that, you can use the `--initiative-name` and `--initiative-id` flags. - > It was also put in the `default` control. This cannot be changed unless you provide a full initiative config with custom names and IDs for your controls. + :::info + The rule was put in the `client-initiative` initiative. To change that, you can use the `--initiative-name` and `--initiative-id` flags. + It was also put in the `default` control. This cannot be changed unless you provide a full initiative config with custom names and IDs for your controls. + ::: ### Targetless Run @@ -355,7 +361,9 @@ edit policy parameters ```attest.cocosign.policies.rules.input identity``` to re You can also edit `target_type` to refelct the artifact type. -> Optional target types are `git`,`directory`, `image`, `file`, `generic`. +:::info +Optional target types are `git`,`directory`, `image`, `file`, `generic`. +::: ```yaml evidence: diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 8c4f0318f..eb795671a 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -182,9 +182,12 @@ controls: - **Type:** Array of Objects - **Description:** A list of rules for the control. For details, see the [Rules](#rule-configuration-format) section below. -> For `valint` configuration details, see the [configuration](./configuration.md) section. -> -> For PKI configuration, see the [attestations](./attestations.md) section. +:::info +For `valint` configuration details, see the [configuration](./configuration.md) section. +::: +:::info +For PKI configuration, see the [attestations](./attestations.md) section. +::: An example of an initiative is: @@ -548,7 +551,9 @@ By default, the `target` and `product` groups are enabled for each rule. - `target_type` - the type of the target provided (e.g., image, git, generic, etc.) - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) - > _If this parameter is set and no target is provided, the rule is disabled with a warning._ + :::info + If this parameter is set and no target is provided, the rule is disabled with a warning._ + ::: 2. The `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: - `context_type` - the type of the environment (e.g., local, github, etc.) From 39b2e3185a4f57e83f8486c417d78faa1ac690a7 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 2 Jan 2025 13:14:59 +0200 Subject: [PATCH 047/191] updates --- docs/guides/secure-sfw-slsa/basic-examples.md | 35 +++++++++- .../ci-integrations/azure.md | 4 +- .../ci-integrations/bitbucket.md | 4 +- .../ci-integrations/github/action-bom.md | 66 ++++++++++++++++-- .../ci-integrations/github/action-evidence.md | 4 +- .../ci-integrations/github/action-slsa.md | 69 +++++++++++++++++-- .../ci-integrations/github/action-verify.md | 4 +- .../ci-integrations/gitlabci.md | 4 +- .../ci-integrations/travis.md | 4 +- docs/valint/getting-started-valint.md | 3 +- docs/valint/sbom.md | 11 +++ 11 files changed, 184 insertions(+), 24 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/basic-examples.md b/docs/guides/secure-sfw-slsa/basic-examples.md index 5235ccd4b..84acbd349 100644 --- a/docs/guides/secure-sfw-slsa/basic-examples.md +++ b/docs/guides/secure-sfw-slsa/basic-examples.md @@ -26,10 +26,43 @@ Create SLSA Provenance for images hosted by a private registry. ```bash docker login -valint slsa scribesecurity.jfrog.io/scribe-docker-local/example:latest +valint slsa scribesecurity/example:latest ```
+
+ Create SBOM and SLSA evidence + +Generate a Software Bill of Materials (SBOM) and corresponding SLSA evidence for a container image. + +```bash +valint bom scribesecurity/example:latest --provenance +``` + +
+ +
+ Create SBOM with Base Image And SLSA evidence + +Generate an SBOM and corresponding SLSA evidence for a container image, including analysis of the specified base image. + +```bash +valint bom scribesecurity/example:latest --provenance --base-image ./Dockerfile +``` + +
+ +
+ Create SLSA provenance with by-product asset evidence + +Generate SLSA Provenance for a container image, incorporating by-product asset evidence using the `--input` flag. + +```bash +valint bom scribesecurity/example:latest --provenance --input sarif:my_report.json --input git:https://github.com/example/repo.git --input sqllite:latest +``` + +
+
Include specific environment diff --git a/docs/integrating-scribe/ci-integrations/azure.md b/docs/integrating-scribe/ci-integrations/azure.md index 6dcafa577..5e13c4ee9 100644 --- a/docs/integrating-scribe/ci-integrations/azure.md +++ b/docs/integrating-scribe/ci-integrations/azure.md @@ -190,7 +190,7 @@ jobs: displayName: Generate cyclonedx json SBOM inputs: commandName: bom - target: scribesecurity.jfrog.io/scribe-docker-local/example:latest + target: scribesecurity/example:latest outputDirectory: $(Build.ArtifactStagingDirectory)/scribe/valint scribeEnable: true scribeClientSecret: $(SCRIBE_TOKEN) @@ -207,7 +207,7 @@ jobs: displayName: Generate SLSA provenance inputs: commandName: slsa - target: scribesecurity.jfrog.io/scribe-docker-local/example:latest + target: scribesecurity/example:latest outputDirectory: $(Build.ArtifactStagingDirectory)/scribe/valint scribeEnable: true scribeClientSecret: $(SCRIBE_TOKEN) diff --git a/docs/integrating-scribe/ci-integrations/bitbucket.md b/docs/integrating-scribe/ci-integrations/bitbucket.md index 1f1e748c7..27bbde689 100644 --- a/docs/integrating-scribe/ci-integrations/bitbucket.md +++ b/docs/integrating-scribe/ci-integrations/bitbucket.md @@ -308,7 +308,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr - pipe: scribe-security/valint-pipe:1.1.0 variables: COMMAND: bom - TARGET: scribesecurity.jfrog.io/scribe-docker-local/example:latest + TARGET: scribesecurity/example:latest ```
@@ -321,7 +321,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr - pipe: scribe-security/valint-pipe:1.1.0 variables: COMMAND: slsa - TARGET: scribesecurity.jfrog.io/scribe-docker-local/example:latest + TARGET: scribesecurity/example:latest VERBOSE: 2 ```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index d723e188b..2eeeed82f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -169,7 +169,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.14 + uses: scribe-security/action-bom@v1.5.15 with: target: 'busybox:latest' ``` @@ -177,7 +177,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.14 + uses: scribe-security/action-bom-cli@v1.5.15 with: target: 'hello-world:latest' ``` @@ -472,11 +472,67 @@ steps: - name: Generate cyclonedx json SBOM uses: scribe-security/action-bom@master with: - target: 'scribesecurity.jfrog.io/scribe-docker-local/example:latest' + target: 'scribesecurity/example:latest' force: true ``` +
+ SBOM with SLSA Provenance + +Generate an SBOM and SLSA Provenance for a container image. + +```yaml +- name: Generate SBOM with SLSA Provenance + uses: scribe-security/action-bom@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + provenance: true +``` + +
+ +
+ SBOM with Base Image Analysis + +Generate an SBOM for a container image while analyzing its base image. + +```yaml +- name: Generate SBOM with Base Image Analysis + uses: scribe-security/action-bom@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + base-image: alpine:latest +``` + +
+ +
+ SBOM with Additional Inputs + +Create an SBOM for a container image by including supplementary inputs like SARIF reports, Git repositories, or additional images. + +```yaml +- name: Generate SBOM with Additional Inputs + uses: scribe-security/action-bom@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + input: | + sarif:test.json, + git:git:https://github.com/mongo-express/mongo-express.git, + alpine:latest +``` + +
+ + +
Custom metadata @@ -560,7 +616,7 @@ Create SBOM for local `docker save ...` output. with: context: . file: .GitHub/workflows/fixtures/Dockerfile_stub - tags: scribesecurity.jfrog.io/scribe-docker-local/example:latest + tags: scribesecurity/example:latest outputs: type=docker,dest=stub_local.tar - name: Generate cyclonedx json SBOM @@ -582,7 +638,7 @@ Create SBOM for the local OCI archive. with: context: . file: .GitHub/workflows/fixtures/Dockerfile_stub - tags: scribesecurity.jfrog.io/scribe-docker-local/example:latest + tags: scribesecurity/example:latest outputs: type=oci,dest=stub_oci_local.tar - name: Generate cyclonedx json SBOM diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 66c3988c5..cc758f7cf 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -136,7 +136,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.14 + uses: scribe-security/action-evidence@v1.5.15 with: target: some_file.json ``` @@ -144,7 +144,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.14 + uses: scribe-security/action-evidence-cli@v1.5.15 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index d3339ffdd..43462a0be 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -155,7 +155,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.14 + uses: scribe-security/action-slsa@v1.5.15 with: target: 'busybox:latest' ``` @@ -163,7 +163,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.14 + uses: scribe-security/action-slsa-cli@v1.5.15 with: target: 'hello-world:latest' ``` @@ -366,6 +366,7 @@ Docker is configured by default to pull images matching the runner's platform. F ``` ### Basic examples +
Public registry image @@ -418,11 +419,69 @@ steps: - name: Generate SLSA provenance uses: scribe-security/action-slsa@master with: - target: 'scribesecurity.jfrog.io/scribe-docker-local/example:latest' + target: 'scribesecurity/example:latest' force: true ```
+ +
+ SLSA Provenance with By-Product Asset Evidence + +Generate SLSA Provenance while adding by-product asset **evidence** using the `--input` flag. Example assets might include configuration files, additional images, or SARIF reports. + +```yaml +- name: Generate SLSA Provenance with By-Products + uses: scribe-security/action-slsa@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + input: | + sarif:test.json, + git:git:https://github.com/mongo-express/mongo-express.git +``` +
+ +
+ SLSA Provenance with BOM + +Generate SLSA Provenance and a Bill of Materials (BOM) for a container image. + +> Note example uses **action-bom** action. + +```yaml +- name: Generate SLSA Provenance with BOM + uses: scribe-security/action-bom@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + provenance: true +``` + +
+ +
+ SLSA Provenance with SBOM and Base Image Analysis + +Generate SLSA Provenance with SBOM by product including Base Image analysis. + +> Note example uses **action-bom** action. + +```yaml +- name: Generate SLSA Provenance with Base Image Analysis + uses: scribe-security/action-bom@dev + with: + target: 'hello-world:latest' + verbose: 2 + format: statement + provenance: true + base-image: alpine:latest +``` + +
+
Custom metadata @@ -502,7 +561,7 @@ Create SLSA for local `docker save ...` output. with: context: . file: .GitHub/workflows/fixtures/Dockerfile_stub - tags: scribesecurity.jfrog.io/scribe-docker-local/example:latest + tags: scribesecurity/example:latest outputs: type=docker,dest=stub_local.tar - name: Generate SLSA provenance @@ -524,7 +583,7 @@ Create SLSA for the local oci archive. with: context: . file: .GitHub/workflows/fixtures/Dockerfile_stub - tags: scribesecurity.jfrog.io/scribe-docker-local/example:latest + tags: scribesecurity/example:latest outputs: type=oci,dest=stub_oci_local.tar - name: Generate SLSA provenance diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index 55811cc5b..f6d3e8943 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -163,7 +163,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.14 + uses: scribe-security/action-verify@v1.5.15 with: target: 'busybox:latest' ``` @@ -171,7 +171,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.14 + uses: scribe-security/action-verify-cli@v1.5.15 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/gitlabci.md b/docs/integrating-scribe/ci-integrations/gitlabci.md index 24b3e5935..3969ebd57 100644 --- a/docs/integrating-scribe/ci-integrations/gitlabci.md +++ b/docs/integrating-scribe/ci-integrations/gitlabci.md @@ -153,7 +153,7 @@ custom-ntia-metadata: > Before the following task add a `docker login` task ```YAML -- valint bom scribesecurity.jfrog.io/scribe-docker-local/example:latest \ +- valint bom scribesecurity/example:latest \ --context-type gitlab \ --output-directory ./scribe/valint \ ``` @@ -165,7 +165,7 @@ custom-ntia-metadata: > Before the following task add a `docker login` task ```YAML -- valint slsa scribesecurity.jfrog.io/scribe-docker-local/example:latest \ +- valint slsa scribesecurity/example:latest \ --context-type gitlab \ --output-directory ./scribe/valint \ ``` diff --git a/docs/integrating-scribe/ci-integrations/travis.md b/docs/integrating-scribe/ci-integrations/travis.md index bd99e5e2e..60e84fc6d 100644 --- a/docs/integrating-scribe/ci-integrations/travis.md +++ b/docs/integrating-scribe/ci-integrations/travis.md @@ -138,7 +138,7 @@ jobs: ```YAML - | - valint bom scribesecurity.jfrog.io/scribe-docker-local/example:latest \ + valint bom scribesecurity/example:latest \ --context-type travis \ --output-directory ./scribe/valint \ -f @@ -152,7 +152,7 @@ jobs: ```YAML - | - valint slsa scribesecurity.jfrog.io/scribe-docker-local/example:latest \ + valint slsa scribesecurity/example:latest \ --context-type travis \ --output-directory ./scribe/valint \ -f diff --git a/docs/valint/getting-started-valint.md b/docs/valint/getting-started-valint.md index 1ce99c69a..8b111fd68 100644 --- a/docs/valint/getting-started-valint.md +++ b/docs/valint/getting-started-valint.md @@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. -> Latest Version `v1.5.14`. +> Latest Version `v1.5.15`. ### Installing Valint @@ -123,6 +123,7 @@ Other using one of the commands `bom` or `slsa` you should add the flag `-o` to Attestation is written by default to the local cache provided by the `--output-directory` flag (default `$HOME/.cache/valint`), you can also use `--output-file` flag to provide a custom path for the attestation. Note in the logs that the signed attestation is now saved on your machine in the default location. The path is specified in the result. In the example above it's saved in: `$HOME/.cache/valint/docker/busybox/latest/sha256-9810966b5f712084ea05bf28fc8ba2c8fb110baa2531a10e2da52c1efc504698.bom.sig.json`. + ### Using Valint to retrieve and verify a signed SBOM Once you have signed something into an attestation you can later verify that the object you're checking is identical to the one you have signed. For example, if we signed the `busybox:latest` image I can later compare that image to the signed attestation we have saved. diff --git a/docs/valint/sbom.md b/docs/valint/sbom.md index e40b71b97..10bf5a7e5 100644 --- a/docs/valint/sbom.md +++ b/docs/valint/sbom.md @@ -71,3 +71,14 @@ Following are some of the customizable features we support. ## Package dependency relations For package-to-package relations, default support is partial, and it is limited to specific types of packages. To enhance the accuracy and completeness of these relations, especially for broader package types, we recommend using the OWASP plugin during your actual build process. This approach typically yields a more precise representation of package relations. You can then seamlessly merge this information into your artifact SBOM by including it in the final artifact. This ensures that your Software Bill of Materials reflects the most up-to-date and accurate dependency relationships. + + +Here's a paragraph you can add to the documentation regarding the new multi-target input support: + +## Multi-target input support + +The SBOM generation process now supports enhanced flexibility with multi-target inputs. By using the `--input` flag, users can specify diverse evidence or assets as inputs, which are processed alongside the primary target. These inputs allow for the creation of third-party evidence and enable richer policy evaluations and enforcement. Relationships between the primary target and inputs are dynamically built, ensuring comprehensive and accurate SBOMs. + +## Base Image Verification + +The `--base-image` flag allows for precise base image identification and verification. When specified, Valint ensures that the target container is accurately linked to its base image. This feature updates the SBOM and in-memory context with information such as base image labels, layer references, and derived package sources. The SBOM graph is also updated to reflect the dependency relationships between the base image and the target container. This ensures a detailed representation of the base image’s influence within the SBOM, including all relevant layers and associated packages. From 5e6507ede7271d9e63b31cf1e110928f00c31dcd Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 2 Jan 2025 13:15:50 +0200 Subject: [PATCH 048/191] updates --- docs/platforms/bom.md | 404 +++++++++----- docs/platforms/discover.md | 1021 ++++++++++++++++++++++++++++-------- docs/platforms/evidence.md | 698 +++++++++++++----------- docs/platforms/overview.md | 107 ++-- docs/platforms/usage.md | 35 +- docs/platforms/verify.md | 474 +++++++++++------ 6 files changed, 1852 insertions(+), 887 deletions(-) diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index 50c703150..db8a0f349 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,33 +16,49 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] - [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] - [--valint.scribe.client-id CLIENT_ID] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] - {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket} ... +usage: platforms [options] bom [-h] [--allow-failures] + [--save-scan-plan] [--dry-run] + [--monitor.mount MOUNT] + [--monitor.threshold THRESHOLD] + [--monitor.clean-docker] + [--max-threads MAX_THREADS] + [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] + [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] + [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] + [--valint.attest ATTEST] + [--valint.sign] + [--valint.components COMPONENTS] + [--valint.label LABEL] [--unique] + {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket} + ... Export bom data options: -h, --help Show this help message and exit. - --allow-failures Allow failures without returning an error code (default: False) + --allow-failures Allow failures without returning an error + code (default: False) --save-scan-plan Save scan plan (default: False) --dry-run Dry run (default: False) --monitor.mount MOUNT - Monitor disk usage - mount path (type: str, default: ) + Monitor disk usage - mount path (type: str, + default: ) --monitor.threshold THRESHOLD - Monitor disk usage - threshold (type: int, default: 90) + Monitor disk usage - threshold (type: int, + default: 90) --monitor.clean-docker - Monitor disk usage - auto clean docker cache (default: False) + Monitor disk usage - auto clean docker cache + (default: False) --max-threads MAX_THREADS - Number of threads used to run valint (type: int, default: 2) - --valint.scribe.client-id CLIENT_ID - Scribe client ID (type: str, default: ) + Number of threads used to run valint (type: + int, default: 10) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable @@ -54,24 +70,33 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, + default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: + /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: factory) + Evidence product key (type: str, default: + factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, default: ) + Evidence product version (type: str, + default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) + Evidence predicate type (type: str, default: + http://scribesecurity.com/evidence/discovery + /v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: x509-env) + Evidence attest type (type: str, default: + x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f2934ecf420>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7fb6e02bfba0>, default: []) --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument followed by --help. + For more details of each subcommand, add it as an argument + followed by --help. Available subcommands: gitlab @@ -145,7 +170,12 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] [--instance INSTANCE] +usage: platforms [options] bom [options] dockerhub [-h] + [--instance INSTANCE] + [--username USERNAME] + [--password PASSWORD] + [--token TOKEN] + [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] @@ -153,15 +183,24 @@ usage: platforms [options] bom [options] dockerhub [-h] [--instance INSTANCE] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] + [--scope.namespace [NAMESPACE ...]] + [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) + --username USERNAME Dockerhub username (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) + (default: null) + --token TOKEN Dockerhub token (default: null) + --url URL Dockerhub base URL (default: + https://hub.docker.com) --default_product_key_strategy {namespace,repository,tag,mapping} - Override product key with namespace, repository or image names (default: mapping) + Override product key with namespace, + repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image id (default: short_image_id) + Override product version with tag or image + id (default: short_image_id) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -169,13 +208,15 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude (default: []) + Dockerhub repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: + Image product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -222,39 +263,63 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] [--instance INSTANCE] [--types {namespace,pod,all}] +usage: platforms [options] bom [options] k8s [-h] + [--instance INSTANCE] + [--url URL] + [--token TOKEN] + [--types {namespace,pod,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] + [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] + [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] + [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) + --url URL Kubernetes API URL (required, default: ) + --token TOKEN Kubernetes token, with access to pods and + secrets (K8S_TOKEN) (default: ) --types {namespace,pod,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or image names (default: mapping) + Override product key with namespace, pod or + image names (default: mapping) --default_product_version_strategy {namespace_hash,pod_hash,image_id} - Override product version with namespace, pod or image names (default: namespace_hash) + Override product version with namespace, pod + or image names (default: namespace_hash) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list (default: ['*']) + Kubernetes namespaces wildcard list + (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: ['*']) + Kubernetes pods wildcard list (default: + ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: ['*']) - --ignore-state Filter out containers that are not running (default: False) + Kubernetes images wildcard list (default: + ['*']) + --ignore-state Filter out containers that are not running + (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process (default: []) + Namespaces to exclude from discovery process + (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process (default: []) + Pods to exclude from discovery process + (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process (default: []) + Images to exclude from discovery process + (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- - image:product_key:product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to + product_key:product_version mappinge.g. my- + namespace;my-pod;my- + image:product_key:product_version (type: + K8sImageMappingString, default: []) ``` @@ -300,7 +365,10 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] [--instance INSTANCE] +usage: platforms [options] bom [options] jfrog [-h] + [--instance INSTANCE] + [--jf_token JF_TOKEN] + [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] @@ -315,10 +383,14 @@ usage: platforms [options] bom [options] jfrog [-h] [--instance INSTANCE] options: -h, --help Show this help message and exit. --instance INSTANCE Jfrog instance string (default: ) + --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --url URL Jfrog base URL (default: ) --default_product_key_strategy {jf-repository,repository,tag,mapping} - Override product key with jf-repository, repository or image names (default: mapping) + Override product key with jf-repository, + repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image id (default: short_image_id) + Override product version with tag or image + id (default: short_image_id) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -328,13 +400,16 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude (default: []) + Jfrog repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude (default: []) + Jfrog Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: + Image product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -355,20 +430,25 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] [--instance INSTANCE] +usage: platforms [options] bom [options] ecr [-h] + [--instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.aws-account [AWS_ACCOUNT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] + [--exclude.aws-account [AWS_ACCOUNT ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) --default_product_key_strategy {aws-account,repository,tag,mapping} - Override product key with aws-account, repository or image names (default: mapping) + Override product key with aws-account, + repository or image names (default: mapping) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -378,14 +458,17 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude (default: []) + ECR repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude (default: []) + ECR Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --url URL ECR base URL (default: null) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: + Image product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -408,58 +491,91 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] - [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] [--types {repository,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] - [--commit.skip] [--default_product_key_strategy {mapping}] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] + [--instance INSTANCE] + [--app_password APP_PASSWORD] + [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] + [--url URL] + [--types {repository,all}] + [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] + [--commit.skip] + [--default_product_key_strategy {mapping}] + [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) (default: ) + BitBucket app_password (BB_PASSWORD) + (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with + --workspace_name flag instead of + --app_password and --username + (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and - --username (default: ) - --url URL BitBucket URL (required, default: https://api.bitbucket.org) + BitBucket workspace_name can be used with + --workspace_token flag instead of + --app_password and --username (default: ) + --url URL BitBucket URL (required, default: + https://api.bitbucket.org) --types {repository,all} - Specifies the type of evidence to generate, scoped by scope parameters (default: repository) + Specifies the type of evidence to generate, + scoped by scope parameters (default: + repository) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all + projects. Note that a project name includes + as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by reopsitory name too. (default: - mapping) + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is - the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format + of workspace::product_key::product_version + where org is the workspace name, wildcards + are supported (type: AssetMappingString, + default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the - project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of + project::product_key::product_version where + org is the project name, wildcards are + supported (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) ``` @@ -481,44 +597,63 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {repository,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--organization.single] - [--repository.single] [--organization.mapping [MAPPING ...]] +usage: platforms [options] bom [options] github [-h] + [--instance INSTANCE] + [--token TOKEN] + [--url URL] + [--types {repository,all}] + [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] + [--branch.shallow] + [--commit.skip] + [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) - --url URL Github base URL (default: https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) + (default: ) + --url URL Github base URL (default: + https://github.com) --types {repository,all} - Specifies the type of evidence to generate, scoped by scope parameters (default: repository) + Specifies the type of evidence to generate, + scoped by scope parameters (default: + repository) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by reopsitory name too. (default: - mapping) - --organization.single - Export all organizations in a single evidence (default: False) - --repository.single Export all repos in a single evidence (default: False) + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the - organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the + format of org::product_key::product_version + where org is the organization name, + wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) ``` @@ -540,37 +675,56 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] - [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] + [--instance INSTANCE] + [--token TOKEN] + [--url URL] + [--types {project,all}] + [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] + [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] + [--commit.skip] + [--pipeline.skip] + [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) - --url URL Gitlab base URL (default: https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) + (default: ) + --url URL Gitlab base URL (default: + https://gitlab.com/) --types {project,all} - Specifies the type of evidence to generate, scoped by scope parameters (default: all) + Specifies the type of evidence to generate, + scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. + Default is all projects. Note that a project + name includes as a prefix its namesapce in + the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) - --pipeline.skip Skip pipeline in evidence (default: False) + --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or image names (default: mapping) + Override product key with namespace, pod or + image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the + format of to + organization::product_key::product_version + (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: + Project product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index 0e44e74ff..5e53e94ee 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -5,9 +5,14 @@ sidebar_position: 3 --- # The Discover Command -The discover command is used to sample asset data from various sources. The data is stored in an internal database, which is used by the evidence generation and policy evaluation commands. To run the discover command you need to provide the access data to the resources and scoping information. Access data typically includes providing a `url` and access data such as a `token` or `username` and `password`. -Notice that the database created should be accessible for running the other commands later on. +The `discover` command is used to sample asset data from various sources. The data is stored in an internal database, which can then be used by the evidence generation and policy evaluation commands. To run the `discover` command, you need to provide access data to the resources and scoping information. Access data typically includes providing a `url` and credentials such as a `token` or `username` and `password`. + +Once executed, the command generates evidence related to the discovered assets. This evidence can either be uploaded to an attestation store or exported locally. The discover command supports various platforms, including DockerHub, GitHub, GitLab, and others. + +The evidence generation process uses Scribe's `valint` tool to upload and optionally sign the evidence. Documentation for the `valint` tool can be found [here](https://scribe-security.netlify.app/docs/introducing-scribe/what-is-scribe/). + +> **Notice:** The `discover` command creates a local database that supports other platform commands such as `evidence`, `verify`, and `bom`. This database must be accessible when running these commands. Multiple databases can be created for different purposes—for instance, using one database for generating fresh evidence during a build process and another for conducting a comprehensive asset discovery across the organization. By default, the database is named `platforms.db` and is stored in the working directory, but the filename can be customized using CLI flags. ## Common Options ```bash -usage: platforms [options] discover [-h] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] - {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket} ... +usage: platforms [options] discover [-h] + [--db.local.store_policy {update,replace}] + [--db.update_period UPDATE_PERIOD] + [--evidence.local.path PATH] + [--evidence.local.prefix PREFIX] + [--evidence.local_only] + [--max-threads MAX_THREADS] + [--thread-timeout THREAD_TIMEOUT] + [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] + [--export-partial] + [--skip-evidence] + [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] + [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] + [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] + [--valint.attest ATTEST] + [--valint.sign] + [--valint.components COMPONENTS] + [--valint.label LABEL] + [--unique] + {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket} + ... Discover assets and save data to a local store options: -h, --help Show this help message and exit. --db.local.store_policy {update,replace} - Policy for local data collection: update or replace (default: update) + Policy for local data collection: update or + replace (default: update) --db.update_period UPDATE_PERIOD - Update period in days. 0 for force update (type: int, default: 0) + Update period in days. 0 for force update + (type: int, default: 0) + --evidence.local.path PATH + Local report export directory path (type: + str, default: output) + --evidence.local.prefix PREFIX + Local report export prefix (type: str, + default: ) + --evidence.local_only + Only export local evidence (default: False) + --max-threads MAX_THREADS + Main Pool max threads used to parallelize + evidence collection (type: int, default: + 2000) + --thread-timeout THREAD_TIMEOUT + Thread timeout in seconds (type: float, + default: 20.0) + --rate-limit-retry RATE_LIMIT_RETRY + Retry on rate limit (type: int, default: 3) + --allow-failures Allow failures without returning an error + code (default: False) + --export-partial Upload Partial Discover evidence (default: + False) + --skip-evidence Skip evidence upload (default: False) + --valint.scribe.client-secret CLIENT_SECRET + Scribe client Secret (type: str, default: ) + --valint.scribe.enable + Enable Scribe client (default: False) + --valint.cache.disable + Disable Valint local cache (default: False) + --valint.context-type CONTEXT_TYPE + Valint context type (type: str, default: ) + --valint.log-level LOG_LEVEL + Valint log level (type: str, default: ) + --valint.output-directory OUTPUT_DIRECTORY + Local evidence cache directory (type: str, + default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: + /home/mikey/.scribe/bin/valint) + --valint.product-key PRODUCT_KEY + Evidence product key (type: str, default: + factory) + --valint.product-version PRODUCT_VERSION + Evidence product version (type: str, + default: ) + --valint.predicate-type PREDICATE_TYPE + Evidence predicate type (type: str, default: + http://scribesecurity.com/evidence/discovery + /v0.1) + --valint.attest ATTEST + Evidence attest type (type: str, default: + x509-env) + --valint.sign sign evidence (default: False) + --valint.components COMPONENTS + components list (type: str, default: ) + --valint.label LABEL Set additional labels (type: at 0x7fe46efee980>, default: []) + --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument followed by --help. + For more details of each subcommand, add it as an argument + followed by --help. Available subcommands: gitlab @@ -45,14 +136,35 @@ subcommands: - +--- ## Gitlab Discovery -Gitlab discovery samples the following assets: organization, projects, users, tokens, and pipelines. + +GitLab discovery samples the following assets: organizations, projects, users, tokens, and pipelines. Evidence is generated for organizations and projects, including details about these assets. + +### Access + +Access to GitLab is provided using the `--url` and `--token` flags. +You can use the environment variables `GITLAB_URL` and `GITLAB_TOKEN` respectively. + +Required permissions for asset collection: + +* **Project Maintainer role** +* **Selected scopes**: `read_api`, `read_repository` + +### Example + +To generate evidence for a GitLab account: + +```bash +platforms discover gitlab \ + --url https://gitlab.com/api/v \ + --token YOUR_GITLAB_TOKEN \ + --organization.mapping "my-org::my-product::1.0" \ + --project.mapping "my-project::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] gitlab [-h] [--instance INSTANCE] - [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--scope.skip_org_members] - [--scope.skip_project_members] [--scope.commit.past_days PAST_DAYS] - [--scope.pipeline.skip] [--scope.pipeline.past_days PAST_DAYS] - [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] +usage: platforms [options] discover [options] gitlab + [-h] [--instance INSTANCE] + [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] + [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] + [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] + [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] + [--scope.pipeline.past_days PAST_DAYS] + [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] + [--broad] [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--organization.single] + [--project.single] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) - --url URL Gitlab base URL (default: https://gitlab.com/) + --types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...] + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...] + Defines which asset types to exclude for + discovery. (default: []) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) + (default: ) + --url URL Gitlab base URL (default: + https://gitlab.com/) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. + Default is all projects. Note that a project + name includes as a prefix its namesapce in + the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) - --pipeline.skip Skip pipeline in evidence (default: False) + --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or image names (default: mapping) + Override product key with namespace, pod or + image names (default: mapping) --scope.skip_org_members - Skip organization members discovery (default: False) + Skip organization members discovery + (default: False) --scope.skip_project_members - Skip project members discovery (default: False) + Skip project members discovery (default: + False) --scope.commit.past_days PAST_DAYS - Number of past days to include in the report (type: int, default: 28) - --scope.pipeline.skip - Skip pipeline information (default: False) + Number of past days to include in the report + (type: int, default: 28) --scope.pipeline.past_days PAST_DAYS - Number of past days to include in the report (type: int, default: 30) + Number of past days to include in the report + (type: int, default: 30) --scope.pipeline.analyzed_logs - Include analyzed pipeline logs (default: False) + Include analyzed pipeline logs (default: + False) --scope.pipeline.reports - Include gitlab standard reports (default: False) - --broad Retrieves limited information (only organizations and projects) (default: False) + Include gitlab standard reports (default: + False) + --broad Retrieves limited information (only + organizations and projects) (default: False) + --organization.mapping [MAPPING ...] + Organization product key mapping in the + format of to + organization::product_key::product_version + (type: AssetMappingString, default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --organization.single + Export all organizations in a single + evidence (default: False) + --project.single Export all projects in a single evidence + (default: False) ``` -Note: -The discovery includes two experimental features, to add data to the project evidence: -* `--scope.workflow.analyzed_logs` which attepmts to analyze logs to detect image building information - +--- ## Github Discovery -Github discovery samples the following assets: organization, repositories, users, tokens, and workflows. + +GitHub discovery samples the following assets: organizations, repositories, users, tokens, and workflows. Evidence generation supports the creation of organization and repository evidence. + +### Access + +Access to GitHub is provided using the `--url` and `--token` flags. +You can use the environment variables `GITHUB_URL` and `GITHUB_TOKEN` respectively. + +Required permissions for asset collection: + +* Fine-grained personal access tokens with the following permissions: + * **List Org, users**: No permission required + * **"Members" organization permissions**: Read + * **"Secrets" organization permissions**: Read + * **"Variables" organization permissions**: Read + * **"Metadata" repository permissions**: Read + * **"Contents" repository permissions**: Read + * **"Secrets" repository permissions**: Read + * **"Actions" repository permissions**: Read + * **"Pull requests" repository permissions**: Read + * **"Administration" repository permissions**: Read (for Runner and Read branch protection rules) + +### Example + +To generate evidence for a GitHub account: + +```bash +platforms discover github \ + --url https://api.github.com \ + --token YOUR_GITHUB_TOKEN \ + --organization.mapping "my-org::my-product::1.0" \ + --repository.mapping "my-repository::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] github [-h] [--instance INSTANCE] - [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] - [--scope.commit.past_days PAST_DAYS] [--workflow.skip] - [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] - [--scope.runners] [--scope.sbom] [--broad] +usage: platforms [options] discover [options] github + [-h] [--instance INSTANCE] + [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] + [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] + [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] + [--scope.commit.past_days PAST_DAYS] [--workflow.skip] + [--scope.workflow.past_days PAST_DAYS] + [--scope.workflow.analyzed_logs] [--scope.runners] + [--scope.sbom] [--broad] + [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) --types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) - --url URL Github base URL (default: https://github.com) + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...] + Defines which asset types to exclude for + discovery. (default: []) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) + (default: ) + --url URL Github base URL (default: + https://github.com) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by reopsitory name too. (default: - mapping) + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) --scope.commit.past_days PAST_DAYS - Number of past days to include in the report (type: int, default: 30) + Number of past days to include in the report + (type: int, default: 30) --workflow.skip Skip workflows in evidence (default: False) --scope.workflow.past_days PAST_DAYS - Number of past days to include in the report (type: int, default: 30) + Number of past days to include in the report + (type: int, default: 30) --scope.workflow.analyzed_logs - Include analyzed workflow logs (default: False) - --scope.runners Include repository allocated runners in evidence (default: False) - --scope.sbom Include repositories SBOM in evidence (default: False) - --broad Retrieves limited information (only organizations, repositories and workflows) (default: False) + Include analyzed workflow logs (default: + False) + --scope.runners Include repository allocated runners in + evidence (default: False) + --scope.sbom Include repositories SBOM in evidence + (default: False) + --broad Retrieves limited information (only + organizations, repositories and workflows) + (default: False) + --organization.mapping [MAPPING ...] + Organization product key mapping in the + format of org::product_key::product_version + where org is the organization name, + wildcards are supported (type: + AssetMappingString, default: []) + --repository.mapping [MAPPING ...] + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) ``` -Note: -The discovery includes two experimental features, to add data to the project evidence: -* `--scope.pipeline.analyzed_logs` which attepmts to analyze logs to detect image building information -* `--scope.pipeline.reports` which collects GitLab standard secret scanning and sast reports. - +--- ## DockerHub Discovery -DockerHub discovery samples the following assets: namespaces, repositories, and repository_tags. + +DockerHub discovery samples the following assets: namespaces, repositories, and repository tags. Evidence generation includes namespace and repository evidence, which includes information about repositories, tags, and access tokens. + +### Access + +Access to DockerHub is provided using the `--url`, `--username`, and either `--password` or `--token` flags. +You can use the environment variables `DOCKERHUB_URL`, `DOCKERHUB_USERNAME`, and `DOCKERHUB_PASSWORD` respectively. + +Required permission for asset collection: + +* **User and password organization owner** + +### Example + +To generate evidence for a DockerHub account: + +```bash +platforms discover dockerhub \ + --url https://hub.docker.com/v2/ \ + --username YOUR_DOCKERHUB_USERNAME \ + --password YOUR_DOCKERHUB_PASSWORD \ + --namespace.mapping "my-namespace::my-product::1.0" \ + --repository.mapping "my-repo::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] dockerhub [-h] [--instance INSTANCE] - [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] - [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] - [--broad] +usage: platforms [options] discover [options] dockerhub + [-h] [--instance INSTANCE] + [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] + [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--namespace-list [NAMESPACE_LIST ...]] + [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] + [--repository.single] [--namespace.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--token.mapping [MAPPING ...]] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...] + Defines which asset types to exclude for + discovery. (default: []) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: ) - --token TOKEN Dockerhub token (default: ) - --url URL Dockerhub base URL (default: https://hub.docker.com) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) + (default: null) + --token TOKEN Dockerhub token (default: null) + --url URL Dockerhub base URL (default: + https://hub.docker.com) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -210,47 +459,67 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude (default: []) + Dockerhub repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --namespace-list [NAMESPACE_LIST ...] List of namespaces (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) - --broad Retrieves limited information (only namespaces and repositories) (default: False) + Ignore tags pushed earlier that previous to + this number of days (type: int, default: 30) + --broad Retrieves limited information (only + namespaces and repositories) (default: + False) + --namespace.single Export all namespaces in a single evidence + (default: False) + --repository.single Export all repositories in a single evidence + (default: False) + --namespace.mapping [MAPPING ...] + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) + --repository.mapping [MAPPING ...] + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) + --token.mapping [MAPPING ...] + Repository tag product key mapping in the + format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --default_product_key_strategy {mapping,mapping,mapping,mapping} + Override product key with namespace, + repository or image names (default: mapping) ``` - +```bash +platforms discover k8s \ + --url https://kubernetes.example.com \ + --token YOUR_K8S_TOKEN \ + --namespace.mapping "my-namespace::my-product::1.0" \ + --pod.mapping "my-pod::my-product::1.0" +``` -## K8s Discovery -Kubernetes discovery samples the following asset types: namespaces, pods, and secrets. Pod information includes image information. +### Usage ```bash -usage: platforms [options] discover [options] k8s [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] k8s [-h] + [--instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] - [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] [--secret.skip] [--deployment.skip] [--broad] + [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] + [--url URL] + [--token TOKEN] + [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] + [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] + [--secret.skip] + [--deployment.skip] + [--broad] + [--namespace.single] + [--pod.single] + [--namespace.mapping [MAPPING ...]] + [--pod.mapping [MAPPING ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...] + Defines which asset types to exclude for + discovery. (default: []) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and + secrets (K8S_TOKEN) (default: ) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list (default: ['*']) + Kubernetes namespaces wildcard list + (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: ['*']) + Kubernetes pods wildcard list (default: + ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: ['*']) - --ignore-state Filter out containers that are not running (default: False) + Kubernetes images wildcard list (default: + ['*']) + --ignore-state Filter out containers that are not running + (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process (default: []) + Namespaces to exclude from discovery process + (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process (default: []) + Pods to exclude from discovery process + (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process (default: []) + Images to exclude from discovery process + (default: []) --secret.skip Skip secrets discovery (default: False) --deployment.skip Skip deployments discovery (default: False) - --broad Retrieves limited information (only namespaces and deployments) (default: False) + --broad Retrieves limited information (only + namespaces and deployments) (default: False) + --namespace.single Export all namespaces (default: False) + --pod.single Export all pods in a single evidence + (default: False) + --namespace.mapping [MAPPING ...] + Namespace product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) + --pod.mapping [MAPPING ...] + Pod product key mapping in the format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --default_product_key_strategy {namespace,pod,image,mapping} + Override product key with namespace, pod or + image names (default: mapping) ``` - +### Example -## Jfrog Discovery -Jfrog discovery samples the following assets: Jfrog repositories, Image repositories, and Image Tags. -For example `my_company.jfrog.io/my_registry/my_image:latest` +To generate evidence for a JFrog account: -* `my_company.jfrog.io`: Instance URL -* `my_registry` A Jfrog Repository Includes a set of Image Repositories. -* `my_image` A image Repository, Includes a set of Image Tags. -* `my_image:latest` A image Repository. +```bash +platforms discover jfrog \ + --url https://my_company.jfrog.io/artifactory/ \ + --token YOUR_JFROG_TOKEN \ + --jf-repository.mapping "*::my-product::1.0" \ + --namespace.mapping "my-namespace::my-product::1.0" \ + --repository.mapping "*my-repo::my-product::1.0" +``` +### Usage ```bash -usage: platforms [options] discover [options] jfrog [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] jfrog [-h] + [--instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] - [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] + [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] + [--jf_token JF_TOKEN] + [--url URL] + [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] + [--scope.past_days PAST_DAYS] + [--scope.tag_limit TAG_LIMIT] + [--broad] + [--jf-repository.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--token.mapping [MAPPING ...]] + [--jf-repository.single] + [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Jfrog instance string (default: ) --types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) - --token TOKEN Jfrog token (JFROG_TOKEN) (default: ) - --url URL Jfrog base URL (default: null) + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...] + Defines which asset types to exclude for + discovery. (default: []) + --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --url URL Jfrog base URL (default: ) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -365,30 +691,85 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude (default: []) + Jfrog repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude (default: []) + Jfrog Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) + Ignore tags pushed earlier that previous to + this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag - list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: - 10) - --broad Retrieves limited information (only jf-repositories and repositories) (default: False) + Limit the number of recent tags to be + discovered. Scoping to tag names is done on + the limited tag list. Limit applies also to + the past_days filter. 0 for no limit, + default is 10. (type: int, default: 20) + --broad Retrieves limited information (only jf- + repositories and repositories) (default: + False) + --jf-repository.mapping [MAPPING ...] + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) + --repository.mapping [MAPPING ...] + Repository image_tags product key mapping in + the format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --token.mapping [MAPPING ...] + Repository tag product key mapping in the + format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --jf-repository.single + Export all jf-repositorys in a single + evidence (default: False) + --repository.single Export all repositories in a single evidence + (default: False) + --default_product_key_strategy {mapping,mapping,mapping,mapping} + Override product key with jf-repository, + repository or image names (default: mapping) ``` +--- + ## ECR Discovery -ECR discovery samples the following assets: ECR repositories, Image repositories, and Image Tags. -For example `\.dkr.ecr.us-west-2.amazonaws.com/my_image:latest` -* ``\.dkr.ecr.us-west-2.amazonaws.com`: Instance URL -* `my_image` A image Repository, Includes a set of Image Tags. -* `my_image:latest` A image Repository. +ECR discovery samples the following assets: ECR repositories, image repositories, and image tags. +For example, `.dkr.ecr.us-west-2.amazonaws.com/my_image:latest` + +* `.dkr.ecr.us-west-2.amazonaws.com`: Instance URL +* `my_image`: An image repository that includes a set of image tags. +* `my_image:latest`: An image repository. +ECR evidence generation includes namespace and repository evidence, which contains information about repositories and tags. + +### Access + +Access to ECR is provided using the `--url` and `--token` flags. +You can use the environment variables `ECR_URL` and `ECR_LOGIN_TOKEN` respectively. + +Required permission for asset collection: + +* **Read permission** to the ECR registry API + +### Example + +To generate evidence for an ECR account: + +```bash +platforms discover ecr \ + --url https://aws.amazon.com/ecr/ \ + --token YOUR_ECR_TOKEN \ + --repository.mapping "*my-service*::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] ecr [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] ecr [-h] + [--instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] - [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] + [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] + [--token TOKEN] + [--url URL] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] + [--scope.past_days PAST_DAYS] + [--scope.tag_limit TAG_LIMIT] + [--broad] + [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--aws-account.single] + [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) --types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) + Defines which asset to discover, scoped by + scope parameters (default: []) + --exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...] + Defines which asset types to exclude for + discovery. (default: []) --token TOKEN ECR token (ECR_LOGIN_TOKEN) (default: ) --url URL ECR base URL (default: null) --scope.aws-account [AWS_ACCOUNT ...] @@ -423,24 +819,80 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude (default: []) + ECR repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude (default: []) + ECR Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) + Ignore tags pushed earlier that previous to + this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag - list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: - 10) - --broad Retrieves limited information (only aws-account and repository) (default: False) + Limit the number of recent tags to be + discovered. Scoping to tag names is done on + the limited tag list. Limit applies also to + the past_days filter. 0 for no limit, + default is 10. (type: int, default: 10) + --broad Retrieves limited information (only aws- + account and repository) (default: False) + --aws-account.mapping [MAPPING ...] + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) + --repository.mapping [MAPPING ...] + Repository image_tags product key mapping in + the format of + asset::product_key::product_version (type: + AssetMappingString, default: []) + --aws-account.single Export all aws-account in a single evidence + (default: False) + --repository.single Export all repositories in a single evidence + (default: False) + --default_product_key_strategy {mapping,mapping,mapping,mapping} + Override product key with aws-account, + repository or image names (default: mapping) ``` +--- + ## BitBucket Discovery -BitBucket discovery samples the following assets: workspaces, projects, repositories, user, branches, commits, protected_branches and webhooks. + +BitBucket discovery samples the following assets: workspaces, projects, repositories, users, branches, commits, protected branches, and webhooks. + +BitBucket evidence generation includes workspace and repository evidence. + +**Note:** BitBucket supports both Cloud and Data Center deployments. + +### Access + +Access to Bitbucket is provided using the `--url` and `--app_password` or `workspace_token` flags. +You can use the environment variables `BB_URL`, `BB_PASSWORD`, or `BB_WORKSPACE_TOKEN` respectively. + +Required OAuth 2.0 scopes for asset collection: + +* **account**: Read workspace, permissions, and user info +* **project**: Read project info +* **repository**: Read repository, tag, branch, and commit info +* **webhook**: Read webhook info +* **admin**: Read branch protection rules + +### Example + +To generate evidence for a Bitbucket account: + +```bash +platforms discover bitbucket \ + --url https://api.bitbucket.org/2.0/ \ + --app_password YOUR_BITBUCKET_PASSWORD \ + --workspace.mapping "my-workspace::my-product::1.0" \ + --repository.mapping "my-repository::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] bitbucket [-h] [--instance INSTANCE] - [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] - [--url URL] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--broad] +usage: platforms [options] discover [options] bitbucket + [-h] [--instance INSTANCE] + [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] + [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] + [--url URL] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--broad] + [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--default_product_key_strategy {mapping}] + [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...] - Defines which asset to discover, scoped by scope parameters (default: []) + Defines which asset to discover, scoped by + scope parameters (default: []) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) (default: ) + BitBucket app_password (BB_PASSWORD) + (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with + --workspace_name flag instead of + --app_password and --username + (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and - --username (default: ) - --url URL BitBucket URL (required, default: https://api.bitbucket.org) + BitBucket workspace_name can be used with + --workspace_token flag instead of + --app_password and --username (default: ) + --url URL BitBucket URL (required, default: + https://api.bitbucket.org) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all + projects. Note that a project name includes + as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: False) - --broad Retrieves limited information (only workspaces, repositories) (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) + --broad Retrieves limited information (only + workspaces, repositories) (default: False) + --workspace.mapping [MAPPING ...] + Workspace product key mapping in the format + of workspace::product_key::product_version + where org is the workspace name, wildcards + are supported (type: AssetMappingString, + default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of + project::product_key::product_version where + org is the project name, wildcards are + supported (type: AssetMappingString, + default: []) + --repository.mapping [MAPPING ...] + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) + --default_product_key_strategy {mapping} + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) + --workspace.single Export all workspaces in a single evidence + (default: False) + --project.single Export all projects in a single evidence + (default: False) + --repository.single Export all repos in a single evidence + (default: False) ``` +--- + ## Jenkins Discovery -Jenkins discovery samples the following assets: instance, folders, jobs, job_runs, credential_stores, users, computer_set, security_settings. + +Jenkins discovery samples the following assets: instances, folders, jobs, job runs, credential stores, users, computer sets, and security settings. + +Jenkins evidence generation supports the creation of instance and folder evidence. + +### Access + +Access to Jenkins is provided using the `--url` and `--password` flags. +You can use the environment variables `JENKINS_URL` and `JENKINS_PASSWORD` respectively. + +Required permissions for asset collection: + +* **Read job and folder permissions** +* **List credentials** +* **Read security realm** + +### Example + +To generate evidence for a Jenkins account: + +```bash +platforms discover jenkins \ + --url https://jenkins.example.com \ + --password YOUR_JENKINS_PASSWORD \ + --instance-mapping "my-instance::my-product::1.0" \ + --folder.mapping "my-folder::my-product::1.0" +``` + +### Usage ```bash -usage: platforms [options] discover [options] jenkins [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] - [--url URL] [--broad] - [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] - [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] [--jobs.skip] - [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] - [--scope.job_runs.analyzed_logs] [--job_runs.skip] +usage: platforms [options] discover [options] jenkins + [-h] [--instance INSTANCE] [--username USERNAME] + [--password PASSWORD] [--url URL] [--broad] + [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] + [--credential_stores.skip] [--users.skip] [--plugins.skip] + [--security_settings.skip] [--computer_set.skip] + [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] + [--scope.job_runs.past_days PAST_DAYS] + [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] + [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] + [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -516,33 +1051,65 @@ options: --username USERNAME Jenkins username (default: ) --password PASSWORD Jenkins token (JENKINS_PASSWORD) (default: ) --url URL Jenkins base URL (default: null) - --broad Perform a fast broad discovery instead of a detailed one (default: False) + --broad Perform a fast broad discovery instead of a + detailed one (default: False) --types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...] - Defines which asset to discover, scoped by scope parameters (default: ['all']) + Defines which asset to discover, scoped by + scope parameters (default: ['all']) --credential_stores.skip Skip credential stores (default: False) --users.skip Skip users (default: False) --plugins.skip Skip plugins (default: False) --security_settings.skip Skip security_settings (default: False) - --computer_set.skip Skip computer sets in discovery/evidence (default: False) + --computer_set.skip Skip computer sets in discovery/evidence + (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders - and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. - examples: folder-a* will discover all folders that are included in a root folder that starts with - folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: - JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all + folders. The folder scoping is defined as a + path of folders and can include the job name + in order to scope specific jobs. Wildcard is + supported only as a suffix. examples: + folder-a* will discover all folders that are + included in a root folder that starts with + folder-a. folder-a/* will discover all + folders and jobs under the root folder + folder-a (type: JenkinsFolderScope, default: + ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: - JenkinsFolderScope, default: []) + Jenkins folder/job list to exclude from + discovery. Format is like the --scope.folder + argument (type: JenkinsFolderScope, default: + []) --scope.job_runs.past_days PAST_DAYS - Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) + Number of past days to include in the job + run discovery, 0 for no time limit (type: + int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job - runs in the past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job + run discovery. This argument will limit the + number of job runs in the past_days range. 0 + for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs - Include analyzed job run logs (default: False) - --job_runs.skip Skip commits in discovery/evidence (default: False) + Include analyzed job run logs (default: + False) + --job_runs.skip Skip commits in discovery/evidence (default: + False) + --default_product_key_strategy {mapping} + Deferment product key by mapping. In the + future - we shall support by folder name + too. (default: mapping) + --instance-mapping [INSTANCE_MAPPING ...] + Instance product key mapping in the format + of *::product_key::product_version, + wildcards are supported (type: + AssetMappingString, default: []) + --folder.mapping [MAPPING ...] + Folder product key mapping in the format of + folder_path::product_key::product_version, + wildcards are supported (type: + AssetMappingString, default: []) ``` + diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index 7524b3c11..a62e98bdc 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -6,6 +6,9 @@ sidebar_position: 4 # The Evidence Command + +> **Note:** The `evidence` command is deprecated. Please use the `discover` command instead. + This command is used for uploading evidence, based on the assets discovered in the previous step, to the attestation store. This command is for creating platform evidence; creating SBOMs of assets such as DockerHub images is done through the `bom` command. @@ -20,31 +23,59 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] - [--max-threads MAX_THREADS] [--valint.scribe.client-id CLIENT_ID] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] - [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] - [--valint.label LABEL] [--unique] - {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket} ... - -Export evidence data +usage: platforms [options] evidence [-h] + [--evidence.local.path PATH] + [--evidence.local.prefix PREFIX] + [--evidence.local_only] + [--max-threads MAX_THREADS] + [--thread-timeout THREAD_TIMEOUT] + [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] + [--export-partial] + [--skip-evidence] + [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] + [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] + [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] + [--valint.attest ATTEST] + [--valint.sign] + [--valint.components COMPONENTS] + [--valint.label LABEL] + [--unique] + {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket} + ... + +Export evidence data (Deprecated) options: -h, --help Show this help message and exit. --evidence.local.path PATH - Local report export directory path (type: str, default: output) + Local report export directory path (type: + str, default: output) --evidence.local.prefix PREFIX - Local report export prefix (type: str, default: ) + Local report export prefix (type: str, + default: ) --evidence.local_only Only export local evidence (default: False) --max-threads MAX_THREADS - Number of threads used to run valint (type: int, default: 2) - --valint.scribe.client-id CLIENT_ID - Scribe client ID (type: str, default: ) + Main Pool max threads used to parallelize + evidence collection (type: int, default: 10) + --thread-timeout THREAD_TIMEOUT + Thread timeout in seconds (type: float, + default: 20.0) + --rate-limit-retry RATE_LIMIT_RETRY + Retry on rate limit (type: int, default: 3) + --allow-failures Allow failures without returning an error + code (default: False) + --export-partial Upload Partial Discover evidence (default: + False) + --skip-evidence Skip evidence upload (default: False) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable @@ -56,24 +87,33 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, + default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: + /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: factory) + Evidence product key (type: str, default: + factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, default: ) + Evidence product version (type: str, + default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) + Evidence predicate type (type: str, default: + http://scribesecurity.com/evidence/discovery + /v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: x509-env) + Evidence attest type (type: str, default: + x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f9f7325ca40>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7fd3675d0fe0>, default: []) --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument followed by --help. + For more details of each subcommand, add it as an argument + followed by --help. Available subcommands: gitlab @@ -87,45 +127,7 @@ subcommands: ``` - ## Gitlab Evidence Gitlab evidence supports the generation of organization evidence and project evidence. @@ -141,75 +143,63 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] - [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--organization.single] [--project.single] +usage: platforms [options] evidence [options] gitlab + [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,project,all}] + [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--organization.single] + [--project.single] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) - --url URL Gitlab base URL (default: https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) + (default: ) + --url URL Gitlab base URL (default: + https://gitlab.com/) --types {organization,project,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. + Default is all projects. Note that a project + name includes as a prefix its namesapce in + the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) - --pipeline.skip Skip pipeline in evidence (default: False) + --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or image names (default: mapping) + Override product key with namespace, pod or + image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the + format of to + organization::product_key::product_version + (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: + Project product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) --organization.single - Export all organizations in a single evidence (default: False) - --project.single Export all projects in a single evidence (default: False) + Export all organizations in a single + evidence (default: False) + --project.single Export all projects in a single evidence + (default: False) ``` - - ## Github Evidence Github evidence supports the generation of organization evidence and repository evidence. @@ -225,45 +215,64 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,repository,all,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--organization.single] - [--repository.single] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] github + [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,repository,all,all}] + [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--organization.single] + [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) - --url URL Github base URL (default: https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) + (default: ) + --url URL Github base URL (default: + https://github.com) --types {organization,repository,all,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by reopsitory name too. (default: - mapping) - --organization.single - Export all organizations in a single evidence (default: False) - --repository.single Export all repos in a single evidence (default: False) + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the - organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the + format of org::product_key::product_version + where org is the organization name, + wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) + --organization.single + Export all organizations in a single + evidence (default: False) + --repository.single Export all repos in a single evidence + (default: False) ``` @@ -282,24 +291,34 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANCE] - [--types {instance,token,repository,namespace,repository_tag,webhook,all}] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] - [--namespace.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] - [--namespace.single] [--repository.single] - [--default_product_key_strategy {mapping}] +usage: platforms [options] evidence [options] dockerhub + [-h] [--instance INSTANCE] + [--types {instance,token,repository,namespace,repository_tag,webhook,all}] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] + [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] + [--namespace.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--token.mapping [MAPPING ...]] [--namespace.single] + [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --types {instance,token,repository,namespace,repository_tag,webhook,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) + --username USERNAME Dockerhub username (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) + (default: null) + --token TOKEN Dockerhub token (default: null) + --url URL Dockerhub base URL (default: + https://hub.docker.com) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -307,53 +326,36 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude (default: []) + Dockerhub repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --namespace.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) --token.mapping [MAPPING ...] - Repository tag product key mapping in the format of asset::product_key::product_version (type: + Repository tag product key mapping in the + format of + asset::product_key::product_version (type: AssetMappingString, default: []) - --namespace.single Export all namespaces in a single evidence (default: False) - --repository.single Export all repositories in a single evidence (default: False) - --default_product_key_strategy {mapping} - Override product key with namespace, repository or image names (default: mapping) + --namespace.single Export all namespaces in a single evidence + (default: False) + --repository.single Export all repositories in a single evidence + (default: False) + --default_product_key_strategy {mapping,mapping,mapping,mapping} + Override product key with namespace, + repository or image names (default: mapping) ``` - ## K8s Evidence K8s evidence generation supports the generation of namespace and pod evidence. Namespace evidence includes secrets metadata (if it was not scoped out) To generate evidence for a K8s cluster: @@ -368,79 +370,74 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] [--instance INSTANCE] [--types {namespace,pod,all}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] +usage: platforms [options] evidence [options] k8s [-h] + [--instance INSTANCE] + [--types {namespace,pod,all}] + [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] + [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] - [--secret.skip] [--namespace.single] [--pod.single] - [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] + [--secret.skip] + [--url URL] + [--token TOKEN] + [--namespace.single] + [--pod.single] + [--namespace.mapping [MAPPING ...]] + [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --types {namespace,pod,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list (default: ['*']) + Kubernetes namespaces wildcard list + (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: ['*']) + Kubernetes pods wildcard list (default: + ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: ['*']) - --ignore-state Filter out containers that are not running (default: False) + Kubernetes images wildcard list (default: + ['*']) + --ignore-state Filter out containers that are not running + (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process (default: []) + Namespaces to exclude from discovery process + (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process (default: []) + Pods to exclude from discovery process + (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process (default: []) + Images to exclude from discovery process + (default: []) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or image names (default: mapping) - --secret.skip Skip secrets information in the evidence (default: False) + Override product key with namespace, pod or + image names (default: mapping) + --secret.skip Skip secrets information in the evidence + (default: False) + --url URL Kubernetes API URL (required, default: ) + --token TOKEN Kubernetes token, with access to pods and + secrets (K8S_TOKEN) (default: ) --namespace.single Export all namespaces (default: False) - --pod.single Export all pods in a single evidence (default: False) + --pod.single Export all pods in a single evidence + (default: False) --namespace.mapping [MAPPING ...] - Namespace product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Namespace product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) --pod.mapping [MAPPING ...] - Pod product key mapping in the format of asset::product_key::product_version (type: + Pod product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) ``` - ## Jfrog evidence Jfrog evidence generation supports the generation of namespace and repository evidence. The evidence includes information about the repositories, tags, and access tokens. @@ -457,7 +454,10 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--types {instance,aws-account,repository,all}] +usage: platforms [options] evidence [options] ecr [-h] + [--instance INSTANCE] + [--url URL] + [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] @@ -465,15 +465,19 @@ usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [-- [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--aws-account.single] [--repository.single] + [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--aws-account.single] + [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) + --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -483,21 +487,29 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude (default: []) + ECR repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude (default: []) + ECR Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: + Repository image_tags product key mapping in + the format of + asset::product_key::product_version (type: AssetMappingString, default: []) - --aws-account.single Export all aws-account in a single evidence (default: False) - --repository.single Export all repositories in a single evidence (default: False) + --aws-account.single Export all aws-account in a single evidence + (default: False) + --repository.single Export all repositories in a single evidence + (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} - Override product key with aws-account, repository or image names (default: mapping) + Override product key with aws-account, + repository or image names (default: mapping) ``` @@ -517,7 +529,10 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--types {instance,aws-account,repository,all}] +usage: platforms [options] evidence [options] ecr [-h] + [--instance INSTANCE] + [--url URL] + [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] @@ -525,15 +540,19 @@ usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [-- [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--aws-account.single] [--repository.single] + [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--aws-account.single] + [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) + --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -543,21 +562,29 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude (default: []) + ECR repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude (default: []) + ECR Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository product key mapping in the format + of asset::product_key::product_version + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: + Repository image_tags product key mapping in + the format of + asset::product_key::product_version (type: AssetMappingString, default: []) - --aws-account.single Export all aws-account in a single evidence (default: False) - --repository.single Export all repositories in a single evidence (default: False) + --aws-account.single Export all aws-account in a single evidence + (default: False) + --repository.single Export all repositories in a single evidence + (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} - Override product key with aws-account, repository or image names (default: mapping) + Override product key with aws-account, + repository or image names (default: mapping) ``` @@ -577,51 +604,75 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket [-h] [--instance INSTANCE] - [--types {workspace,project,repository,all,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] - [--commit.skip] [--default_product_key_strategy {mapping}] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--workspace.single] - [--project.single] [--repository.single] +usage: platforms [options] evidence [options] bitbucket + [-h] [--instance INSTANCE] + [--types {workspace,project,repository,all,all}] + [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--default_product_key_strategy {mapping}] + [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--workspace.single] + [--project.single] [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --types {workspace,project,repository,all,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all + projects. Note that a project name includes + as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by reopsitory name too. (default: - mapping) + Deferment product key by mapping. In the + future - we shall support by reopsitory name + too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is - the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format + of workspace::product_key::product_version + where org is the workspace name, wildcards + are supported (type: AssetMappingString, + default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the - project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of + project::product_key::product_version where + org is the project name, wildcards are + supported (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) - --workspace.single Export all workspaces in a single evidence (default: False) - --project.single Export all projects in a single evidence (default: False) - --repository.single Export all repos in a single evidence (default: False) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) + --workspace.single Export all workspaces in a single evidence + (default: False) + --project.single Export all projects in a single evidence + (default: False) + --repository.single Export all repos in a single evidence + (default: False) ``` @@ -641,56 +692,81 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins [-h] [--instance INSTANCE] [--types {instance,folder,all,all}] - [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] [--jobs.skip] - [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] - [--scope.job_runs.analyzed_logs] [--job_runs.skip] - [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] - [--folder.mapping [MAPPING ...]] [--folder.single] +usage: platforms [options] evidence [options] jenkins + [-h] [--instance INSTANCE] + [--types {instance,folder,all,all}] + [--credential_stores.skip] [--users.skip] [--plugins.skip] + [--security_settings.skip] [--computer_set.skip] + [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] + [--scope.job_runs.past_days PAST_DAYS] + [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] + [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] + [--folder.mapping [MAPPING ...]] [--folder.single] options: -h, --help Show this help message and exit. --instance INSTANCE Jenkins instance string (default: ) --types {instance,folder,all,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --credential_stores.skip Skip credential stores (default: False) --users.skip Skip users (default: False) --plugins.skip Skip plugins (default: False) --security_settings.skip Skip security_settings (default: False) - --computer_set.skip Skip computer sets in discovery/evidence (default: False) + --computer_set.skip Skip computer sets in discovery/evidence + (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders - and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. - examples: folder-a* will discover all folders that are included in a root folder that starts with - folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: - JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all + folders. The folder scoping is defined as a + path of folders and can include the job name + in order to scope specific jobs. Wildcard is + supported only as a suffix. examples: + folder-a* will discover all folders that are + included in a root folder that starts with + folder-a. folder-a/* will discover all + folders and jobs under the root folder + folder-a (type: JenkinsFolderScope, default: + ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: - JenkinsFolderScope, default: []) + Jenkins folder/job list to exclude from + discovery. Format is like the --scope.folder + argument (type: JenkinsFolderScope, default: + []) --scope.job_runs.past_days PAST_DAYS - Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) + Number of past days to include in the job + run discovery, 0 for no time limit (type: + int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job - runs in the past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job + run discovery. This argument will limit the + number of job runs in the past_days range. 0 + for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs - Include analyzed job run logs (default: False) - --job_runs.skip Skip commits in discovery/evidence (default: False) + Include analyzed job run logs (default: + False) + --job_runs.skip Skip commits in discovery/evidence (default: + False) --default_product_key_strategy {mapping} - Determint product key by mapping. In the future - we shall support by folder name too. (default: - mapping) + Deferment product key by mapping. In the + future - we shall support by folder name + too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported - (type: AssetMappingString, default: []) + Instance product key mapping in the format + of *::product_key::product_version, + wildcards are supported (type: + AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are - supported (type: AssetMappingString, default: []) - --folder.single Export all repos in a single evidence (default: False) + Folder product key mapping in the format of + folder_path::product_key::product_version, + wildcards are supported (type: + AssetMappingString, default: []) + --folder.single Export all repos in a single evidence + (default: False) ``` diff --git a/docs/platforms/overview.md b/docs/platforms/overview.md index 813821e58..1b379a5e6 100644 --- a/docs/platforms/overview.md +++ b/docs/platforms/overview.md @@ -7,87 +7,94 @@ sidebar_position: 1 # Platforms: Scribe's Scanning and Policy Evaluation Engine ## What is `platforms`? -Platforms is a dockerized cli tool, that can be used to scan and evaluate policies on your infrastructure. It is a part of the Scribe suite of tools, which are designed to help you secure your software supply chain. +`platforms` is a Dockerized CLI tool designed to scan and evaluate policies on your infrastructure. It is part of the Scribe suite of tools, which aim to secure your software supply chain. -This version of `platforms` supports Gitlab, DockerHub, and K8s. Under construction, we have support for GitHub, Bitbucket, Jenkins, and AWS-ECR. +## Important Note +> The `evidence` command is deprecated and will be removed in future releases. All functionality is now included in the merged `discover` command. Users are encouraged to transition to this unified approach for consistency and expanded capabilities. [Learn how to migrate](#migration-guide-for-v0.3.0-and-above). -Key Features: +## Supported Platforms +- GitLab SCM and CI +- GitHub SCM and CI +- DockerHub Image Registry +- Kubernetes CD +- Bitbucket Cloud SCM and CI +- Bitbucket Data Center SCM and CI +- Jenkins CI +- AWS ECR Image Registry +- JFrog Artifactory Image Registry -* Discovery of assets +### Key Features +**Asset Discovery**: Identify resources in your infrastructure. -* Measuring security posture, activity, -and volume data of assets +**Security Posture Measurement**: Evaluate activity and volume data of assets. -* Powerful scoping and filtering capabilities +**Advanced Scoping and Filtering**: Customize views and focus on relevant data. -* Powerful capabilities to map assets to Scribe Products +**Asset-to-Product Mapping**: Align resources with Scribe products. -* Experimental: Extracting data from build logs. +**Experimental**: Extract data from build logs to gain deeper insights. ## Concepts ### Assets - -Assets are the resources that are being scanned. They can be anything from a docker image to a git repository. +Assets are the resources being scanned, such as Docker images or Git repositories. ### Products +Products are software solutions composed of multiple assets. For example, a simple application might include one code repository, one CI pipeline, and one Docker image. A complex application might span multiple repositories, pipelines, and Docker images, plus external assets like DockerHub images. -Products are software products that are made up of multiple assets. - -For Example: - -* A simple application may be made up of a single code repository and a single CI pipeline that generates a single docker image. - -* A complex application may be made up of multiple code repositories, multiple CI pipelines, and multiple docker images. It may also include external assets such as docker images from DockerHub. - -* The Product point of view serves the product-security team, while assets are the day-to-day concern of the development and operations teams. - -* Scribe's platform tool enables and helps users to map assets to products. +`platforms` helps users map assets to products, aligning day-to-day operations with product security goals. ### Mapping -Mapping is the process of mapping evidence or SBOMs to products. - -* Mapping can done in various ways, the simplest - to specify which assets belong to which products. +Mapping links evidence or SBOMs to products. The simplest approach is specifying which assets belong to which products. Advanced use cases include automated strategies, such as creating a Scribe Product for each Kubernetes namespace using the `--default_product_key_strategy` option. -* For some of the use cases, the mapping can be done automatically, for example - to create a Scribe Product for each K8s namespace. The mapping strategy is defined using the `--default_product_key_strategy` option, available in many sub-commands. - -> mapping is many to many relation, a single asset can be part of multiple products (e.g. a microservice) and a single product can have multiple assets (e.g. a product that consists of multiple microservices). +> Mapping is a many-to-many relationship: an asset can belong to multiple products (e.g., a microservice), and a product can include multiple assets. ### Evidence +Evidence is data generated from assets, such as metadata from source code repositories, SBOMs for Docker images, or secrets metadata for Kubernetes clusters. Evidence is stored in an attestation store (default: ScribeHub, but local and OCI storage options are also supported). -Evidence is the data that is generated from the assets. It can be anything from metadata and settings of source-code-repo, an SBOM of a docker image, or a list of secrets metadata of a K8s cluster. - -> To secure the evidence from being falsified, tampered with, or denied, attestations can be signed. Scribe tools provide the capability to sign the evidence using various signing mechanisms (PKI, Sigstore) +> Attestations can be signed for integrity and authenticity using PKI or Sigstore mechanisms. ### Discovery +Discovery involves sampling asset data from various sources. The input is resource access data and scoping details, and the output is evidence generated from sampled data. -Discovery is the process of sampling asset data from various sources. - -* The input to the discovery process is access data to the resources and scoping information. - -* The output of the discovery process is an internal database of assets. - -### Evidence Generation - -Evidence generation is the process of generating evidence from the assets sampled data. +### SBOM Generation +Automates the generation of SBOMs for assets at scale. A common use case involves automating SBOM creation and analysis for an entire Kubernetes cluster or for all images across a set of Artifactory registries. -* The input to the evidence-generation process is the internal database of assets, scoping, and product mapping information. +* **Image SBOM**: Currently supported platforms include DockerHub, ECR, JFrog Artifactory, and Kubernetes clusters. +* **Source SBOM**: Currently supported platforms include GitHub, GitLab, and Bitbucket. -* The output of the evidence generation process is a set of evidence uploaded to an attestation store, which by default is ScribeHub. +### Policy Evaluation +Policy evaluation assesses evidence against defined policies using Scribe's policy-as-code framework. It includes out-of-the-box policies and custom policy creation. For example, evaluating source code repositories for limited admin access, secret expiration, and PR review requirements. -### SBOM Generation +> Output: Policy results in SARIF format. -Automation of SBOM Generation of assets. +### Migration Guide for `v0.3.0` and Above +If you are using `platforms` versions below `v0.3.0`, the `evidence` command needs to be migrated to the `discover` command instead. -* This capability enables users to generate SBOMs on scale, and to focus on the in-production assets, thus enabling the security teams to focus on the most critical assets. +For Example, previously you may have used: -> Currently, we support generating SBOMs of DockerHub accounts and K8s clusters. +```bash +platforms discover github \ + --scope.organization=scribe-security + --scope.repository *mongo* *example_repo + --workflow.skip --commit.skip --scope.branch=main +platforms evidence github \ + --organization.mapping=scribe-security::example_repo::v1 + --repository.mapping=scribe-security*example_repo::example_repo::v1 +``` -### Policy Evaluation +With `v0.3.0` or above, you should update to: -Policy evaluation is the process of evaluating policies on the evidence generated. +```bash +platforms discover github \ + --scope.organization=scribe-security + --scope.repository *mongo* *example_repo + --workflow.skip --commit.skip --scope.branch=main + --organization.mapping=scribe-security::example_repo::v1 + --repository.mapping=scribe-security*example_repo::example_repo::v1 +``` -* Scribe provides a policy-as-code framework, which provides users with out-of-the-box policies and the ability to write custom policies. +> Note: Asset `single` flags are no longer supported. -* Policies are applied to evidence; the policy evaluation process involves pulling the relevant attestations from the attestation store and evaluating the policies on the evidence. For example, to verify the security of a source-code repo, the policy evaluation process will consume evidence about the repo and the account, and evaluate policies such as "limited admins", "all secrets have an expiration date", "at least 2 reviewers are required for merging a PR", etc. +> Note: To disable evidence export from discover command run `platforms discover --skip-evidence ...`. \ No newline at end of file diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index 57f34632f..ee823cdba 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -35,16 +35,19 @@ platforms [global-options] command [command options] platform [platform options] * The global `options` are the global options that apply to all the commands. * The `command` is the action that you want to perform. It can be one of the following: * `discover`: To discover assets. - * `evidence`: To generate evidence. + * `evidence`: To generate evidence (**deprecated** use `discover` command instead). * `bom`: To generate SBOMs. * `verify`: To evaluate policies. * command options are the options that apply to the command. * platform is the platform on which you want to act. It can be one of the following: - * `gitlab`: To act on Gitlab or Gitlab evidence. - * `dockerhub`: To act on DockerHub, Dockerhub images, or Dockerhub evidence. - * `k8s`: To perform the action on K8s or K8s evidence. - * `jfrog`: To act on Jfrog, Jfrog images, or Jfrog evidence. - * `ecr`: To act on ECR, ECR images, or ECR evidence. + * `github`: Act on GitHub SCM and CI pipelines. + * `gitlab`: Act on GitLab SCM and CI pipelines. + * `dockerhub`: Act on DockerHub images. + * `k8s`: Act on Kubernetes deployments. + * `jfrog`: Act on JFrog, Artifactory images. + * `ecr`: Act on ECR images. + * `bitbucket`: Act on Bitbucket SCM and CI pipelines. + * `jenkins`: Act on Jenkins CI pipelines. * `platforms` options are the options that apply to the platform. Most of the platform-specific options are for scoping, filtering, and mapping assets to products. @@ -58,26 +61,32 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}] +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] + [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... -CLI tool for interacting with platforms APIs +CLI tool for collecting evidence and enforcing policies via CI/CD +platform APIs options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all other arguments and exit. The optional flags customizes the - output and are one or more keywords separated by comma. The supported flags are: comments, - skip_default, skip_null. - --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL} + Print the configuration after applying all + other arguments and exit. The optional flags + customizes the output and are one or more + keywords separated by comma. The supported + flags are: comments, skip_default, + skip_null. + --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) --db.local.path PATH Local db path (default: platforms.db) subcommands: - For more details of each subcommand, add it as an argument followed by --help. + For more details of each subcommand, add it as an argument + followed by --help. Available subcommands: discover diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 2e045beae..97232c00c 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,24 +19,35 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] [--valint.scribe.client-id CLIENT_ID] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] - [--valint.label LABEL] [--unique] [--valint.bundle BUNDLE] - [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] - [--valint.bundle-commit BUNDLE_COMMIT] [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] +usage: platforms [options] verify [-h] + [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] + [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] + [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] + [--valint.attest ATTEST] + [--valint.sign] + [--valint.components COMPONENTS] + [--valint.label LABEL] [--unique] + [--valint.bundle BUNDLE] + [--valint.bundle-auth BUNDLE_AUTH] + [--valint.bundle-branch BUNDLE_BRANCH] + [--valint.bundle-commit BUNDLE_COMMIT] + [--valint.bundle-tag BUNDLE_TAG] + [--allow-failures] [--max-threads MAX_THREADS] - {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} ... + {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} + ... Verify supply chain policies options: -h, --help Show this help message and exit. - --valint.scribe.client-id CLIENT_ID - Scribe client ID (type: str, default: ) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable @@ -48,37 +59,49 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, + default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: + /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: factory) + Evidence product key (type: str, default: + factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, default: ) + Evidence product version (type: str, + default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) + Evidence predicate type (type: str, default: + http://scribesecurity.com/evidence/discovery + /v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: x509-env) + Evidence attest type (type: str, default: + x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fc9d52013a0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f6801539a80>, default: []) --unique Allow unique assets (default: False) --valint.bundle BUNDLE Set bundle git branch (type: str, default: ) --valint.bundle-auth BUNDLE_AUTH Set bundle git auth (type: str, default: ) --valint.bundle-branch BUNDLE_BRANCH - Set bundle git branch (type: str, default: main) + Set bundle git branch (type: str, default: + main) --valint.bundle-commit BUNDLE_COMMIT Set bundle git commit (type: str, default: ) --valint.bundle-tag BUNDLE_TAG Set bundle git tag (type: str, default: ) - --allow-failures Allow failures without returning an error code (default: False) + --allow-failures Allow failures without returning an error + code (default: False) --max-threads MAX_THREADS - Number of threads used to run valint (type: int, default: 2) + Number of threads used to run valint (type: + int, default: 10) subcommands: - For more details of each subcommand, add it as an argument followed by --help. + For more details of each subcommand, add it as an argument + followed by --help. Available subcommands: k8s @@ -147,46 +170,68 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] +usage: platforms [options] verify [options] gitlab [-h] + [--instance INSTANCE] + [--token TOKEN] + [--url URL] [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--project.policy [POLICY ...]] [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] + [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] + [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] + [--commit.skip] + [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] + [--project.policy [POLICY ...]] + [--organization.policy [POLICY ...]] + [--org-policy-skip-aggregate] + [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) - --url URL Gitlab base URL (default: https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) + (default: ) + --url URL Gitlab base URL (default: + https://gitlab.com/) --types {organization,project,all} - Defines which evidence to consume, scoped by scope parameters (default: all) + Defines which evidence to consume, scoped by + scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. + Default is all projects. Note that a project + name includes as a prefix its namesapce in + the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the + format of to + organization::product_key::product_version + (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: + Project product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) --project.policy [POLICY ...] - Set project policy file (type: str, default: ['ct-2@discovery', 'ct-9@discovery']) + Set project policy file (type: str, default: + ['ct-2@discovery', 'ct-9@discovery']) --organization.policy [POLICY ...] - Set organization policy file (type: str, default: ['ct-1@discovery', 'ct-3@discovery', - 'ct-4@discovery']) + Set organization policy file (type: str, + default: ['ct-1@discovery', + 'ct-3@discovery', 'ct-4@discovery']) --org-policy-skip-aggregate - Skip Aggregate organization policy results (default: False) + Skip Aggregate organization policy results + (default: False) --project-policy-skip-aggregate - Skip Aggregate project policy results (default: False) + Skip Aggregate project policy results + (default: False) ``` @@ -204,51 +249,73 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] +usage: platforms [options] verify [options] github [-h] + [--instance INSTANCE] + [--token TOKEN] + [--url URL] [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--organization.single] [--repository.single] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] + [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] + [--branch.shallow] + [--commit.skip] + [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--repository.policy [POLICY ...]] + [--organization.policy [POLICY ...]] + [--org-policy-skip-aggregate] + [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) - --url URL Github base URL (default: https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) + (default: ) + --url URL Github base URL (default: + https://github.com) --types {organization,repository,all} - Defines which evidence to validate, scoped by scope parameters (default: all) + Defines which evidence to validate, scoped + by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: False) - --organization.single - Export all organizations in a single evidence (default: False) - --repository.single Export all repos in a single evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the - organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the + format of org::product_key::product_version + where org is the organization name, + wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) --repository.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) + Set repository evidence policy file (type: + str, default: []) --organization.policy [POLICY ...] - Set organization evidence policy file (type: str, default: ['ct-1@discovery']) + Set organization evidence policy file (type: + str, default: ['ct-1@discovery']) --org-policy-skip-aggregate - Skip Aggregate organization policy results (default: False) + Skip Aggregate organization policy results + (default: False) --repo-policy-skip-aggregate - Skip Aggregate repo policy results (default: False) + Skip Aggregate repo policy results (default: + False) ``` @@ -265,31 +332,39 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] - [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] - [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] - [--image.policy [POLICY ...]] [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub + [-h] [--instance INSTANCE] [--username USERNAME] + [--password PASSWORD] [--token TOKEN] [--url URL] + [--types {token,repository,namespace,all}] + [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] + [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] + [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] + [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: ) - --token TOKEN Dockerhub token (default: ) - --url URL Dockerhub base URL (default: https://hub.docker.com) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) + (default: null) + --token TOKEN Dockerhub token (default: null) + --url URL Dockerhub base URL (default: + https://hub.docker.com) --types {token,repository,namespace,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --default_product_key_strategy {namespace,repository,tag,mapping} - Override product key with namespace, repository or image names (default: mapping) + Override product key with namespace, + repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image id (default: short_image_id) + Override product version with tag or image + id (default: short_image_id) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -297,19 +372,24 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude (default: []) + Dockerhub repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: + Image product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', - 'ct-12@discovery', 'ct-13@discovery']) + Set image mapping policy file (type: str, + default: ['ct-8@discovery', + 'ct-11@discovery', 'ct-12@discovery', + 'ct-13@discovery']) --policy-skip-aggregate - Skip Aggregate policy results (default: False) + Skip Aggregate policy results (default: + False) ``` @@ -346,53 +426,81 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] [--instance INSTANCE] [--url URL] [--token TOKEN] +usage: platforms [options] verify [options] k8s [-h] + [--instance INSTANCE] + [--url URL] + [--token TOKEN] [--types {namespace,pod,cluster-images,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] - [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] - [--namespace.policy [POLICY ...]] [--policy-skip-aggregate] + [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] + [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] + [--namespace.single] + [--pod.single] + [--image.mapping [MAPPING ...]] + [--cluster-images.policy [POLICY ...]] + [--namespace.policy [POLICY ...]] + [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and + secrets (K8S_TOKEN) (default: ) --types {namespace,pod,cluster-images,all} - Defines which evidence to create, scoped by scope parameters (default: cluster-images) + Defines which evidence to create, scoped by + scope parameters (default: cluster-images) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or image names (default: mapping) + Override product key with namespace, pod or + image names (default: mapping) --default_product_version_strategy {namespace_hash,pod_hash,image_id} - Override product version with namespace, pod or image names (default: namespace_hash) + Override product version with namespace, pod + or image names (default: namespace_hash) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list (default: ['*']) + Kubernetes namespaces wildcard list + (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: ['*']) + Kubernetes pods wildcard list (default: + ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: ['*']) - --ignore-state Filter out containers that are not running (default: False) + Kubernetes images wildcard list (default: + ['*']) + --ignore-state Filter out containers that are not running + (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process (default: []) + Namespaces to exclude from discovery process + (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process (default: []) + Pods to exclude from discovery process + (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process (default: []) + Images to exclude from discovery process + (default: []) --namespace.single Export all namespaces (default: False) - --pod.single Export all pods in a single evidence (default: False) + --pod.single Export all pods in a single evidence + (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- - image:product_key:product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to + product_key:product_version mappinge.g. my- + namespace;my-pod;my- + image:product_key:product_version (type: + K8sImageMappingString, default: []) --cluster-images.policy [POLICY ...] - Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', - 'ct-13@discovery']) + Set image policy file (type: str, default: + ['ct-8@discovery', 'ct-11@discovery', + 'ct-12@discovery', 'ct-13@discovery']) --namespace.policy [POLICY ...] - Set Kubernetes policy file (type: str, default: []) + Set Kubernetes policy file (type: str, + default: []) --policy-skip-aggregate - Skip Aggregate policy results (default: False) + Skip Aggregate policy results (default: + False) ``` @@ -434,7 +542,10 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] +usage: platforms [options] verify [options] jfrog [-h] + [--instance INSTANCE] + [--jf_token JF_TOKEN] + [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] @@ -445,20 +556,24 @@ usage: platforms [options] verify [options] jfrog [-h] [--instance INSTANCE] [-- [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] + [--image.mapping [MAPPING ...]] + [--image.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Jfrog instance string (default: ) - --token TOKEN Jfrog token (JFROG_TOKEN) (default: ) - --url URL Jfrog base URL (default: null) + --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --url URL Jfrog base URL (default: ) --types {token,repository,jf-repository,all} - Defines which evidence to create, scoped by scope parameters (default: all) + Defines which evidence to create, scoped by + scope parameters (default: all) --default_product_key_strategy {jf-repository,repository,tag,mapping} - Override product key with jf-repository, repository or image names (default: mapping) + Override product key with jf-repository, + repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image id (default: short_image_id) + Override product version with tag or image + id (default: short_image_id) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -468,19 +583,25 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude (default: []) + Jfrog repository wildcards to exclude + (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude (default: []) + Jfrog Image repository wildcards to exclude + (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: + Image product key mapping in the format of + asset::product_key::product_version (type: AssetMappingString, default: []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', - 'ct-12@discovery', 'ct-13@discovery']) + Set image mapping policy file (type: str, + default: ['ct-8@discovery', + 'ct-11@discovery', 'ct-12@discovery', + 'ct-13@discovery']) --policy-skip-aggregate - Skip Aggregate policy results (default: False) + Skip Aggregate policy results (default: + False) ``` @@ -498,67 +619,98 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] - [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] - [--types {workspace,project,repository,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] - [--commit.skip] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] [--project.policy [POLICY ...]] - [--workspace.policy [POLICY ...]] [--org-policy-skip-aggregate] - [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] bitbucket + [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] + [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] [--url URL] + [--types {workspace,project,repository,all}] + [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] + [--repository.policy [POLICY ...]] + [--project.policy [POLICY ...]] + [--workspace.policy [POLICY ...]] + [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) (default: ) + BitBucket app_password (BB_PASSWORD) + (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and - --username (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with + --workspace_name flag instead of + --app_password and --username + (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and - --username (default: ) - --url URL BitBucket URL (required, default: https://api.bitbucket.org) + BitBucket workspace_name can be used with + --workspace_token flag instead of + --app_password and --username (default: ) + --url URL BitBucket URL (required, default: + https://api.bitbucket.org) --types {workspace,project,repository,all} - Defines which evidence to validate, scoped by scope parameters (default: all) + Defines which evidence to validate, scoped + by scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix - its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all + projects. Note that a project name includes + as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a - prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is + all projects. Note that a project name + includes as a prefix its namesapce in the + format 'namespace / project_name' (default: + ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: False) + --commit.skip Skip commits in discovery/evidence (default: + False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is - the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format + of workspace::product_key::product_version + where org is the workspace name, wildcards + are supported (type: AssetMappingString, + default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the - project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of + project::product_key::product_version where + org is the project name, wildcards are + supported (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the - repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format + of repo::product_key::product_version where + repo is the repository name, wildcards are + supported (type: AssetMappingString, + default: []) --repository.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) + Set repository evidence policy file (type: + str, default: []) --project.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) + Set repository evidence policy file (type: + str, default: []) --workspace.policy [POLICY ...] - Set workspace evidence policy file (type: str, default: []) + Set workspace evidence policy file (type: + str, default: []) --org-policy-skip-aggregate - Skip Aggregate workspace policy results (default: False) + Skip Aggregate workspace policy results + (default: False) --repo-policy-skip-aggregate - Skip Aggregate repo policy results (default: False) + Skip Aggregate repo policy results (default: + False) ``` From 63e10fd2681658f5c217208a219f308c115d850d Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 10:14:57 +0200 Subject: [PATCH 049/191] valint docs --- docs/valint/help/valint.md | 1 + docs/valint/help/valint_bom.md | 14 ++++---------- docs/valint/help/valint_discard.md | 1 + docs/valint/help/valint_download.md | 1 + docs/valint/help/valint_evidence.md | 3 ++- docs/valint/help/valint_list.md | 1 + docs/valint/help/valint_slsa.md | 3 ++- docs/valint/help/valint_verify.md | 2 ++ 8 files changed, 14 insertions(+), 12 deletions(-) diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index 7d347567e..3e3ac539a 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,6 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 1aa30a353..7c722c24d 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -22,9 +22,10 @@ Flags for `bom` subcommand | | --author-email | Set author email | | | | --author-name | Set author name | | | | --author-phone | Set author phone | | +| | --base-image | Base image for the target | | | | --ca | x509 CA Chain path | | | | --cert | x509 Cert path | | -| | --components | Select sbom components groups, options=[metadata layers packages syft files dep commits] | [metadata,layers,packages,syft,dep,commits] | +| | --components | Select sbom components groups, options=[metadata layers packages syft files dep commits base_image] | [metadata,layers,packages,syft,dep,commits] | | | --crl | x509 CRL path | | | | --crl-full-chain | Enable Full chain CRL verfication | | | | --depth | Git clone depth | | @@ -32,7 +33,7 @@ Flags for `bom` subcommand | -F | --filter-regex | Filter out files by regex | [**/*.pyc,**/.git/**] | | | --filter-scope | Filter packages by scope | | | -f | --force | Force overwrite cache | | -| -o | --format | Evidence format, options=[cyclonedx-json cyclonedx-xml attest-cyclonedx-json statement-cyclonedx-json attest-slsa statement-slsa statement-generic attest-generic] | | +| -o | --format | Evidence format, options=[json statement attest] | | | | --git-auth | Git repository authentication info, [format: 'username:password'] | | | | --git-branch | Git branch in the repository | | | | --git-commit | Git commit hash in the repository | | @@ -68,6 +69,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | @@ -122,17 +124,9 @@ Flags for all `valint` subcommands valint bom alpine:latest -o attest valint bom alpine:latest -o statement - SLSA-Example: - valint bom alpine:latest -o attest-slsa - valint bom alpine:latest -o statement-slsa - - Generic-Example: - valint bom file.json -o attest-slsa - valint bom file.json -o statement-slsa Format-aliases: * json=attest-cyclonedx-json - * predicate=predicate-cyclonedx-json * statement=statement-cyclonedx-json * attest=attest-cyclonedx-json diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index 628987794..cb63e2dc0 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,6 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index cc8a12a5d..10ba8620b 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,6 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index 5039090fe..8c5bc57f5 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -53,6 +53,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | @@ -81,7 +82,6 @@ Flags for all `valint` subcommands valint evidence File Path to add as evidence - valint evidence file.json Attach a file as evidence valint evidence file.json -o attest Sign evidence valint evidence file.json --tool my_tool --tool-version 0.0.1 --vendor="My Company Inc" Customize tool information @@ -89,6 +89,7 @@ Flags for all `valint` subcommands valint evidence file.json --predicate-type https:/my_company.com/my_predicate/v1 Customize predicate type valint evidence file.json --compress Compress content valint evidence file.json --parser trivy Select Supported Report Parser + valint evidence --file trivy:report.json --file semgrep:./report.semgrep.json Multiple file mapping Supported Parsers: * acunetix diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index 830fc3bb8..687e9fb4a 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,6 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index 533cd6aad..0df902a36 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -24,7 +24,7 @@ Flags for `slsa` subcommand | | --by-product | Attach by product path | | | | --ca | x509 CA Chain path | | | | --cert | x509 Cert path | | -| | --components | Select by products components groups, options=[metadata layers packages syft files dep commits] | [metadata,layers] | +| | --components | Select by products components groups, options=[metadata layers packages syft files dep commits base_image] | [metadata,layers] | | | --crl | x509 CRL path | | | | --crl-full-chain | Enable Full chain CRL verfication | | | | --depth | Git clone depth | | @@ -64,6 +64,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index e0814f8d8..f4bd6453f 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -19,6 +19,7 @@ Flags for `verify` subcommand | | --attest.config | Attestation config path | | | | --attest.default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | | | -a | --attestation | Attestation for target | | +| | --base-image | Base image for the target | | | | --bom | Create target SBOM evidence | | | | --bundle | Policy bundle uri/path (early-availability) | "https://github.com/scribe-public/sample-policies" | | | --bundle-auth | Bundle repository authentication info, [format: 'username:password'] | | @@ -74,6 +75,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From c474f8142c57ae3da52ade56038147d02ed68f94 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 10:33:58 +0200 Subject: [PATCH 050/191] mend wait_all --- .../ci-integrations/github/action-bom.md | 8 ++++++-- .../ci-integrations/github/action-evidence.md | 2 ++ .../ci-integrations/github/action-slsa.md | 6 ++++-- .../ci-integrations/github/action-verify.md | 6 ++++++ 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 2eeeed82f..1840ceb68 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -48,12 +48,14 @@ To overcome the limitation install tool directly - **[installer](https://github. description: Set author name author-phone: description: Set author phone + base-image: + description: Base image for the target ca: description: x509 CA Chain path cert: description: x509 Cert path components: - description: Select sbom components groups, options=[metadata layers packages syft files dep commits] + description: Select sbom components groups, options=[metadata layers packages syft files dep commits base_image] crl: description: x509 CRL path crl-full-chain: @@ -69,7 +71,7 @@ To overcome the limitation install tool directly - **[installer](https://github. force: description: Force overwrite cache format: - description: Evidence format, options=[cyclonedx-json cyclonedx-xml attest-cyclonedx-json statement-cyclonedx-json attest-slsa statement-slsa statement-generic attest-generic] + description: Evidence format, options=[json statement attest] git-auth: description: 'Git repository authentication info, [format: ''username:password'']' git-branch: @@ -120,6 +122,8 @@ To overcome the limitation install tool directly - **[installer](https://github. description: Environment keys to include in evidence gate: description: Policy Gate name + input: + description: Input Evidence target, format (: or ::) label: description: Add Custom labels level: diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index cc758f7cf..0c2ee4b42 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -87,6 +87,8 @@ The `valint evidence` action is a versatile action designed to include various t description: Environment keys to include in evidence gate: description: Policy Gate name + input: + description: Input Evidence target, format (: or ::) label: description: Add Custom labels level: diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 43462a0be..6a6c9189f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -47,7 +47,7 @@ To overcome the limitation install tool directly - [installer](https://github.co cert: description: x509 Cert path components: - description: Select by products components groups, options=[metadata layers packages syft files dep commits] + description: Select by products components groups, options=[metadata layers packages syft files dep commits base_image] crl: description: x509 CRL path crl-full-chain: @@ -106,6 +106,8 @@ To overcome the limitation install tool directly - [installer](https://github.co description: Environment keys to include in evidence gate: description: Policy Gate name + input: + description: Input Evidence target, format (: or ::) label: description: Add Custom labels level: @@ -143,7 +145,7 @@ To overcome the limitation install tool directly - [installer](https://github.co description: Timeout duration verbose: description: Log verbosity level [-v,--verbose=1] = info, [-vv,--verbose=2] = debug -``` +`` ### Output arguments ```yaml diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index f6d3e8943..53ca80cf6 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -31,6 +31,8 @@ The command allows users to verify any target against its evidence. description: Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] attestation: description: Attestation for target + base-image: + description: Base image for the target bom: description: Create target SBOM evidence bundle: @@ -87,6 +89,8 @@ The command allows users to verify any target against its evidence. description: Select OCI custom attestation repo pass: description: Private key password + payload: + description: path of the decoded payload platform: description: Select target platform, examples=windows/armv6, arm64 ..) policy: @@ -119,6 +123,8 @@ The command allows users to verify any target against its evidence. description: Environment keys to include in evidence gate: description: Policy Gate name + input: + description: Input Evidence target, format (: or ::) label: description: Add Custom labels level: From 4cd9e14c567539120db3f2385da7ed0818d104c5 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 10:35:26 +0200 Subject: [PATCH 051/191] update docs --- docs/platforms/bom.md | 415 +++++++-------------- docs/platforms/discover.md | 733 ++++++++++++------------------------- docs/platforms/evidence.md | 571 ++++++++++------------------- docs/platforms/usage.md | 17 +- docs/platforms/verify.md | 469 ++++++++---------------- 5 files changed, 707 insertions(+), 1498 deletions(-) diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index db8a0f349..881267b0d 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,49 +16,30 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] - [--save-scan-plan] [--dry-run] - [--monitor.mount MOUNT] - [--monitor.threshold THRESHOLD] - [--monitor.clean-docker] - [--max-threads MAX_THREADS] - [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] - [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] - [--valint.sign] - [--valint.components COMPONENTS] - [--valint.label LABEL] [--unique] - {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket} - ... +usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] + [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] + [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] + [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] + {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket} ... Export bom data options: -h, --help Show this help message and exit. - --allow-failures Allow failures without returning an error - code (default: False) + --allow-failures Allow failures without returning an error code (default: False) --save-scan-plan Save scan plan (default: False) --dry-run Dry run (default: False) --monitor.mount MOUNT - Monitor disk usage - mount path (type: str, - default: ) + Monitor disk usage - mount path (type: str, default: ) --monitor.threshold THRESHOLD - Monitor disk usage - threshold (type: int, - default: 90) + Monitor disk usage - threshold (type: int, default: 90) --monitor.clean-docker - Monitor disk usage - auto clean docker cache - (default: False) + Monitor disk usage - auto clean docker cache (default: False) --max-threads MAX_THREADS - Number of threads used to run valint (type: - int, default: 10) + Number of threads used to run valint (type: int, default: 10) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable @@ -70,33 +51,24 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, - default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: - /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: - factory) + Evidence product key (type: str, default: factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, - default: ) + Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: - http://scribesecurity.com/evidence/discovery - /v0.1) + Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: - x509-env) + Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fb6e02bfba0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f87d11a4040>, default: []) --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument - followed by --help. + For more details of each subcommand, add it as an argument followed by --help. Available subcommands: gitlab @@ -170,37 +142,25 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] - [--instance INSTANCE] - [--username USERNAME] - [--password PASSWORD] - [--token TOKEN] - [--url URL] - [--default_product_key_strategy {namespace,repository,tag,mapping}] +usage: platforms [options] bom [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] + [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) - (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) - --url URL Dockerhub base URL (default: - https://hub.docker.com) + --url URL Dockerhub base URL (default: https://hub.docker.com) --default_product_key_strategy {namespace,repository,tag,mapping} - Override product key with namespace, - repository or image names (default: mapping) + Override product key with namespace, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image - id (default: short_image_id) + Override product version with tag or image id (default: short_image_id) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -208,16 +168,14 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude - (default: []) + Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) ``` @@ -263,63 +221,40 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] - [--instance INSTANCE] - [--url URL] - [--token TOKEN] - [--types {namespace,pod,all}] +usage: platforms [options] bom [options] k8s [-h] [--instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] - [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] - [--image.mapping [MAPPING ...]] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] + [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and - secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --types {namespace,pod,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) --default_product_version_strategy {namespace_hash,pod_hash,image_id} - Override product version with namespace, pod - or image names (default: namespace_hash) + Override product version with namespace, pod or image names (default: namespace_hash) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list - (default: ['*']) + Kubernetes namespaces wildcard list (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: - ['*']) + Kubernetes pods wildcard list (default: ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: - ['*']) - --ignore-state Filter out containers that are not running - (default: False) + Kubernetes images wildcard list (default: ['*']) + --ignore-state Filter out containers that are not running (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process - (default: []) + Namespaces to exclude from discovery process (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process - (default: []) + Pods to exclude from discovery process (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process - (default: []) + Images to exclude from discovery process (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to - product_key:product_version mappinge.g. my- - namespace;my-pod;my- - image:product_key:product_version (type: - K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- + image:product_key:product_version (type: K8sImageMappingString, default: []) ``` @@ -365,19 +300,13 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] - [--instance INSTANCE] - [--jf_token JF_TOKEN] - [--url URL] +usage: platforms [options] bom [options] jfrog [-h] [--instance INSTANCE] [--jf_token JF_TOKEN] [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] + [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] options: @@ -386,11 +315,9 @@ options: --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --default_product_key_strategy {jf-repository,repository,tag,mapping} - Override product key with jf-repository, - repository or image names (default: mapping) + Override product key with jf-repository, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image - id (default: short_image_id) + Override product version with tag or image id (default: short_image_id) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -400,17 +327,14 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude - (default: []) + Jfrog repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude - (default: []) + Jfrog Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) ``` @@ -430,25 +354,18 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] - [--instance INSTANCE] +usage: platforms [options] bom [options] ecr [-h] [--instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] - [--scope.aws-account [AWS_ACCOUNT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--url URL] - [--image.mapping [MAPPING ...]] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) --default_product_key_strategy {aws-account,repository,tag,mapping} - Override product key with aws-account, - repository or image names (default: mapping) + Override product key with aws-account, repository or image names (default: mapping) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -458,18 +375,15 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude - (default: []) + ECR repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude - (default: []) + ECR Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --url URL ECR base URL (default: null) --image.mapping [MAPPING ...] - Image product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) ``` @@ -491,91 +405,56 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] - [--instance INSTANCE] - [--app_password APP_PASSWORD] - [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] - [--url URL] - [--types {repository,all}] - [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] - [--commit.skip] - [--default_product_key_strategy {mapping}] - [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] + [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) - (default: ) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with - --workspace_name flag instead of - --app_password and --username + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with - --workspace_token flag instead of - --app_password and --username (default: ) - --url URL BitBucket URL (required, default: - https://api.bitbucket.org) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: + ) + --url URL BitBucket URL (required, default: https://api.bitbucket.org) --types {repository,all} - Specifies the type of evidence to generate, - scoped by scope parameters (default: - repository) + Specifies the type of evidence to generate, scoped by scope parameters (default: repository) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all - projects. Note that a project name includes - as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format - of workspace::product_key::product_version - where org is the workspace name, wildcards - are supported (type: AssetMappingString, - default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace + name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of - project::product_key::product_version where - org is the project name, wildcards are - supported (type: AssetMappingString, - default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, + wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) ``` @@ -597,63 +476,38 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] - [--instance INSTANCE] - [--token TOKEN] - [--url URL] - [--types {repository,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] - [--branch.shallow] - [--commit.skip] - [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] +usage: platforms [options] bom [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) - (default: ) - --url URL Github base URL (default: - https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) + --url URL Github base URL (default: https://github.com) --types {repository,all} - Specifies the type of evidence to generate, - scoped by scope parameters (default: - repository) + Specifies the type of evidence to generate, scoped by scope parameters (default: repository) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of org::product_key::product_version - where org is the organization name, - wildcards are supported (type: - AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization + name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) ``` @@ -675,39 +529,24 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] - [--instance INSTANCE] - [--token TOKEN] - [--url URL] - [--types {project,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] - [--commit.skip] - [--pipeline.skip] - [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) - (default: ) - --url URL Gitlab base URL (default: - https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) + --url URL Gitlab base URL (default: https://gitlab.com/) --types {project,all} - Specifies the type of evidence to generate, - scoped by scope parameters (default: all) + Specifies the type of evidence to generate, scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. - Default is all projects. Note that a project - name includes as a prefix its namesapce in - the format 'namespace / project_name' - (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -715,16 +554,12 @@ options: --commit.skip Skip commits in evidence (default: False) --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of to - organization::product_key::product_version - (type: AssetMappingString, default: []) - --project.mapping [MAPPING ...] - Project product key mapping in the format of - asset::product_key::product_version (type: + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) ``` diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index 5e53e94ee..dc3f3a7b6 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -22,67 +22,39 @@ The evidence generation process uses Scribe's `valint` tool to upload and option --> ```bash -usage: platforms [options] discover [-h] - [--db.local.store_policy {update,replace}] - [--db.update_period UPDATE_PERIOD] - [--evidence.local.path PATH] - [--evidence.local.prefix PREFIX] - [--evidence.local_only] - [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] - [--rate-limit-retry RATE_LIMIT_RETRY] - [--allow-failures] - [--export-partial] - [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] - [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] - [--valint.sign] - [--valint.components COMPONENTS] - [--valint.label LABEL] - [--unique] - {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket} - ... +usage: platforms [options] discover [-h] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] + [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] + [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] + [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] + {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket} ... Discover assets and save data to a local store options: -h, --help Show this help message and exit. --db.local.store_policy {update,replace} - Policy for local data collection: update or - replace (default: update) + Policy for local data collection: update or replace (default: update) --db.update_period UPDATE_PERIOD - Update period in days. 0 for force update - (type: int, default: 0) + Update period in days. 0 for force update (type: int, default: 0) --evidence.local.path PATH - Local report export directory path (type: - str, default: output) + Local report export directory path (type: str, default: output) --evidence.local.prefix PREFIX - Local report export prefix (type: str, - default: ) + Local report export prefix (type: str, default: ) --evidence.local_only Only export local evidence (default: False) --max-threads MAX_THREADS - Main Pool max threads used to parallelize - evidence collection (type: int, default: - 2000) + Main Pool max threads used to parallelize evidence collection (type: int, default: 2000) --thread-timeout THREAD_TIMEOUT - Thread timeout in seconds (type: float, - default: 20.0) + Thread timeout in seconds (type: float, default: 20.0) --rate-limit-retry RATE_LIMIT_RETRY Retry on rate limit (type: int, default: 3) - --allow-failures Allow failures without returning an error - code (default: False) - --export-partial Upload Partial Discover evidence (default: - False) + --allow-failures Allow failures without returning an error code (default: False) + --export-partial Upload Partial Discover evidence (default: False) --skip-evidence Skip evidence upload (default: False) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) @@ -95,33 +67,24 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, - default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: - /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: - factory) + Evidence product key (type: str, default: factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, - default: ) + Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: - http://scribesecurity.com/evidence/discovery - /v0.1) + Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: - x509-env) + Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fe46efee980>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f9b0066ede0>, default: []) --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument - followed by --help. + For more details of each subcommand, add it as an argument followed by --help. Available subcommands: gitlab @@ -172,44 +135,32 @@ platforms discover gitlab \ --> ```bash -usage: platforms [options] discover [options] gitlab - [-h] [--instance INSTANCE] - [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] - [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] - [--token TOKEN] [--url URL] - [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] - [--scope.skip_org_members] [--scope.skip_project_members] - [--scope.commit.past_days PAST_DAYS] - [--scope.pipeline.past_days PAST_DAYS] - [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] - [--broad] [--organization.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--organization.single] - [--project.single] +usage: platforms [options] discover [options] gitlab [-h] [--instance INSTANCE] + [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] + [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] + [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] + [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] + [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--organization.single] [--project.single] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) --types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...] - Defines which asset types to exclude for - discovery. (default: []) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) - (default: ) - --url URL Gitlab base URL (default: - https://gitlab.com/) + Defines which asset types to exclude for discovery. (default: []) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) + --url URL Gitlab base URL (default: https://gitlab.com/) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. - Default is all projects. Note that a project - name includes as a prefix its namesapce in - the format 'namespace / project_name' - (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -217,42 +168,29 @@ options: --commit.skip Skip commits in evidence (default: False) --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) --scope.skip_org_members - Skip organization members discovery - (default: False) + Skip organization members discovery (default: False) --scope.skip_project_members - Skip project members discovery (default: - False) + Skip project members discovery (default: False) --scope.commit.past_days PAST_DAYS - Number of past days to include in the report - (type: int, default: 28) + Number of past days to include in the report (type: int, default: 28) --scope.pipeline.past_days PAST_DAYS - Number of past days to include in the report - (type: int, default: 30) + Number of past days to include in the report (type: int, default: 30) --scope.pipeline.analyzed_logs - Include analyzed pipeline logs (default: - False) + Include analyzed pipeline logs (default: False) --scope.pipeline.reports - Include gitlab standard reports (default: - False) - --broad Retrieves limited information (only - organizations and projects) (default: False) + Include gitlab standard reports (default: False) + --broad Retrieves limited information (only organizations and projects) (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of to - organization::product_key::product_version - (type: AssetMappingString, default: []) - --project.mapping [MAPPING ...] - Project product key mapping in the format of - asset::product_key::product_version (type: + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --organization.single - Export all organizations in a single - evidence (default: False) - --project.single Export all projects in a single evidence - (default: False) + Export all organizations in a single evidence (default: False) + --project.single Export all projects in a single evidence (default: False) ``` @@ -302,84 +240,55 @@ platforms discover github \ --> ```bash -usage: platforms [options] discover [options] github - [-h] [--instance INSTANCE] - [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] - [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] - [--token TOKEN] [--url URL] - [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] - [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] - [--scope.commit.past_days PAST_DAYS] [--workflow.skip] - [--scope.workflow.past_days PAST_DAYS] - [--scope.workflow.analyzed_logs] [--scope.runners] - [--scope.sbom] [--broad] - [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] +usage: platforms [options] discover [options] github [-h] [--instance INSTANCE] + [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] + [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] + [--workflow.skip] [--scope.workflow.past_days PAST_DAYS] + [--scope.workflow.analyzed_logs] [--scope.runners] [--scope.sbom] [--broad] + [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) --types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...] - Defines which asset types to exclude for - discovery. (default: []) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) - (default: ) - --url URL Github base URL (default: - https://github.com) + Defines which asset types to exclude for discovery. (default: []) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) + --url URL Github base URL (default: https://github.com) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --scope.commit.past_days PAST_DAYS - Number of past days to include in the report - (type: int, default: 30) + Number of past days to include in the report (type: int, default: 30) --workflow.skip Skip workflows in evidence (default: False) --scope.workflow.past_days PAST_DAYS - Number of past days to include in the report - (type: int, default: 30) + Number of past days to include in the report (type: int, default: 30) --scope.workflow.analyzed_logs - Include analyzed workflow logs (default: - False) - --scope.runners Include repository allocated runners in - evidence (default: False) - --scope.sbom Include repositories SBOM in evidence - (default: False) - --broad Retrieves limited information (only - organizations, repositories and workflows) - (default: False) + Include analyzed workflow logs (default: False) + --scope.runners Include repository allocated runners in evidence (default: False) + --scope.sbom Include repositories SBOM in evidence (default: False) + --broad Retrieves limited information (only organizations, repositories and workflows) (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of org::product_key::product_version - where org is the organization name, - wildcards are supported (type: - AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization + name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) ``` @@ -420,38 +329,31 @@ platforms discover dockerhub \ --> ```bash -usage: platforms [options] discover [options] dockerhub - [-h] [--instance INSTANCE] - [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] - [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] - [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--namespace-list [NAMESPACE_LIST ...]] - [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] - [--repository.single] [--namespace.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--token.mapping [MAPPING ...]] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] discover [options] dockerhub [-h] [--instance INSTANCE] + [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] + [--namespace.single] [--repository.single] [--namespace.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...] - Defines which asset types to exclude for - discovery. (default: []) + Defines which asset types to exclude for discovery. (default: []) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) - (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) - --url URL Dockerhub base URL (default: - https://hub.docker.com) + --url URL Dockerhub base URL (default: https://hub.docker.com) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -459,38 +361,27 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude - (default: []) + Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --namespace-list [NAMESPACE_LIST ...] List of namespaces (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to - this number of days (type: int, default: 30) - --broad Retrieves limited information (only - namespaces and repositories) (default: - False) - --namespace.single Export all namespaces in a single evidence - (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) + --broad Retrieves limited information (only namespaces and repositories) (default: False) + --namespace.single Export all namespaces in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --token.mapping [MAPPING ...] - Repository tag product key mapping in the - format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --default_product_key_strategy {mapping,mapping,mapping,mapping} - Override product key with namespace, - repository or image names (default: mapping) + Override product key with namespace, repository or image names (default: mapping) ``` @@ -527,78 +418,51 @@ platforms discover k8s \ --> ```bash -usage: platforms [options] discover [options] k8s [-h] - [--instance INSTANCE] +usage: platforms [options] discover [options] k8s [-h] [--instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] - [--url URL] - [--token TOKEN] - [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] - [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] - [--secret.skip] - [--deployment.skip] - [--broad] - [--namespace.single] - [--pod.single] - [--namespace.mapping [MAPPING ...]] - [--pod.mapping [MAPPING ...]] + [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] + [--deployment.skip] [--broad] [--namespace.single] [--pod.single] + [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...] - Defines which asset types to exclude for - discovery. (default: []) + Defines which asset types to exclude for discovery. (default: []) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and - secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list - (default: ['*']) + Kubernetes namespaces wildcard list (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: - ['*']) + Kubernetes pods wildcard list (default: ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: - ['*']) - --ignore-state Filter out containers that are not running - (default: False) + Kubernetes images wildcard list (default: ['*']) + --ignore-state Filter out containers that are not running (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process - (default: []) + Namespaces to exclude from discovery process (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process - (default: []) + Pods to exclude from discovery process (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process - (default: []) + Images to exclude from discovery process (default: []) --secret.skip Skip secrets discovery (default: False) --deployment.skip Skip deployments discovery (default: False) - --broad Retrieves limited information (only - namespaces and deployments) (default: False) + --broad Retrieves limited information (only namespaces and deployments) (default: False) --namespace.single Export all namespaces (default: False) - --pod.single Export all pods in a single evidence - (default: False) + --pod.single Export all pods in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Namespace product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --pod.mapping [MAPPING ...] - Pod product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) ``` @@ -648,38 +512,26 @@ platforms discover jfrog \ --> ```bash -usage: platforms [options] discover [options] jfrog [-h] - [--instance INSTANCE] +usage: platforms [options] discover [options] jfrog [-h] [--instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] - [--jf_token JF_TOKEN] - [--url URL] - [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--jf_token JF_TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] - [--scope.tag_limit TAG_LIMIT] - [--broad] - [--jf-repository.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--token.mapping [MAPPING ...]] - [--jf-repository.single] - [--repository.single] + [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] + [--scope.tag_limit TAG_LIMIT] [--broad] [--jf-repository.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] + [--jf-repository.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Jfrog instance string (default: ) --types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...] - Defines which asset types to exclude for - discovery. (default: []) + Defines which asset types to exclude for discovery. (default: []) --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --scope.jf-repository [JF_REPOSITORY ...] @@ -691,47 +543,31 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude - (default: []) + Jfrog repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude - (default: []) + Jfrog Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to - this number of days (type: int, default: 30) + Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be - discovered. Scoping to tag names is done on - the limited tag list. Limit applies also to - the past_days filter. 0 for no limit, - default is 10. (type: int, default: 20) - --broad Retrieves limited information (only jf- - repositories and repositories) (default: - False) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit + applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 20) + --broad Retrieves limited information (only jf-repositories and repositories) (default: False) --jf-repository.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in - the format of - asset::product_key::product_version (type: + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --token.mapping [MAPPING ...] - Repository tag product key mapping in the - format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --jf-repository.single - Export all jf-repositorys in a single - evidence (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + Export all jf-repositorys in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} - Override product key with jf-repository, - repository or image names (default: mapping) + Override product key with jf-repository, repository or image names (default: mapping) ``` @@ -777,37 +613,25 @@ platforms discover ecr \ --> ```bash -usage: platforms [options] discover [options] ecr [-h] - [--instance INSTANCE] +usage: platforms [options] discover [options] ecr [-h] [--instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] - [--token TOKEN] - [--url URL] - [--scope.aws-account [AWS_ACCOUNT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] - [--scope.tag_limit TAG_LIMIT] - [--broad] - [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--aws-account.single] - [--repository.single] + [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] + [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--aws-account.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE ECR instance string (default: ) --types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...] - Defines which asset types to exclude for - discovery. (default: []) + Defines which asset types to exclude for discovery. (default: []) --token TOKEN ECR token (ECR_LOGIN_TOKEN) (default: ) --url URL ECR base URL (default: null) --scope.aws-account [AWS_ACCOUNT ...] @@ -819,40 +643,27 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude - (default: []) + ECR repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude - (default: []) + ECR Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --scope.past_days PAST_DAYS - Ignore tags pushed earlier that previous to - this number of days (type: int, default: 30) + Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be - discovered. Scoping to tag names is done on - the limited tag list. Limit applies also to - the past_days filter. 0 for no limit, - default is 10. (type: int, default: 10) - --broad Retrieves limited information (only aws- - account and repository) (default: False) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit + applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 10) + --broad Retrieves limited information (only aws-account and repository) (default: False) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in - the format of - asset::product_key::product_version (type: + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --aws-account.single Export all aws-account in a single evidence - (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + --aws-account.single Export all aws-account in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} - Override product key with aws-account, - repository or image names (default: mapping) + Override product key with aws-account, repository or image names (default: mapping) ``` @@ -900,94 +711,62 @@ platforms discover bitbucket \ --> ```bash -usage: platforms [options] discover [options] bitbucket - [-h] [--instance INSTANCE] - [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] - [--url URL] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--broad] - [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--default_product_key_strategy {mapping}] - [--workspace.single] [--project.single] [--repository.single] +usage: platforms [options] discover [options] bitbucket [-h] [--instance INSTANCE] + [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] + [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] + [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--broad] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--default_product_key_strategy {mapping}] + [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: []) + Defines which asset to discover, scoped by scope parameters (default: []) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) - (default: ) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with - --workspace_name flag instead of - --app_password and --username + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with - --workspace_token flag instead of - --app_password and --username (default: ) - --url URL BitBucket URL (required, default: - https://api.bitbucket.org) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: + ) + --url URL BitBucket URL (required, default: https://api.bitbucket.org) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all - projects. Note that a project name includes - as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: - False) - --broad Retrieves limited information (only - workspaces, repositories) (default: False) + --commit.skip Skip commits in discovery/evidence (default: False) + --broad Retrieves limited information (only workspaces, repositories) (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format - of workspace::product_key::product_version - where org is the workspace name, wildcards - are supported (type: AssetMappingString, - default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace + name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of - project::product_key::product_version where - org is the project name, wildcards are - supported (type: AssetMappingString, - default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, + wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) - --workspace.single Export all workspaces in a single evidence - (default: False) - --project.single Export all projects in a single evidence - (default: False) - --repository.single Export all repos in a single evidence - (default: False) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) + --workspace.single Export all workspaces in a single evidence (default: False) + --project.single Export all projects in a single evidence (default: False) + --repository.single Export all repos in a single evidence (default: False) ``` @@ -1031,19 +810,15 @@ platforms discover jenkins \ --> ```bash -usage: platforms [options] discover [options] jenkins - [-h] [--instance INSTANCE] [--username USERNAME] - [--password PASSWORD] [--url URL] [--broad] - [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] - [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] - [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] - [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] - [--job_runs.skip] [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] - [--folder.mapping [MAPPING ...]] +usage: platforms [options] discover [options] jenkins [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] + [--broad] + [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] + [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] + [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] + [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] + [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -1051,65 +826,41 @@ options: --username USERNAME Jenkins username (default: ) --password PASSWORD Jenkins token (JENKINS_PASSWORD) (default: ) --url URL Jenkins base URL (default: null) - --broad Perform a fast broad discovery instead of a - detailed one (default: False) + --broad Perform a fast broad discovery instead of a detailed one (default: False) --types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...] - Defines which asset to discover, scoped by - scope parameters (default: ['all']) + Defines which asset to discover, scoped by scope parameters (default: ['all']) --credential_stores.skip Skip credential stores (default: False) --users.skip Skip users (default: False) --plugins.skip Skip plugins (default: False) --security_settings.skip Skip security_settings (default: False) - --computer_set.skip Skip computer sets in discovery/evidence - (default: False) + --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all - folders. The folder scoping is defined as a - path of folders and can include the job name - in order to scope specific jobs. Wildcard is - supported only as a suffix. examples: - folder-a* will discover all folders that are - included in a root folder that starts with - folder-a. folder-a/* will discover all - folders and jobs under the root folder - folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include + the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will + discover all folders that are included in a root folder that starts with folder-a. folder-a/* will discover all + folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from - discovery. Format is like the --scope.folder - argument (type: JenkinsFolderScope, default: - []) + Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: + JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS - Number of past days to include in the job - run discovery, 0 for no time limit (type: - int, default: 30) + Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job - run discovery. This argument will limit the - number of job runs in the past_days range. 0 - for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the + past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs - Include analyzed job run logs (default: - False) - --job_runs.skip Skip commits in discovery/evidence (default: - False) + Include analyzed job run logs (default: False) + --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by folder name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format - of *::product_key::product_version, - wildcards are supported (type: + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of - folder_path::product_key::product_version, - wildcards are supported (type: - AssetMappingString, default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported + (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index a62e98bdc..cb9fb0d34 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -23,58 +23,34 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] - [--evidence.local.path PATH] - [--evidence.local.prefix PREFIX] - [--evidence.local_only] - [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] - [--rate-limit-retry RATE_LIMIT_RETRY] - [--allow-failures] - [--export-partial] - [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] - [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] - [--valint.sign] - [--valint.components COMPONENTS] - [--valint.label LABEL] - [--unique] - {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket} - ... +usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] + [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] + [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] + {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket} ... Export evidence data (Deprecated) options: -h, --help Show this help message and exit. --evidence.local.path PATH - Local report export directory path (type: - str, default: output) + Local report export directory path (type: str, default: output) --evidence.local.prefix PREFIX - Local report export prefix (type: str, - default: ) + Local report export prefix (type: str, default: ) --evidence.local_only Only export local evidence (default: False) --max-threads MAX_THREADS - Main Pool max threads used to parallelize - evidence collection (type: int, default: 10) + Main Pool max threads used to parallelize evidence collection (type: int, default: 10) --thread-timeout THREAD_TIMEOUT - Thread timeout in seconds (type: float, - default: 20.0) + Thread timeout in seconds (type: float, default: 20.0) --rate-limit-retry RATE_LIMIT_RETRY Retry on rate limit (type: int, default: 3) - --allow-failures Allow failures without returning an error - code (default: False) - --export-partial Upload Partial Discover evidence (default: - False) + --allow-failures Allow failures without returning an error code (default: False) + --export-partial Upload Partial Discover evidence (default: False) --skip-evidence Skip evidence upload (default: False) --valint.scribe.client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) @@ -87,33 +63,24 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, - default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: - /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: - factory) + Evidence product key (type: str, default: factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, - default: ) + Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: - http://scribesecurity.com/evidence/discovery - /v0.1) + Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: - x509-env) + Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fd3675d0fe0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f0e6f9bd440>, default: []) --unique Allow unique assets (default: False) subcommands: - For more details of each subcommand, add it as an argument - followed by --help. + For more details of each subcommand, add it as an argument followed by --help. Available subcommands: gitlab @@ -143,35 +110,25 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab - [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--organization.single] - [--project.single] +usage: platforms [options] evidence [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--organization.single] [--project.single] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) - (default: ) - --url URL Gitlab base URL (default: - https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) + --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. - Default is all projects. Note that a project - name includes as a prefix its namesapce in - the format 'namespace / project_name' - (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -179,22 +136,16 @@ options: --commit.skip Skip commits in evidence (default: False) --pipeline.skip Skip pipeline (default: False) --default_product_key_strategy {mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of to - organization::product_key::product_version - (type: AssetMappingString, default: []) - --project.mapping [MAPPING ...] - Project product key mapping in the format of - asset::product_key::product_version (type: + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --organization.single - Export all organizations in a single - evidence (default: False) - --project.single Export all projects in a single evidence - (default: False) + Export all organizations in a single evidence (default: False) + --project.single Export all projects in a single evidence (default: False) ``` @@ -215,64 +166,42 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github - [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,repository,all,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] - [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--organization.single] - [--repository.single] +usage: platforms [options] evidence [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,repository,all,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) - (default: ) - --url URL Github base URL (default: - https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) + --url URL Github base URL (default: https://github.com) --types {organization,repository,all,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of org::product_key::product_version - where org is the organization name, - wildcards are supported (type: - AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization + name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) --organization.single - Export all organizations in a single - evidence (default: False) - --repository.single Export all repos in a single evidence - (default: False) + Export all organizations in a single evidence (default: False) + --repository.single Export all repos in a single evidence (default: False) ``` @@ -291,34 +220,28 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub - [-h] [--instance INSTANCE] - [--types {instance,token,repository,namespace,repository_tag,webhook,all}] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] - [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] - [--namespace.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--token.mapping [MAPPING ...]] [--namespace.single] - [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANCE] + [--types {instance,token,repository,namespace,repository_tag,webhook,all}] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] + [--namespace.single] [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --types {instance,token,repository,namespace,repository_tag,webhook,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) - (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) - --url URL Dockerhub base URL (default: - https://hub.docker.com) + --url URL Dockerhub base URL (default: https://hub.docker.com) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -326,32 +249,24 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude - (default: []) + Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --namespace.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --token.mapping [MAPPING ...] - Repository tag product key mapping in the - format of - asset::product_key::product_version (type: - AssetMappingString, default: []) - --namespace.single Export all namespaces in a single evidence - (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) + --namespace.single Export all namespaces in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} - Override product key with namespace, - repository or image names (default: mapping) + Override product key with namespace, repository or image names (default: mapping) ``` @@ -370,70 +285,45 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] - [--instance INSTANCE] - [--types {namespace,pod,all}] - [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] - [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] +usage: platforms [options] evidence [options] k8s [-h] [--instance INSTANCE] [--types {namespace,pod,all}] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] + [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--secret.skip] - [--url URL] - [--token TOKEN] - [--namespace.single] - [--pod.single] - [--namespace.mapping [MAPPING ...]] - [--pod.mapping [MAPPING ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] + [--url URL] [--token TOKEN] [--namespace.single] [--pod.single] + [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --types {namespace,pod,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list - (default: ['*']) + Kubernetes namespaces wildcard list (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: - ['*']) + Kubernetes pods wildcard list (default: ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: - ['*']) - --ignore-state Filter out containers that are not running - (default: False) + Kubernetes images wildcard list (default: ['*']) + --ignore-state Filter out containers that are not running (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process - (default: []) + Namespaces to exclude from discovery process (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process - (default: []) + Pods to exclude from discovery process (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process - (default: []) + Images to exclude from discovery process (default: []) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or - image names (default: mapping) - --secret.skip Skip secrets information in the evidence - (default: False) + Override product key with namespace, pod or image names (default: mapping) + --secret.skip Skip secrets information in the evidence (default: False) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and - secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --namespace.single Export all namespaces (default: False) - --pod.single Export all pods in a single evidence - (default: False) + --pod.single Export all pods in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Namespace product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --pod.mapping [MAPPING ...] - Pod product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) ``` @@ -454,21 +344,13 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] - [--instance INSTANCE] - [--url URL] - [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] - [--scope.repository [REPOSITORY ...]] +usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--aws-account.single] - [--repository.single] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -476,8 +358,7 @@ options: --instance INSTANCE ECR instance string (default: ) --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -487,29 +368,21 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude - (default: []) + ECR repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude - (default: []) + ECR Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in - the format of - asset::product_key::product_version (type: + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --aws-account.single Export all aws-account in a single evidence - (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + --aws-account.single Export all aws-account in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} - Override product key with aws-account, - repository or image names (default: mapping) + Override product key with aws-account, repository or image names (default: mapping) ``` @@ -529,21 +402,13 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] - [--instance INSTANCE] - [--url URL] - [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] - [--scope.repository [REPOSITORY ...]] +usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--aws-account.single] - [--repository.single] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -551,8 +416,7 @@ options: --instance INSTANCE ECR instance string (default: ) --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.aws-account [AWS_ACCOUNT ...] ECR repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -562,29 +426,21 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] ECR Image platform (default: ['*']) --exclude.aws-account [AWS_ACCOUNT ...] - ECR repository wildcards to exclude - (default: []) + ECR repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - ECR Image repository wildcards to exclude - (default: []) + ECR Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format - of asset::product_key::product_version - (type: AssetMappingString, default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in - the format of - asset::product_key::product_version (type: + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --aws-account.single Export all aws-account in a single evidence - (default: False) - --repository.single Export all repositories in a single evidence - (default: False) + --aws-account.single Export all aws-account in a single evidence (default: False) + --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} - Override product key with aws-account, - repository or image names (default: mapping) + Override product key with aws-account, repository or image names (default: mapping) ``` @@ -604,75 +460,48 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket - [-h] [--instance INSTANCE] - [--types {workspace,project,repository,all,all}] - [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--default_product_key_strategy {mapping}] - [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--workspace.single] - [--project.single] [--repository.single] +usage: platforms [options] evidence [options] bitbucket [-h] [--instance INSTANCE] [--types {workspace,project,repository,all,all}] + [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --types {workspace,project,repository,all,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all - projects. Note that a project name includes - as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by reopsitory name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format - of workspace::product_key::product_version - where org is the workspace name, wildcards - are supported (type: AssetMappingString, - default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace + name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of - project::product_key::product_version where - org is the project name, wildcards are - supported (type: AssetMappingString, - default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, + wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) - --workspace.single Export all workspaces in a single evidence - (default: False) - --project.single Export all projects in a single evidence - (default: False) - --repository.single Export all repos in a single evidence - (default: False) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) + --workspace.single Export all workspaces in a single evidence (default: False) + --project.single Export all projects in a single evidence (default: False) + --repository.single Export all repos in a single evidence (default: False) ``` @@ -692,81 +521,53 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins - [-h] [--instance INSTANCE] - [--types {instance,folder,all,all}] - [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] - [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] - [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] - [--job_runs.skip] [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] - [--folder.mapping [MAPPING ...]] [--folder.single] +usage: platforms [options] evidence [options] jenkins [-h] [--instance INSTANCE] [--types {instance,folder,all,all}] + [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] + [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] + [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] + [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] + [--folder.single] options: -h, --help Show this help message and exit. --instance INSTANCE Jenkins instance string (default: ) --types {instance,folder,all,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --credential_stores.skip Skip credential stores (default: False) --users.skip Skip users (default: False) --plugins.skip Skip plugins (default: False) --security_settings.skip Skip security_settings (default: False) - --computer_set.skip Skip computer sets in discovery/evidence - (default: False) + --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all - folders. The folder scoping is defined as a - path of folders and can include the job name - in order to scope specific jobs. Wildcard is - supported only as a suffix. examples: - folder-a* will discover all folders that are - included in a root folder that starts with - folder-a. folder-a/* will discover all - folders and jobs under the root folder - folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include + the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will + discover all folders that are included in a root folder that starts with folder-a. folder-a/* will discover all + folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from - discovery. Format is like the --scope.folder - argument (type: JenkinsFolderScope, default: - []) + Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: + JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS - Number of past days to include in the job - run discovery, 0 for no time limit (type: - int, default: 30) + Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job - run discovery. This argument will limit the - number of job runs in the past_days range. 0 - for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the + past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs - Include analyzed job run logs (default: - False) - --job_runs.skip Skip commits in discovery/evidence (default: - False) + Include analyzed job run logs (default: False) + --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} - Deferment product key by mapping. In the - future - we shall support by folder name - too. (default: mapping) + Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format - of *::product_key::product_version, - wildcards are supported (type: + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of - folder_path::product_key::product_version, - wildcards are supported (type: - AssetMappingString, default: []) - --folder.single Export all repos in a single evidence - (default: False) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported + (type: AssetMappingString, default: []) + --folder.single Export all repos in a single evidence (default: False) ``` diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index ee823cdba..0c29db5e2 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -61,32 +61,25 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] - [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... -CLI tool for collecting evidence and enforcing policies via CI/CD -platform APIs +CLI tool for collecting evidence and enforcing policies via CI/CD platform APIs options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all - other arguments and exit. The optional flags - customizes the output and are one or more - keywords separated by comma. The supported - flags are: comments, skip_default, - skip_null. + Print the configuration after applying all other arguments and exit. The optional flags customizes the output and + are one or more keywords separated by comma. The supported flags are: comments, skip_default, skip_null. --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) --db.local.path PATH Local db path (default: platforms.db) subcommands: - For more details of each subcommand, add it as an argument - followed by --help. + For more details of each subcommand, add it as an argument followed by --help. Available subcommands: discover diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 97232c00c..9f058cc93 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,30 +19,15 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] - [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] - [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] - [--valint.sign] - [--valint.components COMPONENTS] - [--valint.label LABEL] [--unique] - [--valint.bundle BUNDLE] - [--valint.bundle-auth BUNDLE_AUTH] - [--valint.bundle-branch BUNDLE_BRANCH] - [--valint.bundle-commit BUNDLE_COMMIT] - [--valint.bundle-tag BUNDLE_TAG] - [--allow-failures] - [--max-threads MAX_THREADS] - {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} - ... +usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] + [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] + [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] + [--unique] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] + [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] + [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] + {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} ... Verify supply chain policies @@ -59,49 +44,37 @@ options: --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) --valint.output-directory OUTPUT_DIRECTORY - Local evidence cache directory (type: str, - default: ) - --valint.bin BIN Valint CLI binary path (type: str, default: - /home/mikey/.scribe/bin/valint) + Local evidence cache directory (type: str, default: ) + --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) --valint.product-key PRODUCT_KEY - Evidence product key (type: str, default: - factory) + Evidence product key (type: str, default: factory) --valint.product-version PRODUCT_VERSION - Evidence product version (type: str, - default: ) + Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE - Evidence predicate type (type: str, default: - http://scribesecurity.com/evidence/discovery - /v0.1) + Evidence predicate type (type: str, default: http://scribesecurity.com/evidence/discovery/v0.1) --valint.attest ATTEST - Evidence attest type (type: str, default: - x509-env) + Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f6801539a80>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7f41239e9ee0>, default: []) --unique Allow unique assets (default: False) --valint.bundle BUNDLE Set bundle git branch (type: str, default: ) --valint.bundle-auth BUNDLE_AUTH Set bundle git auth (type: str, default: ) --valint.bundle-branch BUNDLE_BRANCH - Set bundle git branch (type: str, default: - main) + Set bundle git branch (type: str, default: main) --valint.bundle-commit BUNDLE_COMMIT Set bundle git commit (type: str, default: ) --valint.bundle-tag BUNDLE_TAG Set bundle git tag (type: str, default: ) - --allow-failures Allow failures without returning an error - code (default: False) + --allow-failures Allow failures without returning an error code (default: False) --max-threads MAX_THREADS - Number of threads used to run valint (type: - int, default: 10) + Number of threads used to run valint (type: int, default: 10) subcommands: - For more details of each subcommand, add it as an argument - followed by --help. + For more details of each subcommand, add it as an argument followed by --help. Available subcommands: k8s @@ -170,68 +143,44 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] - [--instance INSTANCE] - [--token TOKEN] - [--url URL] - [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] - [--commit.skip] - [--organization.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] - [--project.policy [POLICY ...]] - [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] - [--project-policy-skip-aggregate] +usage: platforms [options] verify [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--project.policy [POLICY ...]] [--organization.policy [POLICY ...]] + [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Gitlab instance string (default: ) - --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) - (default: ) - --url URL Gitlab base URL (default: - https://gitlab.com/) + --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) + --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} - Defines which evidence to consume, scoped by - scope parameters (default: all) + Defines which evidence to consume, scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. - Default is all projects. Note that a project - name includes as a prefix its namesapce in - the format 'namespace / project_name' - (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of to - organization::product_key::product_version - (type: AssetMappingString, default: []) - --project.mapping [MAPPING ...] - Project product key mapping in the format of - asset::product_key::product_version (type: + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) + --project.mapping [MAPPING ...] + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, + default: []) --project.policy [POLICY ...] - Set project policy file (type: str, default: - ['ct-2@discovery', 'ct-9@discovery']) + Set project policy file (type: str, default: ['ct-2@discovery', 'ct-9@discovery']) --organization.policy [POLICY ...] - Set organization policy file (type: str, - default: ['ct-1@discovery', - 'ct-3@discovery', 'ct-4@discovery']) + Set organization policy file (type: str, default: ['ct-1@discovery', 'ct-3@discovery', 'ct-4@discovery']) --org-policy-skip-aggregate - Skip Aggregate organization policy results - (default: False) + Skip Aggregate organization policy results (default: False) --project-policy-skip-aggregate - Skip Aggregate project policy results - (default: False) + Skip Aggregate project policy results (default: False) ``` @@ -249,73 +198,46 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] - [--instance INSTANCE] - [--token TOKEN] - [--url URL] - [--types {organization,repository,all}] - [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] - [--branch.shallow] - [--commit.skip] - [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] - [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] - [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] + [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]] + [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Github instance string (default: ) - --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) - (default: ) - --url URL Github base URL (default: - https://github.com) + --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) + --url URL Github base URL (default: https://github.com) --types {organization,repository,all} - Defines which evidence to validate, scoped - by scope parameters (default: all) + Defines which evidence to validate, scoped by scope parameters (default: all) --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the - format of org::product_key::product_version - where org is the organization name, - wildcards are supported (type: - AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization + name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) --repository.policy [POLICY ...] - Set repository evidence policy file (type: - str, default: []) + Set repository evidence policy file (type: str, default: []) --organization.policy [POLICY ...] - Set organization evidence policy file (type: - str, default: ['ct-1@discovery']) + Set organization evidence policy file (type: str, default: ['ct-1@discovery']) --org-policy-skip-aggregate - Skip Aggregate organization policy results - (default: False) + Skip Aggregate organization policy results (default: False) --repo-policy-skip-aggregate - Skip Aggregate repo policy results (default: - False) + Skip Aggregate repo policy results (default: False) ``` @@ -332,39 +254,29 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub - [-h] [--instance INSTANCE] [--username USERNAME] - [--password PASSWORD] [--token TOKEN] [--url URL] - [--types {token,repository,namespace,all}] - [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] - [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] - [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] + [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] + [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] + [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] + [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) - --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) - (default: null) + --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) - --url URL Dockerhub base URL (default: - https://hub.docker.com) + --url URL Dockerhub base URL (default: https://hub.docker.com) --types {token,repository,namespace,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --default_product_key_strategy {namespace,repository,tag,mapping} - Override product key with namespace, - repository or image names (default: mapping) + Override product key with namespace, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image - id (default: short_image_id) + Override product version with tag or image id (default: short_image_id) --scope.repository [REPOSITORY ...] Dockerhub repositories (default: ['*']) --scope.repository_tags [REPOSITORY_TAGS ...] @@ -372,24 +284,19 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Dockerhub Image platform (default: ['*']) --exclude.repository [REPOSITORY ...] - Dockerhub repository wildcards to exclude - (default: []) + Dockerhub repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Dockerhub tags to exclude (default: []) --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, - default: ['ct-8@discovery', - 'ct-11@discovery', 'ct-12@discovery', + Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) --policy-skip-aggregate - Skip Aggregate policy results (default: - False) + Skip Aggregate policy results (default: False) ``` @@ -426,81 +333,52 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] - [--instance INSTANCE] - [--url URL] - [--token TOKEN] +usage: platforms [options] verify [options] k8s [-h] [--instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] - [--ignore-state] - [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] - [--namespace.single] - [--pod.single] - [--image.mapping [MAPPING ...]] - [--cluster-images.policy [POLICY ...]] - [--namespace.policy [POLICY ...]] - [--policy-skip-aggregate] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] + [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] + [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] + [--namespace.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) - --token TOKEN Kubernetes token, with access to pods and - secrets (K8S_TOKEN) (default: ) + --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --types {namespace,pod,cluster-images,all} - Defines which evidence to create, scoped by - scope parameters (default: cluster-images) + Defines which evidence to create, scoped by scope parameters (default: cluster-images) --default_product_key_strategy {namespace,pod,image,mapping} - Override product key with namespace, pod or - image names (default: mapping) + Override product key with namespace, pod or image names (default: mapping) --default_product_version_strategy {namespace_hash,pod_hash,image_id} - Override product version with namespace, pod - or image names (default: namespace_hash) + Override product version with namespace, pod or image names (default: namespace_hash) --scope.namespace [NAMESPACE ...] - Kubernetes namespaces wildcard list - (default: ['*']) + Kubernetes namespaces wildcard list (default: ['*']) --scope.pod [POD ...] - Kubernetes pods wildcard list (default: - ['*']) + Kubernetes pods wildcard list (default: ['*']) --scope.image [IMAGE ...] - Kubernetes images wildcard list (default: - ['*']) - --ignore-state Filter out containers that are not running - (default: False) + Kubernetes images wildcard list (default: ['*']) + --ignore-state Filter out containers that are not running (default: False) --exclude.namespace [NAMESPACE ...] - Namespaces to exclude from discovery process - (default: []) + Namespaces to exclude from discovery process (default: []) --exclude.pod [POD ...] - Pods to exclude from discovery process - (default: []) + Pods to exclude from discovery process (default: []) --exclude.image [IMAGE ...] - Images to exclude from discovery process - (default: []) + Images to exclude from discovery process (default: []) --namespace.single Export all namespaces (default: False) - --pod.single Export all pods in a single evidence - (default: False) + --pod.single Export all pods in a single evidence (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to - product_key:product_version mappinge.g. my- - namespace;my-pod;my- - image:product_key:product_version (type: - K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- + image:product_key:product_version (type: K8sImageMappingString, default: []) --cluster-images.policy [POLICY ...] - Set image policy file (type: str, default: - ['ct-8@discovery', 'ct-11@discovery', - 'ct-12@discovery', 'ct-13@discovery']) + Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', + 'ct-13@discovery']) --namespace.policy [POLICY ...] - Set Kubernetes policy file (type: str, - default: []) + Set Kubernetes policy file (type: str, default: []) --policy-skip-aggregate - Skip Aggregate policy results (default: - False) + Skip Aggregate policy results (default: False) ``` @@ -542,23 +420,16 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] - [--instance INSTANCE] - [--jf_token JF_TOKEN] - [--url URL] +usage: platforms [options] verify [options] jfrog [-h] [--instance INSTANCE] [--jf_token JF_TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] + [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] - [--image.policy [POLICY ...]] - [--policy-skip-aggregate] + [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] + [--image.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -566,14 +437,11 @@ options: --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --types {token,repository,jf-repository,all} - Defines which evidence to create, scoped by - scope parameters (default: all) + Defines which evidence to create, scoped by scope parameters (default: all) --default_product_key_strategy {jf-repository,repository,tag,mapping} - Override product key with jf-repository, - repository or image names (default: mapping) + Override product key with jf-repository, repository or image names (default: mapping) --default_product_version_strategy {tag,short_image_id,image_id} - Override product version with tag or image - id (default: short_image_id) + Override product version with tag or image id (default: short_image_id) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) --scope.repository [REPOSITORY ...] @@ -583,25 +451,19 @@ options: --scope.image_platform [IMAGE_PLATFORM ...] Jfrog Image platform (default: ['*']) --exclude.jf-repository [JF_REPOSITORY ...] - Jfrog repository wildcards to exclude - (default: []) + Jfrog repository wildcards to exclude (default: []) --exclude.repository [REPOSITORY ...] - Jfrog Image repository wildcards to exclude - (default: []) + Jfrog Image repository wildcards to exclude (default: []) --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of - asset::product_key::product_version (type: - AssetMappingString, default: []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: + []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, - default: ['ct-8@discovery', - 'ct-11@discovery', 'ct-12@discovery', + Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) --policy-skip-aggregate - Skip Aggregate policy results (default: - False) + Skip Aggregate policy results (default: False) ``` @@ -619,98 +481,65 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket - [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] - [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] - [--types {workspace,project,repository,all}] - [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] - [--project.policy [POLICY ...]] - [--workspace.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] + [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--repository.policy [POLICY ...]] [--project.policy [POLICY ...]] + [--workspace.policy [POLICY ...]] [--org-policy-skip-aggregate] + [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. --instance INSTANCE BitBucket instance string (default: ) --app_password APP_PASSWORD - BitBucket app_password (BB_PASSWORD) - (default: ) + BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with - --workspace_name flag instead of - --app_password and --username + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with - --workspace_token flag instead of - --app_password and --username (default: ) - --url URL BitBucket URL (required, default: - https://api.bitbucket.org) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: + ) + --url URL BitBucket URL (required, default: https://api.bitbucket.org) --types {workspace,project,repository,all} - Defines which evidence to validate, scoped - by scope parameters (default: all) + Defines which evidence to validate, scoped by scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all - projects. Note that a project name includes - as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce + in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is - all projects. Note that a project name - includes as a prefix its namesapce in the - format 'namespace / project_name' (default: - ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its + namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] BitBucket branches wildcards (default: []) --scope.webhook [WEBHOOK ...] BitBucket webhook wildcards (default: []) - --commit.skip Skip commits in discovery/evidence (default: - False) + --commit.skip Skip commits in discovery/evidence (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format - of workspace::product_key::product_version - where org is the workspace name, wildcards - are supported (type: AssetMappingString, - default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace + name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of - project::product_key::product_version where - org is the project name, wildcards are - supported (type: AssetMappingString, - default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, + wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format - of repo::product_key::product_version where - repo is the repository name, wildcards are - supported (type: AssetMappingString, - default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository + name, wildcards are supported (type: AssetMappingString, default: []) --repository.policy [POLICY ...] - Set repository evidence policy file (type: - str, default: []) + Set repository evidence policy file (type: str, default: []) --project.policy [POLICY ...] - Set repository evidence policy file (type: - str, default: []) + Set repository evidence policy file (type: str, default: []) --workspace.policy [POLICY ...] - Set workspace evidence policy file (type: - str, default: []) + Set workspace evidence policy file (type: str, default: []) --org-policy-skip-aggregate - Skip Aggregate workspace policy results - (default: False) + Skip Aggregate workspace policy results (default: False) --repo-policy-skip-aggregate - Skip Aggregate repo policy results (default: - False) + Skip Aggregate repo policy results (default: False) ``` From cd1b45b405f86a02225b18725b23b5f87b7c2ef5 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 11:04:27 +0200 Subject: [PATCH 052/191] downgrade --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 0224c1071..a4ee6efcc 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "classnames": "^2.3.0", "clsx": "^2.0.0", "docusaurus": "^1.14.7", - "docusaurus-lunr-search": "^3.5.0", + "docusaurus-lunr-search": "3.5.0", "lunr": "^2.3.9", "prism-react-renderer": "^2.1.0", "react": "^18.0.0", From bc8e9f226e602fe6720ff74aa4f7b208648d99ef Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 11:09:26 +0200 Subject: [PATCH 053/191] downgrade --- docs/integrating-scribe/ci-integrations/github/action-bom.md | 2 +- .../ci-integrations/github/action-evidence.md | 2 +- docs/integrating-scribe/ci-integrations/github/action-slsa.md | 4 ++-- .../ci-integrations/github/action-verify.md | 2 +- docs/valint/help/valint.md | 2 +- docs/valint/help/valint_bom.md | 2 +- docs/valint/help/valint_discard.md | 2 +- docs/valint/help/valint_download.md | 2 +- docs/valint/help/valint_evidence.md | 2 +- docs/valint/help/valint_list.md | 2 +- docs/valint/help/valint_slsa.md | 2 +- docs/valint/help/valint_verify.md | 2 +- 12 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 1840ceb68..6da70a414 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -123,7 +123,7 @@ To overcome the limitation install tool directly - **[installer](https://github. gate: description: Policy Gate name input: - description: Input Evidence target, format (: or ::) + description: Input Evidence target, format (\:\ or \:\:\) label: description: Add Custom labels level: diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 0c2ee4b42..7970fdce6 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -88,7 +88,7 @@ The `valint evidence` action is a versatile action designed to include various t gate: description: Policy Gate name input: - description: Input Evidence target, format (: or ::) + description: Input Evidence target, format (\:\ or \:\:\) label: description: Add Custom labels level: diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 6a6c9189f..0441c435a 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -107,7 +107,7 @@ To overcome the limitation install tool directly - [installer](https://github.co gate: description: Policy Gate name input: - description: Input Evidence target, format (: or ::) + description: Input Evidence target, format (\:\ or \:\:\) label: description: Add Custom labels level: @@ -465,7 +465,7 @@ Generate SLSA Provenance and a Bill of Materials (BOM) for a container image.
- SLSA Provenance with SBOM and Base Image Analysis + SLSA Provenance with SBOM and Base Image Analysis Generate SLSA Provenance with SBOM by product including Base Image analysis. diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index 53ca80cf6..03cec7db8 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -124,7 +124,7 @@ The command allows users to verify any target against its evidence. gate: description: Policy Gate name input: - description: Input Evidence target, format (: or ::) + description: Input Evidence target, format (\:\ or \:\:\) label: description: Add Custom labels level: diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index 3e3ac539a..a12fe4b34 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,7 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 7c722c24d..8c0344dfb 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -69,7 +69,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index cb63e2dc0..fa81f46a5 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,7 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index 10ba8620b..893376db6 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,7 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index 8c5bc57f5..f3f4d3203 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -53,7 +53,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index 687e9fb4a..aafb91a97 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,7 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index 0df902a36..b4d9c0014 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -64,7 +64,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index f4bd6453f..894acd782 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -75,7 +75,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 3977582d09b5d0b47324409ea19841549780527f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 13 Jan 2025 11:26:24 +0200 Subject: [PATCH 054/191] mend wait_all --- scripts/sync_docs.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index 670e3fa71..ce78c7d95 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -123,14 +123,14 @@ import_action() { repo=$1 repo_dir="${submodules_dir}/${repo}" - dst_dir="docs/integrating-scribe/ci-integrations/github/github-actions" + dst_dir="docs/integrating-scribe/ci-integrations/github" import_file_rename ${repo} "" "${dst_dir}/${repo}.md" } import_action_extra() { repo=$1 repo_dir="${submodules_dir}/${repo}" - dst_dir="docs/integrating-scribe/ci-integrations/github/github-actions" + dst_dir="docs/integrating-scribe/ci-integrations/github" cp -r "${repo_dir}/docs" "${dst_dir}" || true cp -r "${repo_dir}/docs" "${dst_dir}/../" || true } @@ -139,14 +139,14 @@ import_action_extra() { export_action() { repo=$1 repo_dir="${submodules_dir}/${repo}" - dst_dir="docs/integrating-scribe/ci-integrations/github/github-actions" + dst_dir="docs/integrating-scribe/ci-integrations/github" export_file_rename ${repo} "" "${dst_dir}/${repo}.md" } export_action_extra() { repo=$1 repo_dir="${submodules_dir}/${repo}" - dst_dir="docs/integrating-scribe/ci-integrations/github/github-actions" + dst_dir="docs/integrating-scribe/ci-integrations/github" cp -r "${dst_dir}/../docs" "${repo_dir}" || true } From 65e3c6d18814506bd83925bac2c77cbe8e72bc4b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 29 Jan 2025 10:09:34 +0200 Subject: [PATCH 055/191] Gen docs --- .../ci-integrations/github/action-bom.md | 4 +- .../ci-integrations/github/action-evidence.md | 4 +- .../ci-integrations/github/action-slsa.md | 4 +- .../ci-integrations/github/action-verify.md | 9 +- docs/platforms/bom.md | 167 +++++------ docs/platforms/discover.md | 267 ++++++++---------- docs/platforms/evidence.md | 229 +++++++-------- docs/platforms/usage.md | 7 +- docs/platforms/verify.md | 183 ++++++------ docs/valint/configuration.md | 7 + docs/valint/getting-started-valint.md | 2 +- docs/valint/help/valint.md | 2 +- docs/valint/help/valint_bom.md | 3 +- docs/valint/help/valint_discard.md | 2 +- docs/valint/help/valint_download.md | 2 +- docs/valint/help/valint_evidence.md | 3 +- docs/valint/help/valint_list.md | 2 +- docs/valint/help/valint_slsa.md | 3 +- docs/valint/help/valint_verify.md | 3 +- 19 files changed, 403 insertions(+), 500 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 6da70a414..b33ac1009 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -173,7 +173,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.15 + uses: scribe-security/action-bom@v1.5.16 with: target: 'busybox:latest' ``` @@ -181,7 +181,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.15 + uses: scribe-security/action-bom-cli@v1.5.16 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 7970fdce6..6de195652 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -138,7 +138,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.15 + uses: scribe-security/action-evidence@v1.5.16 with: target: some_file.json ``` @@ -146,7 +146,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.15 + uses: scribe-security/action-evidence-cli@v1.5.16 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 0441c435a..6c881b971 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -157,7 +157,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.15 + uses: scribe-security/action-slsa@v1.5.16 with: target: 'busybox:latest' ``` @@ -165,7 +165,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.15 + uses: scribe-security/action-slsa-cli@v1.5.16 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index 03cec7db8..e8263bbfd 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.15 + uses: scribe-security/action-verify@v1.5.16 with: target: 'busybox:latest' ``` @@ -177,7 +177,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.15 + uses: scribe-security/action-verify-cli@v1.5.16 with: target: 'hello-world:latest' ``` @@ -722,9 +722,10 @@ jobs: password: ${{ secrets.DOCKER_PASSWORD }} - name: Generate evidence step - # uses: scribe-security/action-evidence@master + + # uses: scribe-security/action-evidence@master # uses: scribe-security/action-slsa@master - uses: scribe-security/action-bom@master + - uses: scribe-security/action-bom@master with: target: [target] format: [attest, statement] diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index 881267b0d..f16fbf621 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,12 +16,10 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] - [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] +usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] [--monitor.clean-docker] + [--max-threads MAX_THREADS] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket} ... @@ -40,7 +38,7 @@ options: Monitor disk usage - auto clean docker cache (default: False) --max-threads MAX_THREADS Number of threads used to run valint (type: int, default: 10) - --valint.scribe.client-secret CLIENT_SECRET + --valint.scribe.client-secret CLIENT_SECRET, --scribe-token CLIENT_SECRET, --scribe-client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable Enable Scribe client (default: False) @@ -64,7 +62,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f87d11a4040>, default: []) + --valint.label LABEL Set additional labels (type: at 0x705649776b60>, default: []) --unique Allow unique assets (default: False) subcommands: @@ -142,17 +140,17 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] - [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] +usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Dockerhub instance string (default: ) + --instance.instance INSTANCE + Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) @@ -174,8 +172,7 @@ options: --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -221,16 +218,15 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] [--instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] - [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] +usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Kubernetes instance string (default: ) + --instance.instance INSTANCE + Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --types {namespace,pod,all} @@ -253,8 +249,8 @@ options: --exclude.image [IMAGE ...] Images to exclude from discovery process (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- - image:product_key:product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, + default: []) ``` @@ -300,19 +296,17 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] [--instance INSTANCE] [--jf_token JF_TOKEN] [--url URL] - [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] +usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Jfrog instance string (default: ) - --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --instance.instance INSTANCE + Jfrog instance string (default: ) + --token TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --default_product_key_strategy {jf-repository,repository,tag,mapping} Override product key with jf-repository, repository or image names (default: mapping) @@ -333,8 +327,7 @@ options: --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -354,16 +347,15 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] [--instance INSTANCE] - [--default_product_key_strategy {aws-account,repository,tag,mapping}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] +usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE ECR instance string (default: ) + --instance.instance INSTANCE + ECR instance string (default: ) --default_product_key_strategy {aws-account,repository,tag,mapping} Override product key with aws-account, repository or image names (default: mapping) --scope.aws-account [AWS_ACCOUNT ...] @@ -382,8 +374,7 @@ options: ECR tags to exclude (default: []) --url URL ECR base URL (default: null) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -405,38 +396,34 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] - [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] [--url URL] [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] + [--commit.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE BitBucket instance string (default: ) + --instance.instance INSTANCE + BitBucket instance string (default: ) --app_password APP_PASSWORD BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username - (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: - ) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: ) --url URL BitBucket URL (required, default: https://api.bitbucket.org) --types {repository,all} Specifies the type of evidence to generate, scoped by scope parameters (default: repository) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -447,14 +434,14 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace - name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: + AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, - wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) ``` @@ -476,15 +463,14 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] +usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Github instance string (default: ) + --instance.instance INSTANCE + Github instance string (default: ) --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {repository,all} @@ -492,8 +478,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] @@ -503,11 +489,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization - name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) ``` @@ -529,15 +515,14 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] [--scope.organization [ORGANIZATION ...]] + [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Gitlab instance string (default: ) + --instance.instance INSTANCE + Gitlab instance string (default: ) --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {project,all} @@ -545,8 +530,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -556,10 +541,8 @@ options: --default_product_key_strategy {mapping} Override product key with namespace, pod or image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index dc3f3a7b6..3ce0c648f 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -22,15 +22,12 @@ The evidence generation process uses Scribe's `valint` tool to upload and option --> ```bash -usage: platforms [options] discover [-h] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] - [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] - [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] - [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] +usage: platforms [options] discover [-h] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] + [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] + [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] + [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] + [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket} ... Discover assets and save data to a local store @@ -56,7 +53,7 @@ options: --allow-failures Allow failures without returning an error code (default: False) --export-partial Upload Partial Discover evidence (default: False) --skip-evidence Skip evidence upload (default: False) - --valint.scribe.client-secret CLIENT_SECRET + --valint.scribe.client-secret CLIENT_SECRET, --scribe-token CLIENT_SECRET, --scribe-client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable Enable Scribe client (default: False) @@ -80,7 +77,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f9b0066ede0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7697d3755a80>, default: []) --unique Allow unique assets (default: False) subcommands: @@ -135,21 +132,20 @@ platforms discover gitlab \ --> ```bash -usage: platforms [options] discover [options] gitlab [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] - [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--scope.skip_org_members] [--scope.skip_project_members] - [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] - [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] + [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] options: -h, --help Show this help message and exit. - --instance INSTANCE Gitlab instance string (default: ) + --instance.instance INSTANCE + Gitlab instance string (default: ) --types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...] @@ -159,8 +155,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -183,11 +179,9 @@ options: Include gitlab standard reports (default: False) --broad Retrieves limited information (only organizations and projects) (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) @@ -240,20 +234,19 @@ platforms discover github \ --> ```bash -usage: platforms [options] discover [options] github [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] - [--workflow.skip] [--scope.workflow.past_days PAST_DAYS] - [--scope.workflow.analyzed_logs] [--scope.runners] [--scope.sbom] [--broad] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] + [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] [--workflow.skip] + [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.runners] [--scope.sbom] [--broad] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Github instance string (default: ) + --instance.instance INSTANCE + Github instance string (default: ) --types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...] @@ -263,8 +256,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] @@ -284,11 +277,11 @@ options: --scope.sbom Include repositories SBOM in evidence (default: False) --broad Retrieves limited information (only organizations, repositories and workflows) (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization - name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) ``` @@ -329,23 +322,20 @@ platforms discover dockerhub \ --> ```bash -usage: platforms [options] discover [options] dockerhub [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] - [--namespace.single] [--repository.single] [--namespace.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] [--repository.single] + [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE Dockerhub instance string (default: ) + --instance.instance INSTANCE + Dockerhub instance string (default: ) --types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...] @@ -372,14 +362,11 @@ options: --namespace.single Export all namespaces in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) - --token.mapping [MAPPING ...] - Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) + --instance.mapping [MAPPING ...] + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --default_product_key_strategy {mapping,mapping,mapping,mapping} Override product key with namespace, repository or image names (default: mapping) ``` @@ -418,19 +405,17 @@ platforms discover k8s \ --> ```bash -usage: platforms [options] discover [options] k8s [-h] [--instance INSTANCE] - [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] - [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] - [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] - [--deployment.skip] [--broad] [--namespace.single] [--pod.single] - [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] +usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] + [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] [--token TOKEN] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] [--deployment.skip] + [--broad] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE Kubernetes instance string (default: ) + --instance.instance INSTANCE + Kubernetes instance string (default: ) --types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...] @@ -456,11 +441,9 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --pod.mapping [MAPPING ...] - Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --default_product_key_strategy {namespace,pod,image,mapping} Override product key with namespace, pod or image names (default: mapping) ``` @@ -512,27 +495,25 @@ platforms discover jfrog \ --> ```bash -usage: platforms [options] discover [options] jfrog [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] - [--jf_token JF_TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] + [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] - [--scope.tag_limit TAG_LIMIT] [--broad] [--jf-repository.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] - [--jf-repository.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] + [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] + [--jf-repository.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE Jfrog instance string (default: ) + --instance.instance INSTANCE + Jfrog instance string (default: ) --types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...] Defines which asset types to exclude for discovery. (default: []) - --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --token TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --scope.jf-repository [JF_REPOSITORY ...] Jfrog repositories (default: ['*']) @@ -551,18 +532,15 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit - applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 20) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no + limit, default is 10. (type: int, default: 20) --broad Retrieves limited information (only jf-repositories and repositories) (default: False) --jf-repository.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) - --token.mapping [MAPPING ...] - Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) + --instance.mapping [MAPPING ...] + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --jf-repository.single Export all jf-repositorys in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) @@ -613,21 +591,20 @@ platforms discover ecr \ --> ```bash -usage: platforms [options] discover [options] ecr [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] - [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] - [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] - [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--aws-account.single] [--repository.single] + [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] [--token TOKEN] + [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE ECR instance string (default: ) + --instance.instance INSTANCE + ECR instance string (default: ) --types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...] @@ -651,15 +628,13 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit - applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 10) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no + limit, default is 10. (type: int, default: 10) --broad Retrieves limited information (only aws-account and repository) (default: False) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --aws-account.single Export all aws-account in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} @@ -711,40 +686,36 @@ platforms discover bitbucket \ --> ```bash -usage: platforms [options] discover [options] bitbucket [-h] [--instance INSTANCE] +usage: platforms [options] discover [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--broad] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--default_product_key_strategy {mapping}] - [--workspace.single] [--project.single] [--repository.single] + [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] + [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--broad] + [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--default_product_key_strategy {mapping}] [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. - --instance INSTANCE BitBucket instance string (default: ) + --instance.instance INSTANCE + BitBucket instance string (default: ) --types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...] Defines which asset to discover, scoped by scope parameters (default: []) --app_password APP_PASSWORD BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username - (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: - ) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: ) --url URL BitBucket URL (required, default: https://api.bitbucket.org) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -754,14 +725,14 @@ options: --commit.skip Skip commits in discovery/evidence (default: False) --broad Retrieves limited information (only workspaces, repositories) (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace - name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: + AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, - wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.single Export all workspaces in a single evidence (default: False) @@ -810,19 +781,17 @@ platforms discover jenkins \ --> ```bash -usage: platforms [options] discover [options] jenkins [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] - [--broad] +usage: platforms [options] discover [options] jenkins [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] [--broad] [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] - [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] - [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] - [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] - [--default_product_key_strategy {mapping}] + [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] [--jobs.skip] + [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] + [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Jenkins instance string (default: ) + --instance.instance INSTANCE + Jenkins instance string (default: ) --username USERNAME Jenkins username (default: ) --password PASSWORD Jenkins token (JENKINS_PASSWORD) (default: ) --url URL Jenkins base URL (default: null) @@ -838,29 +807,25 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include - the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will - discover all folders that are included in a root folder that starts with folder-a. folder-a/* will discover all - folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific + jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: - JenkinsFolderScope, default: []) + Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the - past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, + default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: - AssetMappingString, default: []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported - (type: AssetMappingString, default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index cb9fb0d34..603dce1bd 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -23,13 +23,11 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] - [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] - [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] +usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] + [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] + [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket} ... @@ -52,7 +50,7 @@ options: --allow-failures Allow failures without returning an error code (default: False) --export-partial Upload Partial Discover evidence (default: False) --skip-evidence Skip evidence upload (default: False) - --valint.scribe.client-secret CLIENT_SECRET + --valint.scribe.client-secret CLIENT_SECRET, --scribe-token CLIENT_SECRET, --scribe-client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable Enable Scribe client (default: False) @@ -76,7 +74,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f0e6f9bd440>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7b9df7c3ff60>, default: []) --unique Allow unique assets (default: False) subcommands: @@ -110,16 +108,15 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] - [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--organization.single] [--project.single] +usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] options: -h, --help Show this help message and exit. - --instance INSTANCE Gitlab instance string (default: ) + --instance.instance INSTANCE + Gitlab instance string (default: ) --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} @@ -127,8 +124,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -138,11 +135,9 @@ options: --default_product_key_strategy {mapping} Override product key with namespace, pod or image names (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) @@ -166,16 +161,15 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,repository,all,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] +usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] options: -h, --help Show this help message and exit. - --instance INSTANCE Github instance string (default: ) + --instance.instance INSTANCE + Github instance string (default: ) --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {organization,repository,all,all} @@ -183,8 +177,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] @@ -194,11 +188,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization - name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -220,22 +214,17 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance INSTANCE] - [--types {instance,token,repository,namespace,repository_tag,webhook,all}] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--token.mapping [MAPPING ...]] - [--namespace.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,token,repository,namespace,repository_tag,webhook,all}] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] + [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] + [--namespace.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE Dockerhub instance string (default: ) + --instance.instance INSTANCE + Dockerhub instance string (default: ) --types {instance,token,repository,namespace,repository_tag,webhook,all} Defines which evidence to create, scoped by scope parameters (default: all) --username USERNAME Dockerhub username (default: null) @@ -255,14 +244,11 @@ options: --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --namespace.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) - --token.mapping [MAPPING ...] - Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) + --instance.mapping [MAPPING ...] + Repository tag product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --namespace.single Export all namespaces in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} @@ -285,17 +271,15 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] [--instance INSTANCE] [--types {namespace,pod,all}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] - [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] - [--url URL] [--token TOKEN] [--namespace.single] [--pod.single] - [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] + [--exclude.image [IMAGE ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] + [--token TOKEN] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. - --instance INSTANCE Kubernetes instance string (default: ) + --instance.instance INSTANCE + Kubernetes instance string (default: ) --types {namespace,pod,all} Defines which evidence to create, scoped by scope parameters (default: all) --scope.namespace [NAMESPACE ...] @@ -319,11 +303,9 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --namespace.mapping [MAPPING ...] - Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Namespace product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --pod.mapping [MAPPING ...] - Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Pod product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) ``` @@ -344,18 +326,16 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--aws-account.single] [--repository.single] - [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE ECR instance string (default: ) + --instance.instance INSTANCE + ECR instance string (default: ) --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -374,11 +354,9 @@ options: --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --aws-account.single Export all aws-account in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} @@ -402,18 +380,16 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--aws-account.single] [--repository.single] - [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: -h, --help Show this help message and exit. - --instance INSTANCE ECR instance string (default: ) + --instance.instance INSTANCE + ECR instance string (default: ) --url URL ECR base URL (default: null) --types {instance,aws-account,repository,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -432,11 +408,9 @@ options: --exclude.repository_tags [REPOSITORY_TAGS ...] ECR tags to exclude (default: []) --aws-account.mapping [MAPPING ...] - Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository image_tags product key mapping in the format of asset::product_key::product_version (type: - AssetMappingString, default: []) + Repository image_tags product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --aws-account.single Export all aws-account in a single evidence (default: False) --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {instance,aws-account,repository,tag,mapping} @@ -460,27 +434,26 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket [-h] [--instance INSTANCE] [--types {workspace,project,repository,all,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--default_product_key_strategy {mapping}] + [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. - --instance INSTANCE BitBucket instance string (default: ) + --instance.instance INSTANCE + BitBucket instance string (default: ) --types {workspace,project,repository,all,all} Defines which evidence to create, scoped by scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -491,14 +464,14 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace - name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: + AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, - wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) --workspace.single Export all workspaces in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -521,18 +494,16 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins [-h] [--instance INSTANCE] [--types {instance,folder,all,all}] - [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] - [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] - [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] - [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] - [--folder.single] +usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--credential_stores.skip] [--users.skip] + [--plugins.skip] [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] + [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] [--folder.single] options: -h, --help Show this help message and exit. - --instance INSTANCE Jenkins instance string (default: ) + --instance.instance INSTANCE + Jenkins instance string (default: ) --types {instance,folder,all,all} Defines which evidence to create, scoped by scope parameters (default: all) --credential_stores.skip @@ -544,29 +515,25 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include - the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will - discover all folders that are included in a root folder that starts with folder-a. folder-a/* will discover all - folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific + jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] - Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: - JenkinsFolderScope, default: []) + Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the - past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, + default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: - AssetMappingString, default: []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported - (type: AssetMappingString, default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.single Export all repos in a single evidence (default: False) ``` diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index 0c29db5e2..45ba7420e 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -61,8 +61,7 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] - [--log-file LOG_FILE] [--db.local.path PATH] +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... CLI tool for collecting evidence and enforcing policies via CI/CD platform APIs @@ -71,8 +70,8 @@ options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all other arguments and exit. The optional flags customizes the output and - are one or more keywords separated by comma. The supported flags are: comments, skip_default, skip_null. + Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords separated by comma. + The supported flags are: comments, skip_default, skip_null. --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 9f058cc93..a20c26559 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,21 +19,19 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] - [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] - [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] - [--unique] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] - [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] - [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] +usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.scribe.enable] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] + [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] + [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] + [--max-threads MAX_THREADS] {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins} ... Verify supply chain policies options: -h, --help Show this help message and exit. - --valint.scribe.client-secret CLIENT_SECRET + --valint.scribe.client-secret CLIENT_SECRET, --scribe-token CLIENT_SECRET, --scribe-client-secret CLIENT_SECRET Scribe client Secret (type: str, default: ) --valint.scribe.enable Enable Scribe client (default: False) @@ -57,7 +55,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f41239e9ee0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x747b9cb90a40>, default: []) --unique Allow unique assets (default: False) --valint.bundle BUNDLE Set bundle git branch (type: str, default: ) @@ -143,16 +141,15 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] - [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--project.policy [POLICY ...]] [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] +usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] + [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--project.policy [POLICY ...]] + [--organization.policy [POLICY ...]] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE Gitlab instance string (default: ) + --instance.instance INSTANCE + Gitlab instance string (default: ) --token TOKEN Gitlab token (GITLAB_TOKEN, CI_JOB_TOKEN) (default: ) --url URL Gitlab base URL (default: https://gitlab.com/) --types {organization,project,all} @@ -160,19 +157,17 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] Gitlab tags wildcards (default: null) --commit.skip Skip commits in evidence (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of to organization::product_key::product_version (type: - AssetMappingString, default: []) + Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, - default: []) + Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --project.policy [POLICY ...] Set project policy file (type: str, default: ['ct-2@discovery', 'ct-9@discovery']) --organization.policy [POLICY ...] @@ -198,17 +193,16 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] [--instance INSTANCE] [--token TOKEN] [--url URL] - [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] - [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]] +usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE Github instance string (default: ) + --instance.instance INSTANCE + Github instance string (default: ) --token TOKEN Github token (GITHUB_TOKEN, GH_TOKEN) (default: ) --url URL Github base URL (default: https://github.com) --types {organization,repository,all} @@ -216,8 +210,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: []) --scope.tag [TAG ...] @@ -225,11 +219,11 @@ options: --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization - name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) --repository.policy [POLICY ...] Set repository evidence policy file (type: str, default: []) --organization.policy [POLICY ...] @@ -254,19 +248,17 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub [-h] [--instance INSTANCE] [--username USERNAME] [--password PASSWORD] - [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] - [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] - [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] - [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] + [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE Dockerhub instance string (default: ) + --instance.instance INSTANCE + Dockerhub instance string (default: ) --username USERNAME Dockerhub username (default: null) --password PASSWORD Dockerhub password (DOCKERHUB_PASSWORD) (default: null) --token TOKEN Dockerhub token (default: null) @@ -290,11 +282,9 @@ options: --scope.namespace [NAMESPACE ...] Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', - 'ct-13@discovery']) + Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) --policy-skip-aggregate Skip Aggregate policy results (default: False) ``` @@ -333,19 +323,16 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] [--instance INSTANCE] [--url URL] [--token TOKEN] - [--types {namespace,pod,cluster-images,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] - [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] - [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] - [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] - [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] - [--namespace.policy [POLICY ...]] [--policy-skip-aggregate] +usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] + [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] + [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] + [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] [--namespace.policy [POLICY ...]] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE Kubernetes instance string (default: ) + --instance.instance INSTANCE + Kubernetes instance string (default: ) --url URL Kubernetes API URL (required, default: ) --token TOKEN Kubernetes token, with access to pods and secrets (K8S_TOKEN) (default: ) --types {namespace,pod,cluster-images,all} @@ -370,11 +357,10 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace;my-pod;my- - image:product_key:product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, + default: []) --cluster-images.policy [POLICY ...] - Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', - 'ct-13@discovery']) + Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) --namespace.policy [POLICY ...] Set Kubernetes policy file (type: str, default: []) --policy-skip-aggregate @@ -420,21 +406,19 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] [--instance INSTANCE] [--jf_token JF_TOKEN] [--url URL] - [--types {token,repository,jf-repository,all}] +usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] - [--image.policy [POLICY ...]] [--policy-skip-aggregate] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] + [--policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE Jfrog instance string (default: ) - --jf_token JF_TOKEN Jfrog token (JFROG_TOKEN) (default: null) + --instance.instance INSTANCE + Jfrog instance string (default: ) + --token TOKEN Jfrog token (JFROG_TOKEN) (default: null) --url URL Jfrog base URL (default: ) --types {token,repository,jf-repository,all} Defines which evidence to create, scoped by scope parameters (default: all) @@ -457,11 +441,9 @@ options: --exclude.repository_tags [REPOSITORY_TAGS ...] Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] - Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: - []) + Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', - 'ct-13@discovery']) + Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) --policy-skip-aggregate Skip Aggregate policy results (default: False) ``` @@ -481,40 +463,35 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket [-h] [--instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] - [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] [--project.policy [POLICY ...]] - [--workspace.policy [POLICY ...]] [--org-policy-skip-aggregate] - [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] [--url URL] [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--repository.policy [POLICY ...]] + [--project.policy [POLICY ...]] [--workspace.policy [POLICY ...]] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. - --instance INSTANCE BitBucket instance string (default: ) + --instance.instance INSTANCE + BitBucket instance string (default: ) --app_password APP_PASSWORD BitBucket app_password (BB_PASSWORD) (default: ) --username USERNAME BitBucket username (default: null) --workspace_token WORKSPACE_TOKEN - BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username - (BB_WORKSPACE_TOKEN) (default: ) + BitBucket workspace_token can be used with --workspace_name flag instead of --app_password and --username (BB_WORKSPACE_TOKEN) (default: ) --workspace WORKSPACE - BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: - ) + BitBucket workspace_name can be used with --workspace_token flag instead of --app_password and --username (default: ) --url URL BitBucket URL (required, default: https://api.bitbucket.org) --types {workspace,project,repository,all} Defines which evidence to validate, scoped by scope parameters (default: all) --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce - in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' + (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its - namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -523,14 +500,14 @@ options: BitBucket webhook wildcards (default: []) --commit.skip Skip commits in discovery/evidence (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace - name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: + AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, - wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: + AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository - name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: + AssetMappingString, default: []) --repository.policy [POLICY ...] Set repository evidence policy file (type: str, default: []) --project.policy [POLICY ...] diff --git a/docs/valint/configuration.md b/docs/valint/configuration.md index 6baa7eee6..dc4e01c81 100644 --- a/docs/valint/configuration.md +++ b/docs/valint/configuration.md @@ -68,6 +68,13 @@ attest: add-passed: true cocosign: {} x509: {} + fulcio: + enable: false + url: "" + oidc: + auth: "" + issuer: "" + clientid: "" kms: enable: false ref: "" diff --git a/docs/valint/getting-started-valint.md b/docs/valint/getting-started-valint.md index 8b111fd68..885a8f4b4 100644 --- a/docs/valint/getting-started-valint.md +++ b/docs/valint/getting-started-valint.md @@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. -> Latest Version `v1.5.15`. +> Latest Version `v1.5.16`. ### Installing Valint diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index a12fe4b34..3e3ac539a 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,7 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 8c0344dfb..2dc645371 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -51,6 +51,7 @@ Flags for `bom` subcommand | | --platform | Select target platform, examples=windows/armv6, arm64 ..) | | | | --provenance | Include SLSA Provenance evidence | | | | --pubkey | Public key path | | +| -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --supplier-email | Set supplier email | | | | --supplier-name | Set supplier name | | | | --supplier-phone | Set supplier phone | | @@ -69,7 +70,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index fa81f46a5..cb63e2dc0 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,7 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index 893376db6..10ba8620b 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,7 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index f3f4d3203..6b684c8a5 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -36,6 +36,7 @@ Flags for `evidence` subcommand | | --parser | Evidence Parser Name | | | | --pass | Private key password | | | | --pubkey | Public key path | | +| -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --tool | Evidence Tool name | | | | --tool-vendor | Evidence Tool vendor | | | | --tool-version | Evidence Tool version | | @@ -53,7 +54,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index aafb91a97..687e9fb4a 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,7 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index b4d9c0014..69429a91c 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -48,6 +48,7 @@ Flags for `slsa` subcommand | | --platform | Select target platform, examples=windows/armv6, arm64 ..) | | | | --predicate | Import predicate path | | | | --pubkey | Public key path | | +| -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --started-on | Set metadata started time (YYYY-MM-DDThh:mm:ssZ) | | | | --statement | Import statement path | | @@ -64,7 +65,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index 894acd782..e483c77b4 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -59,6 +59,7 @@ Flags for `verify` subcommand | | --rule-args | Policy arguments | [] | | | --rule-label | Run only rules with specified label | | | | --skip-bundle | Skip bundle download | | +| -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --skip-report | Skip Policy report stage | | | | --uri | Default policy allowed uris | | @@ -75,7 +76,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (: or ::) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 365742eb0c31a05b5722ba54c4d24d50d73508c9 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 29 Jan 2025 18:47:49 +0200 Subject: [PATCH 056/191] TEst --- docs/valint/help/valint.md | 2 +- docs/valint/help/valint_bom.md | 2 +- docs/valint/help/valint_discard.md | 2 +- docs/valint/help/valint_download.md | 2 +- docs/valint/help/valint_evidence.md | 2 +- docs/valint/help/valint_list.md | 2 +- docs/valint/help/valint_slsa.md | 2 +- docs/valint/help/valint_verify.md | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index 3e3ac539a..5231ec731 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,7 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 2dc645371..5366c7308 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -70,7 +70,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index cb63e2dc0..3a76db359 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,7 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index 10ba8620b..6456419ce 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,7 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index 6b684c8a5..1773cfc4c 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -54,7 +54,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index 687e9fb4a..36910d856 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,7 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index 69429a91c..aaa4fd8a7 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -65,7 +65,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index e483c77b4..c30690e93 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -76,7 +76,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or ::) | | +| | --input | Input Evidence target, format (: or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 4c3f766a56461f196cae85fafd9e3fcc3677da97 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 29 Jan 2025 18:55:02 +0200 Subject: [PATCH 057/191] mikey fixs= merge main --- docs/valint/help/valint.md | 2 +- docs/valint/help/valint_bom.md | 2 +- docs/valint/help/valint_discard.md | 2 +- docs/valint/help/valint_download.md | 2 +- docs/valint/help/valint_evidence.md | 2 +- docs/valint/help/valint_list.md | 2 +- docs/valint/help/valint_slsa.md | 2 +- docs/valint/help/valint_verify.md | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index 5231ec731..0b399ea61 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,7 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 5366c7308..0955707e5 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -70,7 +70,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index 3a76db359..e8e418813 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,7 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index 6456419ce..8306a8970 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,7 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index 1773cfc4c..587bb3b32 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -54,7 +54,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index 36910d856..ddd57801d 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,7 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index aaa4fd8a7..5789da25c 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -65,7 +65,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index c30690e93..eba8810b2 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -76,7 +76,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (: or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 46d0051cc8e5167556b4f343c25facbbc5c2f38e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 25 Feb 2025 10:28:57 +0200 Subject: [PATCH 058/191] Retrigger --- docs/integrating-scribe/ci-integrations/gitlabci.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/integrating-scribe/ci-integrations/gitlabci.md b/docs/integrating-scribe/ci-integrations/gitlabci.md index 3969ebd57..2204f4e83 100644 --- a/docs/integrating-scribe/ci-integrations/gitlabci.md +++ b/docs/integrating-scribe/ci-integrations/gitlabci.md @@ -112,6 +112,8 @@ custom-ntia-metadata: - valint bom busybox --context-type gitlab --output-directory ./scribe/valint + --author-name bom --author-email bob@company.com + --supplier-name alice --supplier-url company2.com --supplier-email alice@company2.com --supplier-phone 001 ```
From 3bd1ab24877b494de2e87e075a20c65c2c62d9b4 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 2 Mar 2025 15:03:05 +0200 Subject: [PATCH 059/191] Fix action --- .../ci-integrations/github/action-bom.md | 45 ++++++++++++++++++- docs/platforms/github-integration.md | 2 +- 2 files changed, 44 insertions(+), 3 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index b33ac1009..34fdf8e9c 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -320,6 +320,47 @@ jobs:
+### Mapping the DOCKER_CONFIG Environment Variable + +When using a job's Docker daemon to pull private images, you might need to log in to your private registry before running **valint**. To ensure that the containerized action `action-bom` can access your private image, set `DOCKER_CONFIG` to a directory in your workflow that is accessible for mapping. + +Below is an example configuration: + +```yaml +env: + DOCKER_CONFIG: ${{ github.workspace }}/.docker + +steps: + - name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom@master + with: + target: 'scribesecurity/example:latest' +``` + +Alternatively, you can use uncontainerized actions directly: + +```yaml +- name: Login to GitHub Container Registry + uses: docker/login-action@v2 + with: + registry: ${{ env.REGISTRY_URL }} + username: ${{ secrets.REGISTRY_USERNAME }} + password: ${{ secrets.REGISTRY_TOKEN }} + +- name: Generate cyclonedx json SBOM + uses: scribe-security/action-bom-cli@master + with: + target: 'scribesecurity/example:latest' + format: json +``` + ### Running action as non root user By default, the action runs in its own pid namespace as the root user. You can change the user by setting specific `USERID` and `USERNAME` environment variables. @@ -464,7 +505,7 @@ Create SBOM for image hosted by a private registry. ```YAML env: - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker steps: - name: Login to GitHub Container Registry uses: docker/login-action@v2 @@ -477,7 +518,7 @@ steps: uses: scribe-security/action-bom@master with: target: 'scribesecurity/example:latest' - force: true + ``` diff --git a/docs/platforms/github-integration.md b/docs/platforms/github-integration.md index 22f5da5c3..a7af8ae92 100644 --- a/docs/platforms/github-integration.md +++ b/docs/platforms/github-integration.md @@ -79,7 +79,7 @@ env: LOG_LEVEL: "INFO" VALINT_SCRIBE_ENABLE: true DOCKER_DRIVER: overlay2 - DOCKER_CONFIG: $HOME/.docker + DOCKER_CONFIG: ${{ github.workspace }}/.docker DOCKERHUB_USERNAME: scribesecurity SCRIBE_PRODUCT_VERSION: "v0.0.2-github" From 6f5af3681418af23ba3ad763f2af6c3f53b0aae8 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 5 Mar 2025 09:41:44 +0200 Subject: [PATCH 060/191] upstream --- docs/integrating-scribe/ci-integrations/github/action-bom.md | 4 ++-- .../ci-integrations/github/action-evidence.md | 4 ++-- docs/integrating-scribe/ci-integrations/github/action-slsa.md | 4 ++-- .../ci-integrations/github/action-verify.md | 4 ++-- docs/valint/getting-started-valint.md | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 34fdf8e9c..9ffafb99f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -173,7 +173,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.16 + uses: scribe-security/action-bom@v1.5.18 with: target: 'busybox:latest' ``` @@ -181,7 +181,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.16 + uses: scribe-security/action-bom-cli@v1.5.18 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 6de195652..b8157882f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -138,7 +138,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.16 + uses: scribe-security/action-evidence@v1.5.18 with: target: some_file.json ``` @@ -146,7 +146,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.16 + uses: scribe-security/action-evidence-cli@v1.5.18 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 6c881b971..c125c10c7 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -157,7 +157,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.16 + uses: scribe-security/action-slsa@v1.5.18 with: target: 'busybox:latest' ``` @@ -165,7 +165,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.16 + uses: scribe-security/action-slsa-cli@v1.5.18 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index e8263bbfd..c1dcb1b5b 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.16 + uses: scribe-security/action-verify@v1.5.18 with: target: 'busybox:latest' ``` @@ -177,7 +177,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.16 + uses: scribe-security/action-verify-cli@v1.5.18 with: target: 'hello-world:latest' ``` diff --git a/docs/valint/getting-started-valint.md b/docs/valint/getting-started-valint.md index 885a8f4b4..ad9923716 100644 --- a/docs/valint/getting-started-valint.md +++ b/docs/valint/getting-started-valint.md @@ -11,7 +11,7 @@ Valint is a tool used to manage `evidence` generation (for directories, file art Valint also enables you to **capture** any 3rd party report, scan or configuration (any file) into evidence. -> Latest Version `v1.5.16`. +> Latest Version `v1.5.18`. ### Installing Valint From f8856cccfb346e56e7d0f88774fb164dd074c844 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:19:07 +0200 Subject: [PATCH 061/191] tmp gen docs --- docs/configuration/initiatives/bp1.md | 262 ++++++++++++++++++ docs/configuration/initiatives/slsa.l1.md | 45 +++ docs/configuration/initiatives/slsa.l2.md | 46 +++ docs/configuration/initiatives/ssdf.md | 88 ++++++ .../rules/api/scribe-api-cve-product.md | 18 ++ .../configuration/rules/api/scribe-api-cve.md | 27 ++ .../rules/api/scribe-api-published.md | 24 ++ docs/configuration/rules/api/scribe-api.md | 24 ++ .../rules/bitbucket/project/allow-admins.md | 25 ++ .../rules/bitbucket/project/allow-users.md | 25 ++ .../bitbucket/project/exposed-credentials.md | 22 ++ .../bitbucket/project/long-live-tokens.md | 25 ++ .../bitbucket/repository/allow-admins.md | 26 ++ .../rules/bitbucket/repository/allow-users.md | 26 ++ .../bitbucket/repository/branch-protection.md | 26 ++ .../rules/bitbucket/workspace/allow-admins.md | 26 ++ .../rules/bitbucket/workspace/allow-users.md | 26 ++ .../rules/dockerhub/token-expiration.md | 22 ++ .../rules/dockerhub/token-not-used.md | 22 ++ .../rules/generic/artifact-signed.md | 21 ++ .../rules/generic/evidence-exists.md | 20 ++ .../rules/generic/k8s-jailbreak.md | 21 ++ .../rules/generic/trivy-exists.md | 19 ++ .../rules/git/artifact-signed.md | 26 ++ .../rules/git/coding-permissions.md | 27 ++ .../rules/git/evidence-exists.md | 22 ++ .../rules/git/no-commit-to-main.md | 22 ++ .../rules/git/no-unsigned-commits.md | 22 ++ .../rules/github/api/branch-protection.md | 21 ++ .../rules/github/api/signed-commits-list.md | 20 ++ .../rules/github/api/signed-commits-range.md | 22 ++ docs/configuration/rules/github/org/2fa.md | 26 ++ .../rules/github/org/advanced-security.md | 26 ++ .../rules/github/org/allow-admins.md | 26 ++ .../rules/github/org/allow-users.md | 26 ++ .../rules/github/org/create-private-repos.md | 26 ++ .../rules/github/org/create-repos.md | 26 ++ .../rules/github/org/dependabot-alerts.md | 26 ++ .../org/dependabot-security-updates-sa.md | 22 ++ .../github/org/dependabot-security-updates.md | 26 ++ .../rules/github/org/dependency-graph.md | 26 ++ .../rules/github/org/max-admins.md | 26 ++ .../rules/github/org/old-secrets.md | 26 ++ .../rules/github/org/pp-custom-link.md | 26 ++ .../rules/github/org/push-protection-sa.md | 22 ++ .../rules/github/org/push-protection.md | 26 ++ .../rules/github/org/repo-visibility.md | 26 ++ .../rules/github/org/secret-scanning-sa.md | 22 ++ .../rules/github/org/secret-scanning.md | 26 ++ .../rules/github/org/validity-checks-sa.md | 22 ++ .../rules/github/org/validity-checks.md | 26 ++ .../rules/github/org/web-commit-signoff.md | 22 ++ .../github/repository/branch-protection.md | 27 ++ .../github/repository/branch-verification.md | 26 ++ .../github/repository/check-signed-commits.md | 22 ++ .../repository/default-branch-protection.md | 22 ++ .../rules/github/repository/dependabot.md | 22 ++ .../repository/ephemeral-runners-only.md | 22 ++ .../rules/github/repository/no-cache-usage.md | 22 ++ .../rules/github/repository/no-org-secrets.md | 22 ++ .../rules/github/repository/old-secrets.md | 26 ++ .../github/repository/push-protection.md | 22 ++ .../rules/github/repository/repo-private.md | 22 ++ .../github/repository/secret-scanning.md | 22 ++ .../rules/github/repository/signed-commits.md | 22 ++ .../github/repository/validity-checks.md | 22 ++ .../rules/github/repository/visibility.md | 26 ++ .../github/repository/web-commit-signoff.md | 22 ++ .../rules/gitlab/api/push-rules.md | 19 ++ .../rules/gitlab/api/signed-commits-list.md | 19 ++ .../rules/gitlab/api/signed-commits-range.md | 20 ++ .../rules/gitlab/org/allow-admins.md | 26 ++ .../rules/gitlab/org/allow-token-scopes.md | 26 ++ .../rules/gitlab/org/allow-users.md | 26 ++ .../rules/gitlab/org/blocked-users.md | 26 ++ .../rules/gitlab/org/expiring-tokens.md | 26 ++ .../rules/gitlab/org/forbid-token-scopes.md | 26 ++ .../rules/gitlab/org/inactive-projects.md | 26 ++ .../rules/gitlab/org/longlive-tokens.md | 26 ++ .../rules/gitlab/org/max-admins.md | 26 ++ .../rules/gitlab/org/projects-visibility.md | 26 ++ .../rules/gitlab/org/unused-tokens.md | 26 ++ .../gitlab/pipeline/verify-labels-exist.md | 26 ++ .../rules/gitlab/pipeline/verify-labels.md | 26 ++ .../rules/gitlab/project/abandoned-project.md | 26 ++ .../gitlab/project/approvals-policy-check.md | 27 ++ .../project/approvers-per-merge-request.md | 26 ++ .../gitlab/project/author-email-regex.md | 26 ++ .../rules/gitlab/project/check-cwe.md | 26 ++ .../gitlab/project/check-signed-commits.md | 22 ++ .../gitlab/project/co-approval-required.md | 26 ++ .../project/commit-author-email-check.md | 26 ++ .../project/commit-author-name-check.md | 26 ++ .../gitlab/project/commit-committer-check.md | 22 ++ .../gitlab/project/commit-message-check.md | 26 ++ .../rules/gitlab/project/commits-validated.md | 22 ++ .../gitlab/project/committer-email-check.md | 26 ++ .../gitlab/project/committer-name-check.md | 26 ++ .../gitlab/project/critical-severity-limit.md | 26 ++ .../project/description-substring-check.md | 26 ++ .../project/disallowed-banned-approvers.md | 26 ++ .../gitlab/project/force-push-protection.md | 26 ++ .../gitlab/project/medium-severity-limit.md | 26 ++ .../rules/gitlab/project/member-check.md | 22 ++ .../gitlab/project/merge-access-level.md | 27 ++ .../project/merge-requests-author-approval.md | 26 ++ ...ge-requests-disable-committers-approval.md | 26 ++ .../gitlab/project/message-substring-check.md | 26 ++ .../gitlab/project/prevent-secrets-check.md | 22 ++ .../gitlab/project/protect-ci-secrets.md | 26 ++ .../rules/gitlab/project/push-access-level.md | 27 ++ .../rules/gitlab/project/push-rules-set.md | 22 ++ .../gitlab/project/reject-unsigned-commits.md | 22 ++ .../project/require-password-to-approve.md | 26 ++ .../project/required-minimal-approvers.md | 22 ++ .../gitlab/project/reset-pprovals-on-push.md | 26 ++ .../rules/gitlab/project/sast-scan-pass.md | 22 ++ .../rules/gitlab/project/sast-scanning.md | 22 ++ .../rules/gitlab/project/secrets-scan-pass.md | 22 ++ .../rules/gitlab/project/secrets-scanning.md | 22 ++ .../project/selective-code-owner-removals.md | 26 ++ .../rules/gitlab/project/visibility-check.md | 26 ++ .../rules/images/blocklist-build-scripts.md | 35 +++ .../rules/images/forbid-large-images.md | 44 +++ .../configuration/rules/images/fresh-image.md | 41 +++ .../rules/images/restrict-shell-entrypoint.md | 30 ++ .../rules/images/verify-labels-exist.md | 44 +++ .../rules/images/verify-labels.md | 44 +++ .../jenkins/folder/exposed-credentials.md | 22 ++ .../rules/jenkins/instance/inactive-users.md | 25 ++ .../rules/jenkins/instance/unused-users.md | 21 ++ .../rules/k8s/namespace/allowed-images.md | 26 ++ .../rules/k8s/namespace/allowed-registries.md | 26 ++ .../namespace/verify-namespace-duration.md | 26 ++ .../namespace/verify-namespace-termination.md | 26 ++ .../k8s/namespace/white-listed-namespaces.md | 26 ++ .../rules/k8s/namespace/white-listed-pod.md | 27 ++ .../rules/k8s/pods/verify-pod-duration.md | 26 ++ .../rules/k8s/pods/verify-pod-termination.md | 22 ++ .../rules/k8s/pods/white-listed-pod.md | 27 ++ .../rules/multievidence/files_integrity.md | 26 ++ .../rules/sarif/artifact-signed.md | 25 ++ .../rules/sarif/evidence-exists.md | 21 ++ .../rules/sarif/patcheck/updates-needed.md | 21 ++ .../rules/sarif/report-iac-errors.md | 25 ++ .../sarif/trivy/report-trivy-iac-errors.md | 25 ++ .../sarif/trivy/verify-trivy-attack-vector.md | 26 ++ .../rules/sarif/trivy/verify-trivy-report.md | 30 ++ .../rules/sarif/verify-attack-vector.md | 26 ++ .../configuration/rules/sarif/verify-sarif.md | 29 ++ .../rules/sarif/verify-semgrep-report.md | 26 ++ .../rules/sarif/verify-tool-evidence.md | 22 ++ .../rules/sbom/allowed-components.md | 27 ++ .../rules/sbom/artifact-signed.md | 25 ++ .../rules/sbom/banned-licenses.md | 27 ++ docs/configuration/rules/sbom/banned-users.md | 24 ++ .../rules/sbom/blocklist-packages.md | 27 ++ .../rules/sbom/complete-licenses.md | 22 ++ .../rules/sbom/evidence-exists.md | 21 ++ docs/configuration/rules/sbom/fresh-sbom.md | 25 ++ .../rules/sbom/required-packages.md | 27 ++ .../rules/sbom/verify-huggingface-license.md | 26 ++ .../rules/slsa/banned-builder-deps.md | 24 ++ docs/configuration/rules/slsa/build-time.md | 26 ++ docs/configuration/rules/slsa/field-exists.md | 25 ++ .../rules/slsa/l1-provenance-exists.md | 26 ++ .../rules/slsa/l2-provenance-authenticated.md | 31 +++ .../rules/slsa/verify-builder.md | 26 ++ .../rules/slsa/verify-byproducts.md | 24 ++ docs/configuration/rules/ssdf/ps-1-2fa.md | 21 ++ .../rules/ssdf/ps-1-branch-protection.md | 21 ++ .../rules/ssdf/ps-1-limit-admins.md | 21 ++ .../rules/ssdf/ps-1-repo-private.md | 21 ++ .../rules/ssdf/ps-1-web-commit-signoff.md | 21 ++ .../rules/ssdf/ps-2-image-verifiable.md | 22 ++ .../rules/ssdf/ps-3.1-code-archived.md | 26 ++ .../rules/ssdf/ps-3.2-archived-sbom.md | 17 ++ scripts/sync_docs.sh | 53 ++-- 178 files changed, 4782 insertions(+), 16 deletions(-) create mode 100644 docs/configuration/initiatives/bp1.md create mode 100644 docs/configuration/initiatives/slsa.l1.md create mode 100644 docs/configuration/initiatives/slsa.l2.md create mode 100644 docs/configuration/initiatives/ssdf.md create mode 100644 docs/configuration/rules/api/scribe-api-cve-product.md create mode 100644 docs/configuration/rules/api/scribe-api-cve.md create mode 100644 docs/configuration/rules/api/scribe-api-published.md create mode 100644 docs/configuration/rules/api/scribe-api.md create mode 100644 docs/configuration/rules/bitbucket/project/allow-admins.md create mode 100644 docs/configuration/rules/bitbucket/project/allow-users.md create mode 100644 docs/configuration/rules/bitbucket/project/exposed-credentials.md create mode 100644 docs/configuration/rules/bitbucket/project/long-live-tokens.md create mode 100644 docs/configuration/rules/bitbucket/repository/allow-admins.md create mode 100644 docs/configuration/rules/bitbucket/repository/allow-users.md create mode 100644 docs/configuration/rules/bitbucket/repository/branch-protection.md create mode 100644 docs/configuration/rules/bitbucket/workspace/allow-admins.md create mode 100644 docs/configuration/rules/bitbucket/workspace/allow-users.md create mode 100644 docs/configuration/rules/dockerhub/token-expiration.md create mode 100644 docs/configuration/rules/dockerhub/token-not-used.md create mode 100644 docs/configuration/rules/generic/artifact-signed.md create mode 100644 docs/configuration/rules/generic/evidence-exists.md create mode 100644 docs/configuration/rules/generic/k8s-jailbreak.md create mode 100644 docs/configuration/rules/generic/trivy-exists.md create mode 100644 docs/configuration/rules/git/artifact-signed.md create mode 100644 docs/configuration/rules/git/coding-permissions.md create mode 100644 docs/configuration/rules/git/evidence-exists.md create mode 100644 docs/configuration/rules/git/no-commit-to-main.md create mode 100644 docs/configuration/rules/git/no-unsigned-commits.md create mode 100644 docs/configuration/rules/github/api/branch-protection.md create mode 100644 docs/configuration/rules/github/api/signed-commits-list.md create mode 100644 docs/configuration/rules/github/api/signed-commits-range.md create mode 100644 docs/configuration/rules/github/org/2fa.md create mode 100644 docs/configuration/rules/github/org/advanced-security.md create mode 100644 docs/configuration/rules/github/org/allow-admins.md create mode 100644 docs/configuration/rules/github/org/allow-users.md create mode 100644 docs/configuration/rules/github/org/create-private-repos.md create mode 100644 docs/configuration/rules/github/org/create-repos.md create mode 100644 docs/configuration/rules/github/org/dependabot-alerts.md create mode 100644 docs/configuration/rules/github/org/dependabot-security-updates-sa.md create mode 100644 docs/configuration/rules/github/org/dependabot-security-updates.md create mode 100644 docs/configuration/rules/github/org/dependency-graph.md create mode 100644 docs/configuration/rules/github/org/max-admins.md create mode 100644 docs/configuration/rules/github/org/old-secrets.md create mode 100644 docs/configuration/rules/github/org/pp-custom-link.md create mode 100644 docs/configuration/rules/github/org/push-protection-sa.md create mode 100644 docs/configuration/rules/github/org/push-protection.md create mode 100644 docs/configuration/rules/github/org/repo-visibility.md create mode 100644 docs/configuration/rules/github/org/secret-scanning-sa.md create mode 100644 docs/configuration/rules/github/org/secret-scanning.md create mode 100644 docs/configuration/rules/github/org/validity-checks-sa.md create mode 100644 docs/configuration/rules/github/org/validity-checks.md create mode 100644 docs/configuration/rules/github/org/web-commit-signoff.md create mode 100644 docs/configuration/rules/github/repository/branch-protection.md create mode 100644 docs/configuration/rules/github/repository/branch-verification.md create mode 100644 docs/configuration/rules/github/repository/check-signed-commits.md create mode 100644 docs/configuration/rules/github/repository/default-branch-protection.md create mode 100644 docs/configuration/rules/github/repository/dependabot.md create mode 100644 docs/configuration/rules/github/repository/ephemeral-runners-only.md create mode 100644 docs/configuration/rules/github/repository/no-cache-usage.md create mode 100644 docs/configuration/rules/github/repository/no-org-secrets.md create mode 100644 docs/configuration/rules/github/repository/old-secrets.md create mode 100644 docs/configuration/rules/github/repository/push-protection.md create mode 100644 docs/configuration/rules/github/repository/repo-private.md create mode 100644 docs/configuration/rules/github/repository/secret-scanning.md create mode 100644 docs/configuration/rules/github/repository/signed-commits.md create mode 100644 docs/configuration/rules/github/repository/validity-checks.md create mode 100644 docs/configuration/rules/github/repository/visibility.md create mode 100644 docs/configuration/rules/github/repository/web-commit-signoff.md create mode 100644 docs/configuration/rules/gitlab/api/push-rules.md create mode 100644 docs/configuration/rules/gitlab/api/signed-commits-list.md create mode 100644 docs/configuration/rules/gitlab/api/signed-commits-range.md create mode 100644 docs/configuration/rules/gitlab/org/allow-admins.md create mode 100644 docs/configuration/rules/gitlab/org/allow-token-scopes.md create mode 100644 docs/configuration/rules/gitlab/org/allow-users.md create mode 100644 docs/configuration/rules/gitlab/org/blocked-users.md create mode 100644 docs/configuration/rules/gitlab/org/expiring-tokens.md create mode 100644 docs/configuration/rules/gitlab/org/forbid-token-scopes.md create mode 100644 docs/configuration/rules/gitlab/org/inactive-projects.md create mode 100644 docs/configuration/rules/gitlab/org/longlive-tokens.md create mode 100644 docs/configuration/rules/gitlab/org/max-admins.md create mode 100644 docs/configuration/rules/gitlab/org/projects-visibility.md create mode 100644 docs/configuration/rules/gitlab/org/unused-tokens.md create mode 100644 docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md create mode 100644 docs/configuration/rules/gitlab/pipeline/verify-labels.md create mode 100644 docs/configuration/rules/gitlab/project/abandoned-project.md create mode 100644 docs/configuration/rules/gitlab/project/approvals-policy-check.md create mode 100644 docs/configuration/rules/gitlab/project/approvers-per-merge-request.md create mode 100644 docs/configuration/rules/gitlab/project/author-email-regex.md create mode 100644 docs/configuration/rules/gitlab/project/check-cwe.md create mode 100644 docs/configuration/rules/gitlab/project/check-signed-commits.md create mode 100644 docs/configuration/rules/gitlab/project/co-approval-required.md create mode 100644 docs/configuration/rules/gitlab/project/commit-author-email-check.md create mode 100644 docs/configuration/rules/gitlab/project/commit-author-name-check.md create mode 100644 docs/configuration/rules/gitlab/project/commit-committer-check.md create mode 100644 docs/configuration/rules/gitlab/project/commit-message-check.md create mode 100644 docs/configuration/rules/gitlab/project/commits-validated.md create mode 100644 docs/configuration/rules/gitlab/project/committer-email-check.md create mode 100644 docs/configuration/rules/gitlab/project/committer-name-check.md create mode 100644 docs/configuration/rules/gitlab/project/critical-severity-limit.md create mode 100644 docs/configuration/rules/gitlab/project/description-substring-check.md create mode 100644 docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md create mode 100644 docs/configuration/rules/gitlab/project/force-push-protection.md create mode 100644 docs/configuration/rules/gitlab/project/medium-severity-limit.md create mode 100644 docs/configuration/rules/gitlab/project/member-check.md create mode 100644 docs/configuration/rules/gitlab/project/merge-access-level.md create mode 100644 docs/configuration/rules/gitlab/project/merge-requests-author-approval.md create mode 100644 docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md create mode 100644 docs/configuration/rules/gitlab/project/message-substring-check.md create mode 100644 docs/configuration/rules/gitlab/project/prevent-secrets-check.md create mode 100644 docs/configuration/rules/gitlab/project/protect-ci-secrets.md create mode 100644 docs/configuration/rules/gitlab/project/push-access-level.md create mode 100644 docs/configuration/rules/gitlab/project/push-rules-set.md create mode 100644 docs/configuration/rules/gitlab/project/reject-unsigned-commits.md create mode 100644 docs/configuration/rules/gitlab/project/require-password-to-approve.md create mode 100644 docs/configuration/rules/gitlab/project/required-minimal-approvers.md create mode 100644 docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md create mode 100644 docs/configuration/rules/gitlab/project/sast-scan-pass.md create mode 100644 docs/configuration/rules/gitlab/project/sast-scanning.md create mode 100644 docs/configuration/rules/gitlab/project/secrets-scan-pass.md create mode 100644 docs/configuration/rules/gitlab/project/secrets-scanning.md create mode 100644 docs/configuration/rules/gitlab/project/selective-code-owner-removals.md create mode 100644 docs/configuration/rules/gitlab/project/visibility-check.md create mode 100644 docs/configuration/rules/images/blocklist-build-scripts.md create mode 100644 docs/configuration/rules/images/forbid-large-images.md create mode 100644 docs/configuration/rules/images/fresh-image.md create mode 100644 docs/configuration/rules/images/restrict-shell-entrypoint.md create mode 100644 docs/configuration/rules/images/verify-labels-exist.md create mode 100644 docs/configuration/rules/images/verify-labels.md create mode 100644 docs/configuration/rules/jenkins/folder/exposed-credentials.md create mode 100644 docs/configuration/rules/jenkins/instance/inactive-users.md create mode 100644 docs/configuration/rules/jenkins/instance/unused-users.md create mode 100644 docs/configuration/rules/k8s/namespace/allowed-images.md create mode 100644 docs/configuration/rules/k8s/namespace/allowed-registries.md create mode 100644 docs/configuration/rules/k8s/namespace/verify-namespace-duration.md create mode 100644 docs/configuration/rules/k8s/namespace/verify-namespace-termination.md create mode 100644 docs/configuration/rules/k8s/namespace/white-listed-namespaces.md create mode 100644 docs/configuration/rules/k8s/namespace/white-listed-pod.md create mode 100644 docs/configuration/rules/k8s/pods/verify-pod-duration.md create mode 100644 docs/configuration/rules/k8s/pods/verify-pod-termination.md create mode 100644 docs/configuration/rules/k8s/pods/white-listed-pod.md create mode 100644 docs/configuration/rules/multievidence/files_integrity.md create mode 100644 docs/configuration/rules/sarif/artifact-signed.md create mode 100644 docs/configuration/rules/sarif/evidence-exists.md create mode 100644 docs/configuration/rules/sarif/patcheck/updates-needed.md create mode 100644 docs/configuration/rules/sarif/report-iac-errors.md create mode 100644 docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md create mode 100644 docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md create mode 100644 docs/configuration/rules/sarif/trivy/verify-trivy-report.md create mode 100644 docs/configuration/rules/sarif/verify-attack-vector.md create mode 100644 docs/configuration/rules/sarif/verify-sarif.md create mode 100644 docs/configuration/rules/sarif/verify-semgrep-report.md create mode 100644 docs/configuration/rules/sarif/verify-tool-evidence.md create mode 100644 docs/configuration/rules/sbom/allowed-components.md create mode 100644 docs/configuration/rules/sbom/artifact-signed.md create mode 100644 docs/configuration/rules/sbom/banned-licenses.md create mode 100644 docs/configuration/rules/sbom/banned-users.md create mode 100644 docs/configuration/rules/sbom/blocklist-packages.md create mode 100644 docs/configuration/rules/sbom/complete-licenses.md create mode 100644 docs/configuration/rules/sbom/evidence-exists.md create mode 100644 docs/configuration/rules/sbom/fresh-sbom.md create mode 100644 docs/configuration/rules/sbom/required-packages.md create mode 100644 docs/configuration/rules/sbom/verify-huggingface-license.md create mode 100644 docs/configuration/rules/slsa/banned-builder-deps.md create mode 100644 docs/configuration/rules/slsa/build-time.md create mode 100644 docs/configuration/rules/slsa/field-exists.md create mode 100644 docs/configuration/rules/slsa/l1-provenance-exists.md create mode 100644 docs/configuration/rules/slsa/l2-provenance-authenticated.md create mode 100644 docs/configuration/rules/slsa/verify-builder.md create mode 100644 docs/configuration/rules/slsa/verify-byproducts.md create mode 100644 docs/configuration/rules/ssdf/ps-1-2fa.md create mode 100644 docs/configuration/rules/ssdf/ps-1-branch-protection.md create mode 100644 docs/configuration/rules/ssdf/ps-1-limit-admins.md create mode 100644 docs/configuration/rules/ssdf/ps-1-repo-private.md create mode 100644 docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md create mode 100644 docs/configuration/rules/ssdf/ps-2-image-verifiable.md create mode 100644 docs/configuration/rules/ssdf/ps-3.1-code-archived.md create mode 100644 docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md new file mode 100644 index 000000000..3c1eae405 --- /dev/null +++ b/docs/configuration/initiatives/bp1.md @@ -0,0 +1,262 @@ +# Venafi Blueprint +**Type:** Initiative +**ID:** `blueprint-securesoftwarepipeline` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/bp1.yaml) + +A comprehensive framework to secure the software supply chain by integrating robust security controls throughout the development lifecycle. + + +## Mitigation +By enforcing layered security controls across all phases of the software development lifecycle, this initiative significantly reduces the risk of supply chain compromises and ensures that only verified and trustworthy software components are deployed. + +**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline +> Evidence for this initiative **IS** required by default.** + +## **Description** + +This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [CT-1](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | Only accept commits signed with a developer GPG key | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [CT-3](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [CT-4](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [CT-6](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [CT-8](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [CT-9](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [CT-11](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [CT-12](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [CT-13](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | True | + +--- + +# Detailed Controls + +## [CT-1] Restrict administrative access to CI/CD tools + +Restrict administrative access to CI/CD tools + + +### Mitigation +Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. + +### **Description** + +It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls. + +Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication. + +> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](../rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | + +## [CT-2] Only accept commits signed with a developer GPG key + +Only accept commits signed with a developer GPG key + + +### Mitigation +Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. + +### **Description** + +Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers. + +> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](../rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](../rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | + +## [CT-3] Automation access keys expire automatically + +Automation access keys expire automatically + + +### Mitigation +Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. + +### **Description** + +Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised. + +> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](../rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | + +## [CT-4] Reduce automation access to read-only + +Reduce automation access to read-only + + +### Mitigation +Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. + +### **Description** + +CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. + +> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](../rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | + +## [CT-6] Any critical or high severity vulnerability breaks the build + +Any critical or high severity vulnerability breaks the build + + +### Mitigation +Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. + +### **Description** + +Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged. + +> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored. + +Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process. + +> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CT-8] Validate artifact digest + +Validate artifact digest + + +### Mitigation +Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. + +### **Description** + +Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised. + +> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/evidence-exists.md) | [Require SBOM Existence](../rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | + +## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + +Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + + +### Mitigation +Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. + +### **Description** + +Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight. + +> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](../rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | + +## [CT-11] Available container images don’t have any high or critical vulnerabilities + +Available container images don’t have any high or critical vulnerabilities + + +### Mitigation +Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. + +### **Description** + +Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities. + +> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CT-12] Validate artifact signatures and digests + +Validate artifact signatures and digests + + +### Mitigation +Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. + +### **Description** + +Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment. + +> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](../rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | + +## [CT-13] Scan deployed images in production + +Scan deployed images in production + + +### Mitigation +Continuously monitor and scan production images to ensure ongoing compliance with security standards. + +### **Description** + +Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production. + +> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](../rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](../rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md new file mode 100644 index 000000000..76fde98bf --- /dev/null +++ b/docs/configuration/initiatives/slsa.l1.md @@ -0,0 +1,45 @@ +# SLSA L1 Framework” +**Type:** Initiative +**ID:** `SLSA.L1` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l1.yaml) + +Evaluate SLSA L1 + +**Help:** https://slsa.dev/ +> Evidence for this initiative **IS NOT** required by default but is recommended. + +## **Description** + +This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [prov_exists](#prov_exists-provenance-exists) | Provenance exists | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [prov_exists] Provenance exists + +This control verifies that essential provenance metadata is present for each build artifact. + + +### Mitigation +Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](../rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md new file mode 100644 index 000000000..bfe0c0724 --- /dev/null +++ b/docs/configuration/initiatives/slsa.l2.md @@ -0,0 +1,46 @@ +# SLSA L2 Framework” +**Type:** Initiative +**ID:** `SLSA.L2` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l2.yaml) + +Evaluate SLSA Level 2 + +**Help:** https://slsa.dev/ +> Evidence for this initiative **IS NOT** required by default but is recommended. + +## **Description** + +Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [prov_authn](#prov_authn-provenance-authenticated) | Provenance authenticated | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [prov_authn] Provenance authenticated + +Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. + + +### Mitigation +Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](../rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](../rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md new file mode 100644 index 000000000..22753fdea --- /dev/null +++ b/docs/configuration/initiatives/ssdf.md @@ -0,0 +1,88 @@ +# SSDF Client Initiative +**Type:** Initiative +**ID:** `SSDF` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/ssdf.yaml) + +Evaluate PS rules from the SSDF initiative + +**Help:** https://csrc.nist.gov/pubs/sp/800/218/final +> Evidence for this initiative **IS NOT** required by default but is recommended. + +## **Description** + +This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. + | +| [](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. + | +| [](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. + | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [] SSDF-IMAGE + +Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. + + +### Mitigation +Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](../rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](../rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | + +## [] SSDF-ORG + +Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. + + +### Mitigation +Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.1.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](../rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](../rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](../rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | + +## [] SSDF-REPO + +Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. + + +### Mitigation +Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.3.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](../rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + | +| [PS.1.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](../rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-repo-private.md) | [Repo private](../rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | diff --git a/docs/configuration/rules/api/scribe-api-cve-product.md b/docs/configuration/rules/api/scribe-api-cve-product.md new file mode 100644 index 000000000..771566344 --- /dev/null +++ b/docs/configuration/rules/api/scribe-api-cve-product.md @@ -0,0 +1,18 @@ +# Verify No Critical or High Vulnerabilities in Product +**Type:** Rule +**ID:** `scribe-cve-product` +**Uses:** `api/scribe-api-cve-product@v2/rules` +**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-cve-product.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.rego) +**Labels:** SCA, Blueprint, Scribe + +Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. +> Rule requires the Scribe API to be enabled. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | {'cve': {'max': 0, 'severity': 6}} | diff --git a/docs/configuration/rules/api/scribe-api-cve.md b/docs/configuration/rules/api/scribe-api-cve.md new file mode 100644 index 000000000..6c1eefd22 --- /dev/null +++ b/docs/configuration/rules/api/scribe-api-cve.md @@ -0,0 +1,27 @@ +# Verify No Critical or High Vulnerabilities +**Type:** Rule +**ID:** `scribe-cve` +**Uses:** `api/scribe-api-cve@v2/rules` +**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-cve.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.rego) +**Labels:** SCA, Blueprint, Scribe + +Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). + +> Rule Result will be set as 'open' if evidence is missing. +> Rule requires the Scribe API to be enabled. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | {'cve': {'max': 0, 'severity': 6}} | diff --git a/docs/configuration/rules/api/scribe-api-published.md b/docs/configuration/rules/api/scribe-api-published.md new file mode 100644 index 000000000..ea876ae30 --- /dev/null +++ b/docs/configuration/rules/api/scribe-api-published.md @@ -0,0 +1,24 @@ +# Scribe Published Policy +**Type:** Rule +**ID:** `scribe-published-policy` +**Uses:** `api/scribe-api-published@v2/rules` +**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-published.yaml) +**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-published.rego) +**Labels:** Scribe + +Verify image Scribe Publish flag is set for container image. + +> Rule Result will be set as 'open' if evidence is missing. +> Rule requires the Scribe API to be enabled. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | {'published': None} | diff --git a/docs/configuration/rules/api/scribe-api.md b/docs/configuration/rules/api/scribe-api.md new file mode 100644 index 000000000..a3d8704be --- /dev/null +++ b/docs/configuration/rules/api/scribe-api.md @@ -0,0 +1,24 @@ +# Apply Scribe Template Policy +**Type:** Rule +**ID:** `scribe-template` +**Uses:** `api/scribe-api@v2/rules` +**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.yaml) +**Labels:** Scribe + +Verify XX using the Scribe API template rule. + +> Rule Result will be set as 'open' if evidence is missing. +> Rule requires the Scribe API to be enabled. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| predicate_type | https://cyclonedx.org/bom | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | None | diff --git a/docs/configuration/rules/bitbucket/project/allow-admins.md b/docs/configuration/rules/bitbucket/project/allow-admins.md new file mode 100644 index 000000000..f53b37763 --- /dev/null +++ b/docs/configuration/rules/bitbucket/project/allow-admins.md @@ -0,0 +1,25 @@ +# Allowed Project Admins +**Type:** Rule +**ID:** `bb-project-allowed-project-admins` +**Uses:** `bitbucket/project/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-admins.rego) + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | diff --git a/docs/configuration/rules/bitbucket/project/allow-users.md b/docs/configuration/rules/bitbucket/project/allow-users.md new file mode 100644 index 000000000..9301eab95 --- /dev/null +++ b/docs/configuration/rules/bitbucket/project/allow-users.md @@ -0,0 +1,25 @@ +# Allowed Project Users +**Type:** Rule +**ID:** `bb-project-allowed-project-users` +**Uses:** `bitbucket/project/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-users.rego) + +Verify only users specified in the Allowed List have user access to the Bitbucket project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | diff --git a/docs/configuration/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/rules/bitbucket/project/exposed-credentials.md new file mode 100644 index 000000000..c8b857d62 --- /dev/null +++ b/docs/configuration/rules/bitbucket/project/exposed-credentials.md @@ -0,0 +1,22 @@ +# Prevent Credential Exposure +**Type:** Rule +**ID:** `bb-project-exposed-credentials` +**Uses:** `bitbucket/project/exposed-credentials@v2/rules` +**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/exposed-credentials.rego) +**Labels:** Bitbucket, Project + +Verify access to the Bitbucket project is blocked if exposed credentials are detected. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + diff --git a/docs/configuration/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/rules/bitbucket/project/long-live-tokens.md new file mode 100644 index 000000000..7b4b4d11f --- /dev/null +++ b/docs/configuration/rules/bitbucket/project/long-live-tokens.md @@ -0,0 +1,25 @@ +# Prevent Long-Lived Tokens +**Type:** Rule +**ID:** `bb-project-long-live-tokens` +**Uses:** `bitbucket/project/long-live-tokens@v2/rules` +**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/long-live-tokens.yaml) +**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/long-live-tokens.rego) +**Labels:** Bitbucket, Project + +Verify Bitbucket API tokens expire before the maximum time to live. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 30 | diff --git a/docs/configuration/rules/bitbucket/repository/allow-admins.md b/docs/configuration/rules/bitbucket/repository/allow-admins.md new file mode 100644 index 000000000..ef73ab6f7 --- /dev/null +++ b/docs/configuration/rules/bitbucket/repository/allow-admins.md @@ -0,0 +1,26 @@ +# Allowed Repository Admins +**Type:** Rule +**ID:** `bb-repo-allowed-repository-admins` +**Uses:** `bitbucket/repository/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-admins.rego) +**Labels:** Bitbucket, Repository + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | diff --git a/docs/configuration/rules/bitbucket/repository/allow-users.md b/docs/configuration/rules/bitbucket/repository/allow-users.md new file mode 100644 index 000000000..08a5899ea --- /dev/null +++ b/docs/configuration/rules/bitbucket/repository/allow-users.md @@ -0,0 +1,26 @@ +# Allowed Repository Users +**Type:** Rule +**ID:** `bb-repo-allowed-repository-users` +**Uses:** `bitbucket/repository/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-users.rego) +**Labels:** Bitbucket, Repository + +Verify only users specified in the Allowed List have user access to the Bitbucket repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | diff --git a/docs/configuration/rules/bitbucket/repository/branch-protection.md b/docs/configuration/rules/bitbucket/repository/branch-protection.md new file mode 100644 index 000000000..ade8f0b38 --- /dev/null +++ b/docs/configuration/rules/bitbucket/repository/branch-protection.md @@ -0,0 +1,26 @@ +# Verify Default Branch Protection Setting Is Configured +**Type:** Rule +**ID:** `bb-repo-branch-protection` +**Uses:** `bitbucket/repository/branch-protection@v2/rules` +**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/branch-protection.rego) +**Labels:** Bitbucket, Repository + +Verify the default branch protection is enabled in the Bitbucket repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branches | ['main'] | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/rules/bitbucket/workspace/allow-admins.md new file mode 100644 index 000000000..56d608453 --- /dev/null +++ b/docs/configuration/rules/bitbucket/workspace/allow-admins.md @@ -0,0 +1,26 @@ +# Allowed Workspace Admins +**Type:** Rule +**ID:** `bb-workspace-allowed-workspace-admins` +**Uses:** `bitbucket/workspace/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-admins.rego) +**Labels:** Bitbucket, Workspace + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=workspace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-users.md b/docs/configuration/rules/bitbucket/workspace/allow-users.md new file mode 100644 index 000000000..3aed9fc1f --- /dev/null +++ b/docs/configuration/rules/bitbucket/workspace/allow-users.md @@ -0,0 +1,26 @@ +# Allowed Workspace Users +**Type:** Rule +**ID:** `bb-workspace-allowed-workspace-users` +**Uses:** `bitbucket/workspace/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-users.rego) +**Labels:** Bitbucket, Workspace + +Verify only users specified in the Allowed List have user access to the Bitbucket workspace. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=workspace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | diff --git a/docs/configuration/rules/dockerhub/token-expiration.md b/docs/configuration/rules/dockerhub/token-expiration.md new file mode 100644 index 000000000..03353e39e --- /dev/null +++ b/docs/configuration/rules/dockerhub/token-expiration.md @@ -0,0 +1,22 @@ +# Verify DockerHub Tokens are Active +**Type:** Rule +**ID:** `dockerhub-token-expiration` +**Uses:** `dockerhub/token-expiration@v2/rules` +**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-expiration.yaml) +**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-expiration.rego) +**Labels:** Dockerhub + +Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project | + diff --git a/docs/configuration/rules/dockerhub/token-not-used.md b/docs/configuration/rules/dockerhub/token-not-used.md new file mode 100644 index 000000000..744d20e9a --- /dev/null +++ b/docs/configuration/rules/dockerhub/token-not-used.md @@ -0,0 +1,22 @@ +# Verify no unused Dockerhub +**Type:** Rule +**ID:** `dockerhub-token-not-used` +**Uses:** `dockerhub/token-not-used@v2/rules` +**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-not-used.yaml) +**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-not-used.rego) +**Labels:** Dockerhub + +Verify that there are no unused Dockerhub. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project | + diff --git a/docs/configuration/rules/generic/artifact-signed.md b/docs/configuration/rules/generic/artifact-signed.md new file mode 100644 index 000000000..50155324c --- /dev/null +++ b/docs/configuration/rules/generic/artifact-signed.md @@ -0,0 +1,21 @@ +# Generic Artifact Signed +**Type:** Rule +**ID:** `generic-artifact-signed` +**Uses:** `generic/artifact-signed@v2/rules` +**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/artifact-signed.rego) +**Labels:** 3rd-party + +Verify required evidence is signed. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS** required by default. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | + diff --git a/docs/configuration/rules/generic/evidence-exists.md b/docs/configuration/rules/generic/evidence-exists.md new file mode 100644 index 000000000..87d9d0589 --- /dev/null +++ b/docs/configuration/rules/generic/evidence-exists.md @@ -0,0 +1,20 @@ +# Required Generic Evidence Exists +**Type:** Rule +**ID:** `generic-required-evidence` +**Uses:** `generic/evidence-exists@v2/rules` +**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/evidence-exists.rego) +**Labels:** 3rd-party + +Verify required evidence exists. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | + diff --git a/docs/configuration/rules/generic/k8s-jailbreak.md b/docs/configuration/rules/generic/k8s-jailbreak.md new file mode 100644 index 000000000..dbba96264 --- /dev/null +++ b/docs/configuration/rules/generic/k8s-jailbreak.md @@ -0,0 +1,21 @@ +# K8s Jailbreak +**Type:** Rule +**ID:** `k8s-jailbreak` +**Uses:** `generic/k8s-jailbreak@v2/rules` +**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/k8s-jailbreak.yaml) +**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/k8s-jailbreak.rego) +**Labels:** K8s + +Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| target_type | data | + diff --git a/docs/configuration/rules/generic/trivy-exists.md b/docs/configuration/rules/generic/trivy-exists.md new file mode 100644 index 000000000..f1e829b9c --- /dev/null +++ b/docs/configuration/rules/generic/trivy-exists.md @@ -0,0 +1,19 @@ +# Required Trivy Evidence Exists +**Type:** Rule +**ID:** `required-trivy-evidence` +**Uses:** `generic/trivy-exists@v2/rules` +**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/trivy-exists.yaml) +**Labels:** 3rd-party + +Verify required Trivy evidence exists + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | generic | +| target_type | data | +| predicate_type | https://aquasecurity.github.io/trivy/v0.42/docs/configuration/reporting/#json | + diff --git a/docs/configuration/rules/git/artifact-signed.md b/docs/configuration/rules/git/artifact-signed.md new file mode 100644 index 000000000..aa41f390b --- /dev/null +++ b/docs/configuration/rules/git/artifact-signed.md @@ -0,0 +1,26 @@ +# Git Artifact Signed +**Type:** Rule +**ID:** `git-artifact-signed` +**Uses:** `git/artifact-signed@v2/rules` +**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/artifact-signed.rego) +**Labels:** Git + +Verify the Git artifact is signed. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS** required by default. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | True | +| content_body_type | cyclonedx-json | +| target_type | git | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | {'common-names': [], 'emails': []} | diff --git a/docs/configuration/rules/git/coding-permissions.md b/docs/configuration/rules/git/coding-permissions.md new file mode 100644 index 000000000..8a6026f57 --- /dev/null +++ b/docs/configuration/rules/git/coding-permissions.md @@ -0,0 +1,27 @@ +# Restrict Coding Permissions +**Type:** Rule +**ID:** `git-coding-permissions` +**Uses:** `git/coding-permissions@v2/rules` +**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/coding-permissions.yaml) +**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/coding-permissions.rego) +**Labels:** Git + +Verify only allowed users committed to the repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| ids | [] | +| files | [] | diff --git a/docs/configuration/rules/git/evidence-exists.md b/docs/configuration/rules/git/evidence-exists.md new file mode 100644 index 000000000..21f7624d1 --- /dev/null +++ b/docs/configuration/rules/git/evidence-exists.md @@ -0,0 +1,22 @@ +# Required Git Evidence Exists +**Type:** Rule +**ID:** `required-git-evidence` +**Uses:** `git/evidence-exists@v2/rules` +**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/evidence-exists.rego) +**Labels:** Git + +Verify required Git evidence exists. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/rules/git/no-commit-to-main.md b/docs/configuration/rules/git/no-commit-to-main.md new file mode 100644 index 000000000..66e74f5bb --- /dev/null +++ b/docs/configuration/rules/git/no-commit-to-main.md @@ -0,0 +1,22 @@ +# Disallow Commits to Main Branch +**Type:** Rule +**ID:** `git-disallow-commits-to-main` +**Uses:** `git/no-commit-to-main@v2/rules` +**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/no-commit-to-main.yaml) +**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/no-commit-to-main.rego) +**Labels:** Git + +Verify commits made directly to the main branch are disallowed. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/rules/git/no-unsigned-commits.md b/docs/configuration/rules/git/no-unsigned-commits.md new file mode 100644 index 000000000..ae3ff6e8c --- /dev/null +++ b/docs/configuration/rules/git/no-unsigned-commits.md @@ -0,0 +1,22 @@ +# Disallow Unsigned Commits +**Type:** Rule +**ID:** `git-disallow-unsigned-commits` +**Uses:** `git/no-unsigned-commits@v2/rules` +**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/no-unsigned-commits.yaml) +**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/no-unsigned-commits.rego) +**Labels:** Git + +Verify all commits are signed. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/rules/github/api/branch-protection.md new file mode 100644 index 000000000..f25cd8370 --- /dev/null +++ b/docs/configuration/rules/github/api/branch-protection.md @@ -0,0 +1,21 @@ +# Branch protection enabled in GitHub repository +**Type:** Rule +**ID:** `github-api-branch-protection` +**Uses:** `github/api/branch-protection@v2/rules` +**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/branch-protection.rego) +**Labels:** GitHub + +Verify GitHub branch protection rules + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| api_token | {{ .Args.Token }} | +| owner | {{ .Args.Owner }} | +| repo | {{ .Args.Repo }} | +| branch | {{ .Args.Branch }} | +| branch_protection_rules | {'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False} | diff --git a/docs/configuration/rules/github/api/signed-commits-list.md b/docs/configuration/rules/github/api/signed-commits-list.md new file mode 100644 index 000000000..d787719fa --- /dev/null +++ b/docs/configuration/rules/github/api/signed-commits-list.md @@ -0,0 +1,20 @@ +# Verify Selected Commits Are Signed API +**Type:** Rule +**ID:** `github-api-signed-commits-list` +**Uses:** `github/api/signed-commits-list@v2/rules` +**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-list.rego) +**Labels:** GitHub, API + +Verify selected commits are signed in the GitHub organization. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_id_list | [] | +| access_token | | +| owner | | +| repo | | diff --git a/docs/configuration/rules/github/api/signed-commits-range.md b/docs/configuration/rules/github/api/signed-commits-range.md new file mode 100644 index 000000000..c28a66729 --- /dev/null +++ b/docs/configuration/rules/github/api/signed-commits-range.md @@ -0,0 +1,22 @@ +# Disallow Unsigned Commits In Time Range +**Type:** Rule +**ID:** `signed-commits-range` +**Uses:** `github/api/signed-commits-range@v2/rules` +**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-range.rego) +**Labels:** GitHub + +Verify commits in the specified time range are signed. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| access_token | | +| owner | | +| repo | | +| since | None | +| until | None | +| sha | None | diff --git a/docs/configuration/rules/github/org/2fa.md b/docs/configuration/rules/github/org/2fa.md new file mode 100644 index 000000000..03a641f4c --- /dev/null +++ b/docs/configuration/rules/github/org/2fa.md @@ -0,0 +1,26 @@ +# Verify two_factor_requirement_enabled setting +**Type:** Rule +**ID:** `github-org-2fa` +**Uses:** `github/org/2fa@v2/rules` +**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/2fa.yaml) +**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/2fa.rego) +**Labels:** GitHub, Organization + +Verify `two_factor_requirement` is enabled in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/advanced-security.md b/docs/configuration/rules/github/org/advanced-security.md new file mode 100644 index 000000000..cce729349 --- /dev/null +++ b/docs/configuration/rules/github/org/advanced-security.md @@ -0,0 +1,26 @@ +# Verify advanced security setting is enabled +**Type:** Rule +**ID:** `github-org-advanced-security` +**Uses:** `github/org/advanced-security@v2/rules` +**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/advanced-security.yaml) +**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/advanced-security.rego) +**Labels:** GitHub, Organization + +Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/allow-admins.md b/docs/configuration/rules/github/org/allow-admins.md new file mode 100644 index 000000000..a9e390973 --- /dev/null +++ b/docs/configuration/rules/github/org/allow-admins.md @@ -0,0 +1,26 @@ +# Allowed GitHub Organization Admins +**Type:** Rule +**ID:** `github-orgallowed-admins` +**Uses:** `github/org/allow-admins@v2/rules` +**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-admins.rego) +**Labels:** GitHub, Organization + +Verify only users in the Allowed List have admin privileges in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | diff --git a/docs/configuration/rules/github/org/allow-users.md b/docs/configuration/rules/github/org/allow-users.md new file mode 100644 index 000000000..e97f52169 --- /dev/null +++ b/docs/configuration/rules/github/org/allow-users.md @@ -0,0 +1,26 @@ +# Allowed GitHub Organization Users +**Type:** Rule +**ID:** `github-org-allowed-users` +**Uses:** `github/org/allow-users@v2/rules` +**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-users.rego) +**Labels:** GitHub, Organization + +Verify only users in the Allowed List have user access to the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | diff --git a/docs/configuration/rules/github/org/create-private-repos.md b/docs/configuration/rules/github/org/create-private-repos.md new file mode 100644 index 000000000..f4b7b8211 --- /dev/null +++ b/docs/configuration/rules/github/org/create-private-repos.md @@ -0,0 +1,26 @@ +# Verify members_can_create_private_repositories setting +**Type:** Rule +**ID:** `github-org-create-private-repos` +**Uses:** `github/org/create-private-repos@v2/rules` +**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-private-repos.yaml) +**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-private-repos.rego) +**Labels:** GitHub, Organization + +Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | diff --git a/docs/configuration/rules/github/org/create-repos.md b/docs/configuration/rules/github/org/create-repos.md new file mode 100644 index 000000000..bee12cc1b --- /dev/null +++ b/docs/configuration/rules/github/org/create-repos.md @@ -0,0 +1,26 @@ +# Verify members_can_create_repositories setting +**Type:** Rule +**ID:** `github-org-create-repos` +**Uses:** `github/org/create-repos@v2/rules` +**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-repos.yaml) +**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-repos.rego) +**Labels:** GitHub, Organization + +Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/dependabot-alerts.md b/docs/configuration/rules/github/org/dependabot-alerts.md new file mode 100644 index 000000000..45cbe605f --- /dev/null +++ b/docs/configuration/rules/github/org/dependabot-alerts.md @@ -0,0 +1,26 @@ +# Verify dependabot_alerts_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependabot-alerts` +**Uses:** `github/org/dependabot-alerts@v2/rules` +**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-alerts.yaml) +**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-alerts.rego) +**Labels:** GitHub, Organization + +Verify Dependabot alerts for new repositories are enabled in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md new file mode 100644 index 000000000..6aebca515 --- /dev/null +++ b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md @@ -0,0 +1,22 @@ +# Verify dependabot_security_updates setting in security_and_analysis +**Type:** Rule +**ID:** `github-org-dependabot-security-updates-sa` +**Uses:** `github/org/dependabot-security-updates-sa@v2/rules` +**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates-sa.yaml) +**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates-sa.rego) +**Labels:** GitHub, Organization + +Verify Dependabot security updates are configured in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/rules/github/org/dependabot-security-updates.md b/docs/configuration/rules/github/org/dependabot-security-updates.md new file mode 100644 index 000000000..26a0363d2 --- /dev/null +++ b/docs/configuration/rules/github/org/dependabot-security-updates.md @@ -0,0 +1,26 @@ +# Verify dependabot_security_updates_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependabot-security-updates` +**Uses:** `github/org/dependabot-security-updates@v2/rules` +**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates.yaml) +**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates.rego) +**Labels:** GitHub, Organization + +Verify Dependabot security updates for new repositories are configured in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/dependency-graph.md b/docs/configuration/rules/github/org/dependency-graph.md new file mode 100644 index 000000000..0ba23356b --- /dev/null +++ b/docs/configuration/rules/github/org/dependency-graph.md @@ -0,0 +1,26 @@ +# Verify dependency_graph_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependency-graph` +**Uses:** `github/org/dependency-graph@v2/rules` +**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependency-graph.yaml) +**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependency-graph.rego) +**Labels:** GitHub, Organization + +Verify `dependency_graph` is enabled for new repositories in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/max-admins.md b/docs/configuration/rules/github/org/max-admins.md new file mode 100644 index 000000000..0b58ec268 --- /dev/null +++ b/docs/configuration/rules/github/org/max-admins.md @@ -0,0 +1,26 @@ +# Limit Admin Number in GitHub Organization +**Type:** Rule +**ID:** `github-org-max-admins` +**Uses:** `github/org/max-admins@v2/rules` +**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/max-admins.rego) +**Labels:** Blueprint, GitHub, Organization + +Verify the maximum number of GitHub organization admins is restricted. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 0 | diff --git a/docs/configuration/rules/github/org/old-secrets.md b/docs/configuration/rules/github/org/old-secrets.md new file mode 100644 index 000000000..38a98afc9 --- /dev/null +++ b/docs/configuration/rules/github/org/old-secrets.md @@ -0,0 +1,26 @@ +# Verify GitHub Organization Secrets Are Not Too Old +**Type:** Rule +**ID:** `github-org-old-secrets` +**Uses:** `github/org/old-secrets@v2/rules` +**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/old-secrets.rego) +**Labels:** GitHub, Organization + +Verify secrets in the GitHub organization are not older than the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_secret_age | 12 | diff --git a/docs/configuration/rules/github/org/pp-custom-link.md b/docs/configuration/rules/github/org/pp-custom-link.md new file mode 100644 index 000000000..edf17616c --- /dev/null +++ b/docs/configuration/rules/github/org/pp-custom-link.md @@ -0,0 +1,26 @@ +# Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +**Type:** Rule +**ID:** `github-org-pp-custom-link` +**Uses:** `github/org/pp-custom-link@v2/rules` +**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/pp-custom-link.yaml) +**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/pp-custom-link.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/push-protection-sa.md b/docs/configuration/rules/github/org/push-protection-sa.md new file mode 100644 index 000000000..410cc5c0e --- /dev/null +++ b/docs/configuration/rules/github/org/push-protection-sa.md @@ -0,0 +1,22 @@ +# Verify Secret_Scanning_Push_Protection Setting +**Type:** Rule +**ID:** `github-org-push-protection-sa` +**Uses:** `github/org/push-protection-sa@v2/rules` +**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection-sa.yaml) +**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection` is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/rules/github/org/push-protection.md b/docs/configuration/rules/github/org/push-protection.md new file mode 100644 index 000000000..1b42a9c6c --- /dev/null +++ b/docs/configuration/rules/github/org/push-protection.md @@ -0,0 +1,26 @@ +# Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +**Type:** Rule +**ID:** `github-org-push-protection` +**Uses:** `github/org/push-protection@v2/rules` +**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | diff --git a/docs/configuration/rules/github/org/repo-visibility.md b/docs/configuration/rules/github/org/repo-visibility.md new file mode 100644 index 000000000..92e15e28f --- /dev/null +++ b/docs/configuration/rules/github/org/repo-visibility.md @@ -0,0 +1,26 @@ +# Verify Repo Visibility Setting +**Type:** Rule +**ID:** `github-org-repo-visibility` +**Uses:** `github/org/repo-visibility@v2/rules` +**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/repo-visibility.yaml) +**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/repo-visibility.rego) +**Labels:** GitHub, Organization + +Verify only repositories in the Allowed List are public in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_repo_names | [] | diff --git a/docs/configuration/rules/github/org/secret-scanning-sa.md b/docs/configuration/rules/github/org/secret-scanning-sa.md new file mode 100644 index 000000000..8858c847a --- /dev/null +++ b/docs/configuration/rules/github/org/secret-scanning-sa.md @@ -0,0 +1,22 @@ +# Verify Secret_Scanning Setting in Security_And_Analysis +**Type:** Rule +**ID:** `github-org-secret-scanning-sa` +**Uses:** `github/org/secret-scanning-sa@v2/rules` +**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning-sa.yaml) +**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning` is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/rules/github/org/secret-scanning.md b/docs/configuration/rules/github/org/secret-scanning.md new file mode 100644 index 000000000..ab9b71a48 --- /dev/null +++ b/docs/configuration/rules/github/org/secret-scanning.md @@ -0,0 +1,26 @@ +# Verify secret_scanning_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-secret-scanning` +**Uses:** `github/org/secret-scanning@v2/rules` +**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning` is enabled for new repositories in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/validity-checks-sa.md b/docs/configuration/rules/github/org/validity-checks-sa.md new file mode 100644 index 000000000..d40bd9a64 --- /dev/null +++ b/docs/configuration/rules/github/org/validity-checks-sa.md @@ -0,0 +1,22 @@ +# Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +**Type:** Rule +**ID:** `github-org-validity-checks-sa` +**Uses:** `github/org/validity-checks-sa@v2/rules` +**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks-sa.yaml) +**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_validity_checks` is configured in the GitHub organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/rules/github/org/validity-checks.md b/docs/configuration/rules/github/org/validity-checks.md new file mode 100644 index 000000000..fc0f27c57 --- /dev/null +++ b/docs/configuration/rules/github/org/validity-checks.md @@ -0,0 +1,26 @@ +# Verify Secret_Scanning_Validity_Checks_Enabled Setting +**Type:** Rule +**ID:** `github-org-validity-checks` +**Uses:** `github/org/validity-checks@v2/rules` +**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_validity_checks` is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/github/org/web-commit-signoff.md b/docs/configuration/rules/github/org/web-commit-signoff.md new file mode 100644 index 000000000..c843a088d --- /dev/null +++ b/docs/configuration/rules/github/org/web-commit-signoff.md @@ -0,0 +1,22 @@ +# Verify GitHub Organization Requires Signoff on Web Commits +**Type:** Rule +**ID:** `github-org-web-commit-signoff` +**Uses:** `github/org/web-commit-signoff@v2/rules` +**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/web-commit-signoff.rego) +**Labels:** GitHub, Organization + +Verify contributors sign commits through the GitHub web interface. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/rules/github/repository/branch-protection.md b/docs/configuration/rules/github/repository/branch-protection.md new file mode 100644 index 000000000..65500373a --- /dev/null +++ b/docs/configuration/rules/github/repository/branch-protection.md @@ -0,0 +1,27 @@ +# Verify Branch Protection Setting +**Type:** Rule +**ID:** `github-repo-branch-protection` +**Uses:** `github/repository/branch-protection@v2/rules` +**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-protection.rego) +**Labels:** GitHub, Repository + +Verify branch protection is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_protected | True | +| branches | ['main', 'master'] | diff --git a/docs/configuration/rules/github/repository/branch-verification.md b/docs/configuration/rules/github/repository/branch-verification.md new file mode 100644 index 000000000..58c3e545b --- /dev/null +++ b/docs/configuration/rules/github/repository/branch-verification.md @@ -0,0 +1,26 @@ +# Verify Branch Verification Setting +**Type:** Rule +**ID:** `github-repo-branch-verification` +**Uses:** `github/repository/branch-verification@v2/rules` +**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-verification.yaml) +**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-verification.rego) +**Labels:** GitHub, Repository + +Verify branch verification in the GitHub repository matches the value defined in the configuration file. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_verified | False | diff --git a/docs/configuration/rules/github/repository/check-signed-commits.md b/docs/configuration/rules/github/repository/check-signed-commits.md new file mode 100644 index 000000000..b68c5d336 --- /dev/null +++ b/docs/configuration/rules/github/repository/check-signed-commits.md @@ -0,0 +1,22 @@ +# Verify All Commits Are Signed in Repository +**Type:** Rule +**ID:** `github-repo-signed-commits` +**Uses:** `github/repository/check-signed-commits@v2/rules` +**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/check-signed-commits.rego) +**Labels:** GitHub, Repository + +Verify all commits in the GitHub repository are signed. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/default-branch-protection.md b/docs/configuration/rules/github/repository/default-branch-protection.md new file mode 100644 index 000000000..19f6c5ed4 --- /dev/null +++ b/docs/configuration/rules/github/repository/default-branch-protection.md @@ -0,0 +1,22 @@ +# Verify Default Branch Protection +**Type:** Rule +**ID:** `github-repo-default-branch-protection` +**Uses:** `github/repository/default-branch-protection@v2/rules` +**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/default-branch-protection.yaml) +**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/default-branch-protection.rego) +**Labels:** GitHub, Repository + +Verify the default branch protection is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/dependabot.md b/docs/configuration/rules/github/repository/dependabot.md new file mode 100644 index 000000000..7261bafee --- /dev/null +++ b/docs/configuration/rules/github/repository/dependabot.md @@ -0,0 +1,22 @@ +# Verify Dependabot security updates setting +**Type:** Rule +**ID:** `github-repo-dependabot` +**Uses:** `github/repository/dependabot@v2/rules` +**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/dependabot.yaml) +**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/dependabot.rego) +**Labels:** GitHub, Repository + +Verify Dependabot security updates are configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/rules/github/repository/ephemeral-runners-only.md new file mode 100644 index 000000000..c72c576bd --- /dev/null +++ b/docs/configuration/rules/github/repository/ephemeral-runners-only.md @@ -0,0 +1,22 @@ +# Verify Only Ephemeral Runners Exist in Repository +**Type:** Rule +**ID:** `github-repo-ephemeral-runners-only` +**Uses:** `github/repository/ephemeral-runners-only@v2/rules` +**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/ephemeral-runners-only.yaml) +**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/ephemeral-runners-only.rego) +**Labels:** GitHub, Repository + +Verify self-hosted runners are disallowed in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/no-cache-usage.md b/docs/configuration/rules/github/repository/no-cache-usage.md new file mode 100644 index 000000000..519db0bfb --- /dev/null +++ b/docs/configuration/rules/github/repository/no-cache-usage.md @@ -0,0 +1,22 @@ +# Verify No Cache Usage Exists in Repository +**Type:** Rule +**ID:** `github-repo-no-cache-usage` +**Uses:** `github/repository/no-cache-usage@v2/rules` +**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-cache-usage.yaml) +**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-cache-usage.rego) +**Labels:** GitHub, Repository + +Verify the GitHub repository has no cache usage. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/no-org-secrets.md b/docs/configuration/rules/github/repository/no-org-secrets.md new file mode 100644 index 000000000..e9e0f64ae --- /dev/null +++ b/docs/configuration/rules/github/repository/no-org-secrets.md @@ -0,0 +1,22 @@ +# Verify No Organization Secrets Exist in Repository +**Type:** Rule +**ID:** `github-repo-no-org-secrets` +**Uses:** `github/repository/no-org-secrets@v2/rules` +**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-org-secrets.yaml) +**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-org-secrets.rego) +**Labels:** GitHub, Repository + +Verify no organization secrets exist in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/old-secrets.md b/docs/configuration/rules/github/repository/old-secrets.md new file mode 100644 index 000000000..42537bd66 --- /dev/null +++ b/docs/configuration/rules/github/repository/old-secrets.md @@ -0,0 +1,26 @@ +# Verify No Old Secrets Exist in Repository +**Type:** Rule +**ID:** `github-repo-old-secrets` +**Uses:** `github/repository/old-secrets@v2/rules` +**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/old-secrets.rego) +**Labels:** GitHub, Repository + +Verify secrets in the GitHub repository are not older than the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_secret_age | 12 | diff --git a/docs/configuration/rules/github/repository/push-protection.md b/docs/configuration/rules/github/repository/push-protection.md new file mode 100644 index 000000000..23bce23b3 --- /dev/null +++ b/docs/configuration/rules/github/repository/push-protection.md @@ -0,0 +1,22 @@ +# Verify Push Protection Setting +**Type:** Rule +**ID:** `github-repo-push-protection` +**Uses:** `github/repository/push-protection@v2/rules` +**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/push-protection.rego) +**Labels:** GitHub, Repository + +Verify `secret_scanning_push_protection` is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/repo-private.md b/docs/configuration/rules/github/repository/repo-private.md new file mode 100644 index 000000000..a9ade5bd7 --- /dev/null +++ b/docs/configuration/rules/github/repository/repo-private.md @@ -0,0 +1,22 @@ +# Verify Repository Is Private +**Type:** Rule +**ID:** `github-repo-private` +**Uses:** `github/repository/repo-private@v2/rules` +**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/repo-private.yaml) +**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/repo-private.rego) +**Labels:** GitHub, Repository + +Verify the GitHub repository is private. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/secret-scanning.md b/docs/configuration/rules/github/repository/secret-scanning.md new file mode 100644 index 000000000..99c98d277 --- /dev/null +++ b/docs/configuration/rules/github/repository/secret-scanning.md @@ -0,0 +1,22 @@ +# Verify secret_scanning setting +**Type:** Rule +**ID:** `github-repo-secret-scanning` +**Uses:** `github/repository/secret-scanning@v2/rules` +**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/secret-scanning.rego) +**Labels:** GitHub, Repository + +Verify `secret_scanning` is configured in the GitHub repository. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/signed-commits.md b/docs/configuration/rules/github/repository/signed-commits.md new file mode 100644 index 000000000..b7110f117 --- /dev/null +++ b/docs/configuration/rules/github/repository/signed-commits.md @@ -0,0 +1,22 @@ +# Verify All Commits Are Signed in Repository +**Type:** Rule +**ID:** `github-repo-signed-commits` +**Uses:** `github/repository/signed-commits@v2/rules` +**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/signed-commits.yaml) +**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/signed-commits.rego) +**Labels:** GitHub, Repository + +Verify all commits are signed in a repository attestation. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/validity-checks.md b/docs/configuration/rules/github/repository/validity-checks.md new file mode 100644 index 000000000..d9c2bd18d --- /dev/null +++ b/docs/configuration/rules/github/repository/validity-checks.md @@ -0,0 +1,22 @@ +# Verify secret scanning. +**Type:** Rule +**ID:** `github-repo-validity-checks` +**Uses:** `github/repository/validity-checks@v2/rules` +**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/validity-checks.rego) +**Labels:** GitHub, Repository + +Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/github/repository/visibility.md b/docs/configuration/rules/github/repository/visibility.md new file mode 100644 index 000000000..d26c984a5 --- /dev/null +++ b/docs/configuration/rules/github/repository/visibility.md @@ -0,0 +1,26 @@ +# Allowed Public Repositories +**Type:** Rule +**ID:** `github-repo-visibility` +**Uses:** `github/repository/visibility@v2/rules` +**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/visibility.yaml) +**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/visibility.rego) +**Labels:** GitHub, Repository + +Verify only GitHub repositories in the Allowed List are public. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_repo_names | [] | diff --git a/docs/configuration/rules/github/repository/web-commit-signoff.md b/docs/configuration/rules/github/repository/web-commit-signoff.md new file mode 100644 index 000000000..eae021abb --- /dev/null +++ b/docs/configuration/rules/github/repository/web-commit-signoff.md @@ -0,0 +1,22 @@ +# Verify Repository Requires Commit Signoff +**Type:** Rule +**ID:** `github-repo-web-commit-signoff` +**Uses:** `github/repository/web-commit-signoff@v2/rules` +**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/web-commit-signoff.rego) +**Labels:** GitHub, Repository + +Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/rules/gitlab/api/push-rules.md new file mode 100644 index 000000000..9a6cc7acb --- /dev/null +++ b/docs/configuration/rules/gitlab/api/push-rules.md @@ -0,0 +1,19 @@ +# Set Push Rules in GitLab +**Type:** Rule +**ID:** `gitlab-api-push-rules` +**Uses:** `gitlab/api/push-rules@v2/rules` +**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/push-rules.yaml) +**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/push-rules.rego) +**Labels:** Gitlab, API + +Verify GitLab push rules are configured via the API. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| api_token | {{ .Args.Token }} | +| project | {{ .Args.Project }} | +| push_rule | {'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None} | diff --git a/docs/configuration/rules/gitlab/api/signed-commits-list.md b/docs/configuration/rules/gitlab/api/signed-commits-list.md new file mode 100644 index 000000000..29bee1783 --- /dev/null +++ b/docs/configuration/rules/gitlab/api/signed-commits-list.md @@ -0,0 +1,19 @@ +# Sign Selected Commits in GitLab +**Type:** Rule +**ID:** `gitlab-api-signed-commits-list` +**Uses:** `gitlab/api/signed-commits-list@v2/rules` +**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-list.rego) +**Labels:** Gitlab, API + +Verify the selected commits are signed in the GitLab organization. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_id_list | [] | +| private_token | | +| project_id | | diff --git a/docs/configuration/rules/gitlab/api/signed-commits-range.md b/docs/configuration/rules/gitlab/api/signed-commits-range.md new file mode 100644 index 000000000..6ec4343a4 --- /dev/null +++ b/docs/configuration/rules/gitlab/api/signed-commits-range.md @@ -0,0 +1,20 @@ +# Sign Selected Commit Range in GitLab +**Type:** Rule +**ID:** `gitlab-api-signed-commits-range` +**Uses:** `gitlab/api/signed-commits-range@v2/rules` +**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-range.rego) +**Labels:** Gitlab, API + +Verify the selected range of commits is signed via the GitLab API. + +> Evidence **IS NOT** required for this rule. +> Rule Result will be set as 'open' if evidence is missing. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| since | | +| until | | +| project_id | | +| private_token | | diff --git a/docs/configuration/rules/gitlab/org/allow-admins.md b/docs/configuration/rules/gitlab/org/allow-admins.md new file mode 100644 index 000000000..bc0b92755 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/allow-admins.md @@ -0,0 +1,26 @@ +# Allowed Admins in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-admins` +**Uses:** `gitlab/org/allow-admins@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-admins.rego) +**Labels:** Gitlab, Organization + +Verify only users in the Allowed List have admin privileges in the GitLab organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | diff --git a/docs/configuration/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/rules/gitlab/org/allow-token-scopes.md new file mode 100644 index 000000000..322ee4197 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/allow-token-scopes.md @@ -0,0 +1,26 @@ +# Restrict Token Scopes in GitLab +**Type:** Rule +**ID:** `gitlab-org-allowed-token-scope` +**Uses:** `gitlab/org/allow-token-scopes@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-token-scopes.yaml) +**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-token-scopes.rego) +**Labels:** Gitlab, Organization + +Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_token_scopes | ['api', 'read_api', 'read_repository', 'read_registry'] | diff --git a/docs/configuration/rules/gitlab/org/allow-users.md b/docs/configuration/rules/gitlab/org/allow-users.md new file mode 100644 index 000000000..f64dbd342 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/allow-users.md @@ -0,0 +1,26 @@ +# Allowed Users in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-users` +**Uses:** `gitlab/org/allow-users@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-users.rego) +**Labels:** Gitlab, Organization + +Verify only users in the Allowed List have access to the GitLab organization. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | diff --git a/docs/configuration/rules/gitlab/org/blocked-users.md b/docs/configuration/rules/gitlab/org/blocked-users.md new file mode 100644 index 000000000..7551a6e9f --- /dev/null +++ b/docs/configuration/rules/gitlab/org/blocked-users.md @@ -0,0 +1,26 @@ +# Block Users in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-blocked-users` +**Uses:** `gitlab/org/blocked-users@v2/rules` +**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/blocked-users.yaml) +**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/blocked-users.rego) +**Labels:** Gitlab, Organization + +Verify no users in the GitLab organization are on the block list. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocked_users | [] | diff --git a/docs/configuration/rules/gitlab/org/expiring-tokens.md b/docs/configuration/rules/gitlab/org/expiring-tokens.md new file mode 100644 index 000000000..0e4f29c17 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/expiring-tokens.md @@ -0,0 +1,26 @@ +# Prevent Token Expiration in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-token-about-to-expire` +**Uses:** `gitlab/org/expiring-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/expiring-tokens.yaml) +**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/expiring-tokens.rego) +**Labels:** Gitlab, Organization + +Verify no GitLab organization tokens are about to expire. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| exiring_in_days | 30 | diff --git a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md new file mode 100644 index 000000000..a85359a84 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md @@ -0,0 +1,26 @@ +# Forbid Token Scopes in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-disallowed-token-scope` +**Uses:** `gitlab/org/forbid-token-scopes@v2/rules` +**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/forbid-token-scopes.yaml) +**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/forbid-token-scopes.rego) +**Labels:** Blueprint, Gitlab, Organization + +Verify no GitLab organization tokens have disallowed scopes. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| project_scopes | ['write_api', 'write_repository'] | diff --git a/docs/configuration/rules/gitlab/org/inactive-projects.md b/docs/configuration/rules/gitlab/org/inactive-projects.md new file mode 100644 index 000000000..de98105fc --- /dev/null +++ b/docs/configuration/rules/gitlab/org/inactive-projects.md @@ -0,0 +1,26 @@ +# Ensure Active Projects in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-inactive-projects` +**Uses:** `gitlab/org/inactive-projects@v2/rules` +**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/inactive-projects.yaml) +**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/inactive-projects.rego) +**Labels:** Gitlab, Organization + +Verify no GitLab organization projects are inactive. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 90 | diff --git a/docs/configuration/rules/gitlab/org/longlive-tokens.md b/docs/configuration/rules/gitlab/org/longlive-tokens.md new file mode 100644 index 000000000..f67fff937 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/longlive-tokens.md @@ -0,0 +1,26 @@ +# Forbid Long-Lived Tokens in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-token-excessive-lifespan` +**Uses:** `gitlab/org/longlive-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/longlive-tokens.yaml) +**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/longlive-tokens.rego) +**Labels:** Blueprint, Gitlab, Organization + +Verify no GitLab organization tokens have an excessively long lifespan. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| exiring_in_days | 365 | diff --git a/docs/configuration/rules/gitlab/org/max-admins.md b/docs/configuration/rules/gitlab/org/max-admins.md new file mode 100644 index 000000000..29c730113 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/max-admins.md @@ -0,0 +1,26 @@ +# Limit Admins in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-max-admins` +**Uses:** `gitlab/org/max-admins@v2/rules` +**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/max-admins.rego) +**Labels:** Blueprint, GitLab, Organization + +Verify the maximum number of admins for the GitLab project is restricted. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 0 | diff --git a/docs/configuration/rules/gitlab/org/projects-visibility.md b/docs/configuration/rules/gitlab/org/projects-visibility.md new file mode 100644 index 000000000..1d62a1dee --- /dev/null +++ b/docs/configuration/rules/gitlab/org/projects-visibility.md @@ -0,0 +1,26 @@ +# Restrict Public Visibility in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-visible-projects` +**Uses:** `gitlab/org/projects-visibility@v2/rules` +**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/projects-visibility.yaml) +**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/projects-visibility.rego) +**Labels:** Gitlab, Organization + +Verify only allowed projects in the GitLab organization have public visibility. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_public | ['Learn GitLab', 'Scribe Gitlab Test'] | diff --git a/docs/configuration/rules/gitlab/org/unused-tokens.md b/docs/configuration/rules/gitlab/org/unused-tokens.md new file mode 100644 index 000000000..eacc9671f --- /dev/null +++ b/docs/configuration/rules/gitlab/org/unused-tokens.md @@ -0,0 +1,26 @@ +# Forbid Unused Tokens in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-unused-tokens` +**Uses:** `gitlab/org/unused-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/unused-tokens.yaml) +**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/unused-tokens.rego) +**Labels:** Gitlab, Organization + +Verify there are no unused GitLab organization tokens. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| unused_for_days | 90 | diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md new file mode 100644 index 000000000..de26c58a7 --- /dev/null +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md @@ -0,0 +1,26 @@ +# GitLab pipeline verify labels exist +**Type:** Rule +**ID:** `gitlab-pipeline-verify-labels-exist` +**Uses:** `gitlab/pipeline/verify-labels-exist@v2/rules` +**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels-exist.rego) +**Labels:** Gitlab, Pipeline + +Verify the pipeline has all required label keys and values. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pipeline | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | ['app.kubernetes.io/instance'] | diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/rules/gitlab/pipeline/verify-labels.md new file mode 100644 index 000000000..61cbbb7d0 --- /dev/null +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels.md @@ -0,0 +1,26 @@ +# Verify GitLab Pipeline Labels +**Type:** Rule +**ID:** `gitlab-pipeline-verify-labels` +**Uses:** `gitlab/pipeline/verify-labels@v2/rules` +**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels.rego) +**Labels:** Gitlab, Pipeline + +Verify the pipeline includes all required label keys and values. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pipeline | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | {'app.kubernetes.io/instance': 'defaul1t'} | diff --git a/docs/configuration/rules/gitlab/project/abandoned-project.md b/docs/configuration/rules/gitlab/project/abandoned-project.md new file mode 100644 index 000000000..38ef939b0 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/abandoned-project.md @@ -0,0 +1,26 @@ +# Verify Project Activity +**Type:** Rule +**ID:** `gitlab-project-abandoned-project` +**Uses:** `gitlab/project/abandoned-project@v2/rules` +**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/abandoned-project.yaml) +**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/abandoned-project.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project is active for a specified duration. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 30 | diff --git a/docs/configuration/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/rules/gitlab/project/approvals-policy-check.md new file mode 100644 index 000000000..f9af4c85b --- /dev/null +++ b/docs/configuration/rules/gitlab/project/approvals-policy-check.md @@ -0,0 +1,27 @@ +# Merge approval policy check for GitLab project +**Type:** Rule +**ID:** `gitlab-project-merge-approval` +**Uses:** `gitlab/project/approvals-policy-check@v2/rules` +**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvals-policy-check.yaml) +**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvals-policy-check.rego) +**Labels:** Blueprint, Gitlab, Project + +Verify the project's merge approval policy complies with requirements. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| name | All Members | +| approvals_required_min | 2 | diff --git a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md new file mode 100644 index 000000000..a1d5b8cdc --- /dev/null +++ b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md @@ -0,0 +1,26 @@ +# Restrict Approvers Per Merge Request +**Type:** Rule +**ID:** `gitlab-project-approvers-per-merge-request` +**Uses:** `gitlab/project/approvers-per-merge-request@v2/rules` +**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvers-per-merge-request.yaml) +**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvers-per-merge-request.rego) +**Labels:** Gitlab, Project + +Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| disable_overriding_approvers_per_merge_request | False | diff --git a/docs/configuration/rules/gitlab/project/author-email-regex.md b/docs/configuration/rules/gitlab/project/author-email-regex.md new file mode 100644 index 000000000..3e23894dc --- /dev/null +++ b/docs/configuration/rules/gitlab/project/author-email-regex.md @@ -0,0 +1,26 @@ +# Set Author Email Regex in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-author-email-regex` +**Uses:** `gitlab/project/author-email-regex@v2/rules` +**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/author-email-regex.yaml) +**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/author-email-regex.rego) +**Labels:** Gitlab, Project + +Verify the `author_email_regex` for the GitLab project is set to the specified value. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| author_email_regex | | diff --git a/docs/configuration/rules/gitlab/project/check-cwe.md b/docs/configuration/rules/gitlab/project/check-cwe.md new file mode 100644 index 000000000..271c61286 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/check-cwe.md @@ -0,0 +1,26 @@ +# Check CWE Compliance +**Type:** Rule +**ID:** `gitlab-project-check-cwe` +**Uses:** `gitlab/project/check-cwe@v2/rules` +**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-cwe.yaml) +**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-cwe.rego) +**Labels:** Gitlab, Project + +Verify that specified CWEs were not detected in the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| cwe_value | 89 | diff --git a/docs/configuration/rules/gitlab/project/check-signed-commits.md b/docs/configuration/rules/gitlab/project/check-signed-commits.md new file mode 100644 index 000000000..0d0f8b2b4 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/check-signed-commits.md @@ -0,0 +1,22 @@ +# Ensure All Commits Are Signed in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-signed-commits` +**Uses:** `gitlab/project/check-signed-commits@v2/rules` +**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-signed-commits.rego) +**Labels:** Gitlab, Project + +Verify all commits in the GitLab project are signed. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/co-approval-required.md b/docs/configuration/rules/gitlab/project/co-approval-required.md new file mode 100644 index 000000000..15d525383 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/co-approval-required.md @@ -0,0 +1,26 @@ +# Require Code Owner Approval in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-code-owner-approval` +**Uses:** `gitlab/project/co-approval-required@v2/rules` +**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/co-approval-required.yaml) +**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/co-approval-required.rego) +**Labels:** Gitlab, Project + +Verify code owner approval is required for specific branches in the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | diff --git a/docs/configuration/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/rules/gitlab/project/commit-author-email-check.md new file mode 100644 index 000000000..63bfd8d79 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/commit-author-email-check.md @@ -0,0 +1,26 @@ +# Restrict Commit Authors in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-commit-authors` +**Uses:** `gitlab/project/commit-author-email-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-email-check.yaml) +**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-email-check.rego) +**Labels:** Gitlab, Project + +Verify only GitLab project users in the Allowed List have commit author permissions. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_authors | ['mail@example.com'] | diff --git a/docs/configuration/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/rules/gitlab/project/commit-author-name-check.md new file mode 100644 index 000000000..a67801f92 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/commit-author-name-check.md @@ -0,0 +1,26 @@ +# Allowed Commit Authors in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-commit-author-names` +**Uses:** `gitlab/project/commit-author-name-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-name-check.yaml) +**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-name-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List author commits in the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_authors | ['examplename'] | diff --git a/docs/configuration/rules/gitlab/project/commit-committer-check.md b/docs/configuration/rules/gitlab/project/commit-committer-check.md new file mode 100644 index 000000000..e1778c1e4 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/commit-committer-check.md @@ -0,0 +1,22 @@ +# Enable Commit Committer Check in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-commit_committer_check` +**Uses:** `gitlab/project/commit-committer-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-committer-check.yaml) +**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-committer-check.rego) +**Labels:** Gitlab, Project + +Verify `commit_committer_check` is enabled for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/commit-message-check.md b/docs/configuration/rules/gitlab/project/commit-message-check.md new file mode 100644 index 000000000..bb15ec851 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/commit-message-check.md @@ -0,0 +1,26 @@ +# Verify Commit Message Format +**Type:** Rule +**ID:** `gitlab-project-verify-commit_message_check` +**Uses:** `gitlab/project/commit-message-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-message-check.yaml) +**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-message-check.rego) +**Labels:** Gitlab, Project + +Verify that commit messages in the GitLab project adhere to the specified format template. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_message_regex | .*JIRA-\d+.* | diff --git a/docs/configuration/rules/gitlab/project/commits-validated.md b/docs/configuration/rules/gitlab/project/commits-validated.md new file mode 100644 index 000000000..b2b18f58e --- /dev/null +++ b/docs/configuration/rules/gitlab/project/commits-validated.md @@ -0,0 +1,22 @@ +# Validate All Commits in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-all-commits-validated` +**Uses:** `gitlab/project/commits-validated@v2/rules` +**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commits-validated.yaml) +**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commits-validated.rego) +**Labels:** Gitlab, Project + +Verify all commits in the GitLab project are validated. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/committer-email-check.md b/docs/configuration/rules/gitlab/project/committer-email-check.md new file mode 100644 index 000000000..33b208d1a --- /dev/null +++ b/docs/configuration/rules/gitlab/project/committer-email-check.md @@ -0,0 +1,26 @@ +# Allowed Committer Emails in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-committer-emails` +**Uses:** `gitlab/project/committer-email-check@v2/rules` +**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-email-check.yaml) +**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-email-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List use committer email addresses in the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_committers | ['mail@example.com'] | diff --git a/docs/configuration/rules/gitlab/project/committer-name-check.md b/docs/configuration/rules/gitlab/project/committer-name-check.md new file mode 100644 index 000000000..65e0191ab --- /dev/null +++ b/docs/configuration/rules/gitlab/project/committer-name-check.md @@ -0,0 +1,26 @@ +# Allowed Committer Names in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-committer-names` +**Uses:** `gitlab/project/committer-name-check@v2/rules` +**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-name-check.yaml) +**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-name-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List commit by name in the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_committers | ['somename'] | diff --git a/docs/configuration/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/rules/gitlab/project/critical-severity-limit.md new file mode 100644 index 000000000..80a247e99 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/critical-severity-limit.md @@ -0,0 +1,26 @@ +# Enforce Critical Severity Limit +**Type:** Rule +**ID:** `gitlab-project-critical-severity-limit` +**Uses:** `gitlab/project/critical-severity-limit@v2/rules` +**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/critical-severity-limit.yaml) +**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/critical-severity-limit.rego) +**Labels:** Gitlab, Project + +Verify the maximum allowed critical severity alerts for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_allowed_vulnerability_count | 0 | diff --git a/docs/configuration/rules/gitlab/project/description-substring-check.md b/docs/configuration/rules/gitlab/project/description-substring-check.md new file mode 100644 index 000000000..0a80b5ddc --- /dev/null +++ b/docs/configuration/rules/gitlab/project/description-substring-check.md @@ -0,0 +1,26 @@ +# Check Description Substring +**Type:** Rule +**ID:** `gitlab-project-description-substring-check` +**Uses:** `gitlab/project/description-substring-check@v2/rules` +**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/description-substring-check.yaml) +**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/description-substring-check.rego) +**Labels:** Gitlab, Project + +Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)insdput | diff --git a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md new file mode 100644 index 000000000..099c58807 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md @@ -0,0 +1,26 @@ +# Disallow Banned Approvers +**Type:** Rule +**ID:** `gitlab-project-disallowed-banned-approvers` +**Uses:** `gitlab/project/disallowed-banned-approvers@v2/rules` +**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) +**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/disallowed-banned-approvers.rego) +**Labels:** Gitlab, Project + +Verify approvers in the GitLab project are not on the banned list. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| banned_list | [] | diff --git a/docs/configuration/rules/gitlab/project/force-push-protection.md b/docs/configuration/rules/gitlab/project/force-push-protection.md new file mode 100644 index 000000000..6b73f1073 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/force-push-protection.md @@ -0,0 +1,26 @@ +# Disallow Force Push in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-disallow-force-push` +**Uses:** `gitlab/project/force-push-protection@v2/rules` +**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/force-push-protection.yaml) +**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/force-push-protection.rego) +**Labels:** Gitlab, Project + +Verify force pushes in the GitLab project are disallowed to maintain repository integrity. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | diff --git a/docs/configuration/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/rules/gitlab/project/medium-severity-limit.md new file mode 100644 index 000000000..4ac7c60fa --- /dev/null +++ b/docs/configuration/rules/gitlab/project/medium-severity-limit.md @@ -0,0 +1,26 @@ +# Enforce Medium Severity Limit +**Type:** Rule +**ID:** `gitlab-project-medium-severity-limit` +**Uses:** `gitlab/project/medium-severity-limit@v2/rules` +**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/medium-severity-limit.yaml) +**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/medium-severity-limit.rego) +**Labels:** Gitlab, Project + +Verify the maximum allowed medium severity alerts for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_allowed_specific_severity | 0 | diff --git a/docs/configuration/rules/gitlab/project/member-check.md b/docs/configuration/rules/gitlab/project/member-check.md new file mode 100644 index 000000000..97c0a15be --- /dev/null +++ b/docs/configuration/rules/gitlab/project/member-check.md @@ -0,0 +1,22 @@ +# Enable Member Check for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-member_check` +**Uses:** `gitlab/project/member-check@v2/rules` +**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/member-check.yaml) +**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/member-check.rego) +**Labels:** Gitlab, Project + +Verify `member_check` is enabled for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/merge-access-level.md b/docs/configuration/rules/gitlab/project/merge-access-level.md new file mode 100644 index 000000000..c4695c9b7 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/merge-access-level.md @@ -0,0 +1,27 @@ +# Enforce Merge Access Level Policy for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-merge-access-level` +**Uses:** `gitlab/project/merge-access-level@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-access-level.yaml) +**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-access-level.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's merge access level complies with requirements. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | +| access_level_description | Maintainers | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md new file mode 100644 index 000000000..d6e7f7aba --- /dev/null +++ b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md @@ -0,0 +1,26 @@ +# Disable Author Approval for Merge Requests in GitLab +**Type:** Rule +**ID:** `gitlab-project-merge-requests-author-approval` +**Uses:** `gitlab/project/merge-requests-author-approval@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-author-approval.yaml) +**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-author-approval.rego) +**Labels:** Gitlab, Project + +Verify the binary field `merge_requests_author_approval` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| merge_requests_author_approval | True | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md new file mode 100644 index 000000000..385f90733 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -0,0 +1,26 @@ +# Disable Committers' Approval for Merge Requests in GitLab +**Type:** Rule +**ID:** `gitlab-project-merge-requests-disable-committers-approval` +**Uses:** `gitlab/project/merge-requests-disable-committers-approval@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) +**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) +**Labels:** Gitlab, Project + +Verify `merge_requests_disable_committers_approval` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| merge_requests_disable_committers_approval | False | diff --git a/docs/configuration/rules/gitlab/project/message-substring-check.md b/docs/configuration/rules/gitlab/project/message-substring-check.md new file mode 100644 index 000000000..533279fa2 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/message-substring-check.md @@ -0,0 +1,26 @@ +# Check Message Substring +**Type:** Rule +**ID:** `gitlab-project-message-substring-check` +**Uses:** `gitlab/project/message-substring-check@v2/rules` +**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/message-substring-check.yaml) +**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/message-substring-check.rego) +**Labels:** Gitlab, Project + +Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)dghd | diff --git a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md new file mode 100644 index 000000000..2d54c2706 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md @@ -0,0 +1,22 @@ +# Enable Secrets Prevention in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-prevent_secrets` +**Uses:** `gitlab/project/prevent-secrets-check@v2/rules` +**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/prevent-secrets-check.yaml) +**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/prevent-secrets-check.rego) +**Labels:** Gitlab, Project + +Verify `prevent_secrets` is enabled for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md new file mode 100644 index 000000000..6bb4e355d --- /dev/null +++ b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md @@ -0,0 +1,26 @@ +# Protect CI Secrets in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-protect-ci-secrets` +**Uses:** `gitlab/project/protect-ci-secrets@v2/rules` +**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/protect-ci-secrets.yaml) +**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/protect-ci-secrets.rego) +**Labels:** Gitlab, Project + +Verify secrets in the GitLab project are not shared. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)(token|secret) | diff --git a/docs/configuration/rules/gitlab/project/push-access-level.md b/docs/configuration/rules/gitlab/project/push-access-level.md new file mode 100644 index 000000000..4d19f5a4a --- /dev/null +++ b/docs/configuration/rules/gitlab/project/push-access-level.md @@ -0,0 +1,27 @@ +# Set Push Access Level in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-push-access-level` +**Uses:** `gitlab/project/push-access-level@v2/rules` +**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-access-level.yaml) +**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-access-level.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's push access level policy complies with requirements. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | +| access_level_description | Maintainers | diff --git a/docs/configuration/rules/gitlab/project/push-rules-set.md b/docs/configuration/rules/gitlab/project/push-rules-set.md new file mode 100644 index 000000000..f64acc55b --- /dev/null +++ b/docs/configuration/rules/gitlab/project/push-rules-set.md @@ -0,0 +1,22 @@ +# Set Push Rules for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-push_rules` +**Uses:** `gitlab/project/push-rules-set@v2/rules` +**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-rules-set.yaml) +**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-rules-set.rego) +**Labels:** Gitlab, Project + +Verify push rules are set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md new file mode 100644 index 000000000..485a9285b --- /dev/null +++ b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md @@ -0,0 +1,22 @@ +# Reject Unsigned Commits in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-disallow-unsigned-commits` +**Uses:** `gitlab/project/reject-unsigned-commits@v2/rules` +**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reject-unsigned-commits.yaml) +**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reject-unsigned-commits.rego) +**Labels:** Blueprint, Gitlab, Project + +Verify `reject_unsigned_commits` is enabled for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/rules/gitlab/project/require-password-to-approve.md new file mode 100644 index 000000000..a586964e0 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/require-password-to-approve.md @@ -0,0 +1,26 @@ +# Require Password for Approvals in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-require-password-to-approve` +**Uses:** `gitlab/project/require-password-to-approve@v2/rules` +**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/require-password-to-approve.yaml) +**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/require-password-to-approve.rego) +**Labels:** Gitlab, Project + +Verify the binary field `require_password_to_approve` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| require_password_to_approve | True | diff --git a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md new file mode 100644 index 000000000..93757e3b0 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md @@ -0,0 +1,22 @@ +# Require Minimal Approvers in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-required-minimal-approvers` +**Uses:** `gitlab/project/required-minimal-approvers@v2/rules` +**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/required-minimal-approvers.yaml) +**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/required-minimal-approvers.rego) +**Labels:** Gitlab, Project + +Verify the required number of approvers for the GitLab project is met. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md new file mode 100644 index 000000000..9ac95865c --- /dev/null +++ b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md @@ -0,0 +1,26 @@ +# Reset Approvals on Push in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-reset-pprovals-on-push` +**Uses:** `gitlab/project/reset-pprovals-on-push@v2/rules` +**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) +**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reset-pprovals-on-push.rego) +**Labels:** Gitlab, Project + +Verify `reset_approvals_on_push` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| reset_approvals_on_push | True | diff --git a/docs/configuration/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/rules/gitlab/project/sast-scan-pass.md new file mode 100644 index 000000000..2968bd3ac --- /dev/null +++ b/docs/configuration/rules/gitlab/project/sast-scan-pass.md @@ -0,0 +1,22 @@ +# Ensure SAST Scanning Passes +**Type:** Rule +**ID:** `gitlab-project-sast-scan-pass` +**Uses:** `gitlab/project/sast-scan-pass@v2/rules` +**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scan-pass.yaml) +**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scan-pass.rego) +**Labels:** Gitlab, Project + +Verify SAST scanning is successful for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/sast-scanning.md b/docs/configuration/rules/gitlab/project/sast-scanning.md new file mode 100644 index 000000000..383ef4967 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/sast-scanning.md @@ -0,0 +1,22 @@ +# Run SAST Scanning in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-sast-scanning` +**Uses:** `gitlab/project/sast-scanning@v2/rules` +**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scanning.yaml) +**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scanning.rego) +**Labels:** Gitlab, Project + +Verify SAST scanning is performed for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md new file mode 100644 index 000000000..49eed6531 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md @@ -0,0 +1,22 @@ +# Ensure Secrets Scanning Passes +**Type:** Rule +**ID:** `gitlab-project-secrets-scan-pass` +**Uses:** `gitlab/project/secrets-scan-pass@v2/rules` +**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scan-pass.yaml) +**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scan-pass.rego) +**Labels:** Gitlab, Project + +Verify secrets scanning is successful for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/secrets-scanning.md b/docs/configuration/rules/gitlab/project/secrets-scanning.md new file mode 100644 index 000000000..07a4dd747 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/secrets-scanning.md @@ -0,0 +1,22 @@ +# Run Secrets Scanning in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-secrets-scanning` +**Uses:** `gitlab/project/secrets-scanning@v2/rules` +**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scanning.yaml) +**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scanning.rego) +**Labels:** Gitlab, Project + +Verify secrets scanning is performed for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md new file mode 100644 index 000000000..9c74c8e3c --- /dev/null +++ b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md @@ -0,0 +1,26 @@ +# Restrict Selective Code Owner Removals in GitLab +**Type:** Rule +**ID:** `gitlab-project-selective-code-owner-removals` +**Uses:** `gitlab/project/selective-code-owner-removals@v2/rules` +**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/selective-code-owner-removals.yaml) +**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/selective-code-owner-removals.rego) +**Labels:** Gitlab, Project + +Verify `selective_code_owner_removals` is set for the GitLab project. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| selective_code_owner_removals | True | diff --git a/docs/configuration/rules/gitlab/project/visibility-check.md b/docs/configuration/rules/gitlab/project/visibility-check.md new file mode 100644 index 000000000..4b2ed1707 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/visibility-check.md @@ -0,0 +1,26 @@ +# Set Visibility Level in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-project-visibility-level` +**Uses:** `gitlab/project/visibility-check@v2/rules` +**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/visibility-check.yaml) +**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/visibility-check.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's visibility matches the required level. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| visibility | private | diff --git a/docs/configuration/rules/images/blocklist-build-scripts.md b/docs/configuration/rules/images/blocklist-build-scripts.md new file mode 100644 index 000000000..b6cb4a2fd --- /dev/null +++ b/docs/configuration/rules/images/blocklist-build-scripts.md @@ -0,0 +1,35 @@ +# Restrict Build Scripts +**Type:** Rule +**ID:** `images-disallowed-build-script` +**Uses:** `images/blocklist-build-scripts@v2/rules` +**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-build-scripts.yaml) +**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-build-scripts.rego) +**Labels:** SBOM, Images + +Verify no build scripts commands appear in block list. + + +## Mitigation +Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". +It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. +If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | diff --git a/docs/configuration/rules/images/forbid-large-images.md b/docs/configuration/rules/images/forbid-large-images.md new file mode 100644 index 000000000..8392fc76a --- /dev/null +++ b/docs/configuration/rules/images/forbid-large-images.md @@ -0,0 +1,44 @@ +# Forbid Large Images +**Type:** Rule +**ID:** `images-project-large-image` +**Uses:** `images/forbid-large-images@v2/rules` +**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/forbid-large-images.yaml) +**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/forbid-large-images.rego) +**Labels:** SBOM, Images + +Verify the image size is below the specified threshold. + + +## Mitigation +Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components +to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically +looks for the size property when the associated "index" property is "0" (which typically represents the overall image size). +The extracted size is then converted to a numeric value and compared against the maximum size specified in the rule's configuration (`max_size`). + +- If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable. +- If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size. + +**Evidence Requirements:** + +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_size | 77819980 | diff --git a/docs/configuration/rules/images/fresh-image.md b/docs/configuration/rules/images/fresh-image.md new file mode 100644 index 000000000..6eda47239 --- /dev/null +++ b/docs/configuration/rules/images/fresh-image.md @@ -0,0 +1,41 @@ +# Fresh Image +**Type:** Rule +**ID:** `fresh-image` +**Uses:** `images/fresh-image@v2/rules` +**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-image.yaml) +**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-image.rego) +**Labels:** SBOM, Images + +Verify the image is not older than the specified threshold. + + +## Mitigation +Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" +within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339. + +The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum, +the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time. + +**Evidence Requirements:** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 183 | diff --git a/docs/configuration/rules/images/restrict-shell-entrypoint.md b/docs/configuration/rules/images/restrict-shell-entrypoint.md new file mode 100644 index 000000000..c0d3a3baf --- /dev/null +++ b/docs/configuration/rules/images/restrict-shell-entrypoint.md @@ -0,0 +1,30 @@ +# Disallow Container Shell Entrypoint +**Type:** Rule +**ID:** `images-disallow-shell-access` +**Uses:** `images/restrict-shell-entrypoint@v2/rules` +**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/restrict-shell-entrypoint.yaml) +**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/restrict-shell-entrypoint.rego) +**Labels:** SBOM, Images + +Verify the container image disallows shell entrypoint. + + +## Mitigation +Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). +**Evidence Requirements:** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + diff --git a/docs/configuration/rules/images/verify-labels-exist.md b/docs/configuration/rules/images/verify-labels-exist.md new file mode 100644 index 000000000..0dd55aea0 --- /dev/null +++ b/docs/configuration/rules/images/verify-labels-exist.md @@ -0,0 +1,44 @@ +# Require Image Labels +**Type:** Rule +**ID:** `required-image-labels` +**Uses:** `images/verify-labels-exist@v2/rules` +**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels-exist.rego) +**Labels:** SBOM, Images + +Verify the image has the specified labels. + + +## Mitigation +Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label +(as defined in the `with.labels` parameter) exists with the correct value. + +1. The rule iterates over the list of required labels provided in the `with.labels` configuration. +2. For each required label, it examines the `metadata.component.properties` array in the SBOM. +3. It looks for a property where the name starts with "label_" and ends with the required label key, and + where the property value matches the expected value. +4. If such a property is not found, a violation is recorded with the missing label and expected value details. + +**Evidence Requirements:** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array that contains label information. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | [] | diff --git a/docs/configuration/rules/images/verify-labels.md b/docs/configuration/rules/images/verify-labels.md new file mode 100644 index 000000000..9b0abdd10 --- /dev/null +++ b/docs/configuration/rules/images/verify-labels.md @@ -0,0 +1,44 @@ +# Verify Image Labels +**Type:** Rule +**ID:** `image-labels` +**Uses:** `images/verify-labels@v2/rules` +**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels.rego) +**Labels:** SBOM, Images + +Verify specified labels key-value pairs exist in the image. + + +## Mitigation +Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Description +This rule checks the CycloneDX SBOM evidence for the container image to verify that each +required label (as defined in the `with.labels` parameter) exists with the correct value. + +1. The rule iterates over the list of required labels provided in the `with.labels` configuration. +2. For each required label, it examines the `metadata.component.properties` array in the SBOM. +3. It looks for a property where the name starts with "label_" and ends with the required label key, and + where the property value matches the expected value. +4. If such a property is not found, a violation is recorded with the missing label and expected value details. + +**Evidence Requirements:** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array that contains label information. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | [] | diff --git a/docs/configuration/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/rules/jenkins/folder/exposed-credentials.md new file mode 100644 index 000000000..94acafe8e --- /dev/null +++ b/docs/configuration/rules/jenkins/folder/exposed-credentials.md @@ -0,0 +1,22 @@ +# Verify Exposed Credentials +**Type:** Rule +**ID:** `jenkins-exposed-credentials` +**Uses:** `jenkins/folder/exposed-credentials@v2/rules` +**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/folder/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/folder/exposed-credentials.rego) +**Labels:** Jenkins, Folder + +Verify there are no exposed credentials. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=folder | + diff --git a/docs/configuration/rules/jenkins/instance/inactive-users.md b/docs/configuration/rules/jenkins/instance/inactive-users.md new file mode 100644 index 000000000..75b982be6 --- /dev/null +++ b/docs/configuration/rules/jenkins/instance/inactive-users.md @@ -0,0 +1,25 @@ +# Verify Inactive Users +**Type:** Rule +**ID:** `jenkins-inactive-users` +**Uses:** `jenkins/instance/inactive-users@v2/rules` +**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/inactive-users.yaml) +**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/inactive-users.rego) +**Labels:** Jenkins, Instance + +Verify there are no inactive users. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=instance
- platform=jenkins | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 90 | diff --git a/docs/configuration/rules/jenkins/instance/unused-users.md b/docs/configuration/rules/jenkins/instance/unused-users.md new file mode 100644 index 000000000..10ad14ce7 --- /dev/null +++ b/docs/configuration/rules/jenkins/instance/unused-users.md @@ -0,0 +1,21 @@ +# Disallow Unused Users +**Type:** Rule +**ID:** `jenkins-unused-users` +**Uses:** `jenkins/instance/unused-users@v2/rules` +**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/unused-users.yaml) +**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/unused-users.rego) +**Labels:** Jenkins, Instance + +Verify there are no users with zero activity. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=instance
- platform=jenkins | + diff --git a/docs/configuration/rules/k8s/namespace/allowed-images.md b/docs/configuration/rules/k8s/namespace/allowed-images.md new file mode 100644 index 000000000..d88c4070c --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/allowed-images.md @@ -0,0 +1,26 @@ +# Allowed Container Images +**Type:** Rule +**ID:** `k8s-namespace-blocked-images` +**Uses:** `k8s/namespace/allowed-images@v2/rules` +**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-images.yaml) +**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/blocked-images.rego) +**Labels:** K8s, Namespace + +Verify only container images specified in the Allowed List run within the Kubernetes namespace. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| images_to_include | [] | diff --git a/docs/configuration/rules/k8s/namespace/allowed-registries.md b/docs/configuration/rules/k8s/namespace/allowed-registries.md new file mode 100644 index 000000000..120244f49 --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/allowed-registries.md @@ -0,0 +1,26 @@ +# Allowed Namespace Registries +**Type:** Rule +**ID:** `k8s-namespace-allowed-registries` +**Uses:** `k8s/namespace/allowed-registries@v2/rules` +**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-registries.yaml) +**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-registries.rego) +**Labels:** K8s, Namespace + +Verify container images in Kubernetes namespaces originate from registries in the Allowed List. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_registries | [] | diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md new file mode 100644 index 000000000..c158b3560 --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md @@ -0,0 +1,26 @@ +# Verify Namespace Runtime Duration +**Type:** Rule +**ID:** `k8s-namespace-verify-namespace-duration` +**Uses:** `k8s/namespace/verify-namespace-duration@v2/rules` +**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-duration.yaml) +**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-duration.rego) +**Labels:** K8s, Namespace + +Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| threshold_date | 1970-01-01T00:00:00Z | diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md new file mode 100644 index 000000000..11e7ca77b --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md @@ -0,0 +1,26 @@ +# Verify Namespace Termination +**Type:** Rule +**ID:** `k8s-namespace-verify-namespace-termination` +**Uses:** `k8s/namespace/verify-namespace-termination@v2/rules` +**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-termination.yaml) +**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-termination.rego) +**Labels:** K8s, Namespace + +Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| namespaces | ['.*'] | diff --git a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md new file mode 100644 index 000000000..1f8c6d7e7 --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md @@ -0,0 +1,26 @@ +# Allowed Namespaces +**Type:** Rule +**ID:** `k8s-namespace-white-listed-namespaces` +**Uses:** `k8s/namespace/white-listed-namespaces@v2/rules` +**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-namespaces.yaml) +**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-namespaces.rego) +**Labels:** K8s, Namespace + +Verify only namespaces specified in the Allowed List are allowed within the cluster. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| namespaces | [] | diff --git a/docs/configuration/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/rules/k8s/namespace/white-listed-pod.md new file mode 100644 index 000000000..efd3a6001 --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/white-listed-pod.md @@ -0,0 +1,27 @@ +# Allowed Pods in Namespace +**Type:** Rule +**ID:** `k8s-namespace-white-listed-pod` +**Uses:** `k8s/namespace/white-listed-pod@v2/rules` +**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-pod.rego) +**Labels:** K8s, Namespace + +Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| white_listed_pod | [] | +| verify_namespaces | ['.*'] | diff --git a/docs/configuration/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/rules/k8s/pods/verify-pod-duration.md new file mode 100644 index 000000000..8fe319bc0 --- /dev/null +++ b/docs/configuration/rules/k8s/pods/verify-pod-duration.md @@ -0,0 +1,26 @@ +# Verify Pod Runtime Duration +**Type:** Rule +**ID:** `k8s-pods-verify-pod-duration` +**Uses:** `k8s/pods/verify-pod-duration@v2/rules` +**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-duration.yaml) +**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-duration.rego) +**Labels:** K8s, Pod + +Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 30 | diff --git a/docs/configuration/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/rules/k8s/pods/verify-pod-termination.md new file mode 100644 index 000000000..6601f5e10 --- /dev/null +++ b/docs/configuration/rules/k8s/pods/verify-pod-termination.md @@ -0,0 +1,22 @@ +# Verify Pod Termination +**Type:** Rule +**ID:** `k8s-pods-verify-pod-termination` +**Uses:** `k8s/pods/verify-pod-termination@v2/rules` +**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-termination.yaml) +**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-termination.rego) +**Labels:** K8s, Pod + +Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod | + diff --git a/docs/configuration/rules/k8s/pods/white-listed-pod.md b/docs/configuration/rules/k8s/pods/white-listed-pod.md new file mode 100644 index 000000000..f36b37150 --- /dev/null +++ b/docs/configuration/rules/k8s/pods/white-listed-pod.md @@ -0,0 +1,27 @@ +# Allowed Pods +**Type:** Rule +**ID:** `k8s-pods-white-listed-pod` +**Uses:** `k8s/pods/white-listed-pod@v2/rules` +**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/white-listed-pod.rego) +**Labels:** K8s, Pod + +Verify only pods explicitly listed in the Allowed List are allowed to run. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| white_listed_pod | [] | +| verify_namespaces | ['.*'] | diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md new file mode 100644 index 000000000..f4e0e83ba --- /dev/null +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -0,0 +1,26 @@ +# Verify File Integrity +**Type:** Rule +**ID:** `file-integrity` +**Uses:** `multievidence/files_integrity@v2/rules` +**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/v2/rules/multievidence/files_integrity.yaml) +**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/v2/rules/multievidence/files_integrity.rego) +**Labels:** SBOM + +Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS** required by default. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | cyclonedx-json | +| target_type | container | +| labels | - new_evidence | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| ref_sbom | {{ .Env.REF_SBOM_DATA }} | +| path_prefix | pkg:file/ | diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/rules/sarif/artifact-signed.md new file mode 100644 index 000000000..6ec8eb6e7 --- /dev/null +++ b/docs/configuration/rules/sarif/artifact-signed.md @@ -0,0 +1,25 @@ +# Verify Artifact Signature in SARIF +**Type:** Rule +**ID:** `sarif-artifact-signed` +**Uses:** `sarif/artifact-signed@v2/rules` +**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/artifact-signed.rego) +**Labels:** SARIF + +Verify the artifact referenced in the SARIF report is signed to confirm its integrity. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS** required by default. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | {'common-names': [], 'emails': []} | diff --git a/docs/configuration/rules/sarif/evidence-exists.md b/docs/configuration/rules/sarif/evidence-exists.md new file mode 100644 index 000000000..729329715 --- /dev/null +++ b/docs/configuration/rules/sarif/evidence-exists.md @@ -0,0 +1,21 @@ +# Verify Required Evidence in SARIF +**Type:** Rule +**ID:** `required-sarif-evidence` +**Uses:** `sarif/evidence-exists@v2/rules` +**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/evidence-exists.rego) +**Labels:** SARIF + +Verify all required evidence exists as defined by the SARIF policy. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/rules/sarif/patcheck/updates-needed.md b/docs/configuration/rules/sarif/patcheck/updates-needed.md new file mode 100644 index 000000000..01ad48e98 --- /dev/null +++ b/docs/configuration/rules/sarif/patcheck/updates-needed.md @@ -0,0 +1,21 @@ +# SARIF Update Needed +**Type:** Rule +**ID:** `sarif-update-needed` +**Uses:** `sarif/patcheck/updates-needed@v2/rules` +**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/patcheck/updates-needed.yaml) +**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/patcheck/updates-needed.rego) +**Labels:** SARIF + +Verify no security packages require updates. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/rules/sarif/report-iac-errors.md b/docs/configuration/rules/sarif/report-iac-errors.md new file mode 100644 index 000000000..7838e0faf --- /dev/null +++ b/docs/configuration/rules/sarif/report-iac-errors.md @@ -0,0 +1,25 @@ +# Verify IaC Misconfiguration Threshold in SARIF +**Type:** Rule +**ID:** `sarif-iac-findings` +**Uses:** `sarif/report-iac-errors@v2/rules` +**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/report-iac-errors.yaml) +**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/report-iac-errors.rego) +**Labels:** SARIF + +Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md new file mode 100644 index 000000000..2fbdda371 --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md @@ -0,0 +1,25 @@ +# Verify IaC Misconfiguration Threshold in Trivy SARIF +**Type:** Rule +**ID:** `trivy-iac-findings` +**Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` +**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) +**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../report-iac-errors.rego) +**Labels:** SARIF, Trivy + +Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md new file mode 100644 index 000000000..a66f02791 --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -0,0 +1,26 @@ +# Verify Attack Vector Threshold in Trivy SARIF +**Type:** Rule +**ID:** `trivy-attack-vectors` +**Uses:** `sarif/trivy/verify-trivy-attack-vector@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) +**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../verify-attack-vector.rego) +**Labels:** SARIF, Trivy + +Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| attack_vectors | [] | +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md new file mode 100644 index 000000000..4d99da78a --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md @@ -0,0 +1,30 @@ +# Verify Trivy SARIF Report Compliance +**Type:** Rule +**ID:** `trivy-report` +**Uses:** `sarif/trivy/verify-trivy-report@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-trivy-report.yaml) +**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../verify-sarif.rego) +**Labels:** SARIF, Trivy + +Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| tool | Trivy Vulnerability Scanner | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| rule_level | [] | +| precision | [] | +| rule_ids | [] | +| ignore | [] | +| max_allowed | 0 | diff --git a/docs/configuration/rules/sarif/verify-attack-vector.md b/docs/configuration/rules/sarif/verify-attack-vector.md new file mode 100644 index 000000000..a598e814c --- /dev/null +++ b/docs/configuration/rules/sarif/verify-attack-vector.md @@ -0,0 +1,26 @@ +# Verify Attack Vector Exists in SARIF +**Type:** Rule +**ID:** `sarif-attack-vectors` +**Uses:** `sarif/verify-attack-vector@v2/rules` +**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-attack-vector.yaml) +**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-attack-vector.rego) +**Labels:** SARIF + +Verify required evidence validates attack vectors in the SARIF report. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| attack_vectors | [] | +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/verify-sarif.md b/docs/configuration/rules/sarif/verify-sarif.md new file mode 100644 index 000000000..713501603 --- /dev/null +++ b/docs/configuration/rules/sarif/verify-sarif.md @@ -0,0 +1,29 @@ +# Verify Rule Compliance in SARIF +**Type:** Rule +**ID:** `sarif-policy` +**Uses:** `sarif/verify-sarif@v2/rules` +**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-sarif.yaml) +**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-sarif.rego) +**Labels:** SARIF + +Verify the SARIF report complies with defined generic rules for compliance and security. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| rule_level | [] | +| precision | [] | +| rule_ids | [] | +| ignore | [] | +| max_allowed | 0 | diff --git a/docs/configuration/rules/sarif/verify-semgrep-report.md b/docs/configuration/rules/sarif/verify-semgrep-report.md new file mode 100644 index 000000000..2db6a148a --- /dev/null +++ b/docs/configuration/rules/sarif/verify-semgrep-report.md @@ -0,0 +1,26 @@ +# Verify Semgrep Rule in SARIF +**Type:** Rule +**ID:** `sarif-semgrep-report` +**Uses:** `sarif/verify-semgrep-report@v2/rules` +**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-semgrep-report.yaml) +**Rego Source:** [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-semgrep-report.rego) +**Labels:** SARIF, Semgrep + +Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| rule_ids | [] | +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/verify-tool-evidence.md b/docs/configuration/rules/sarif/verify-tool-evidence.md new file mode 100644 index 000000000..70db62dc4 --- /dev/null +++ b/docs/configuration/rules/sarif/verify-tool-evidence.md @@ -0,0 +1,22 @@ +# Verify Tool Evidence in SARIF +**Type:** Rule +**ID:** `sarif-tool-evidence` +**Uses:** `sarif/verify-tool-evidence@v2/rules` +**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-tool-evidence.yaml) +**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-tool-evidence.rego) +**Labels:** SARIF + +Verify required tools were used to generate the SARIF report. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| tool | semgrep | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/rules/sbom/allowed-components.md b/docs/configuration/rules/sbom/allowed-components.md new file mode 100644 index 000000000..daf979e6d --- /dev/null +++ b/docs/configuration/rules/sbom/allowed-components.md @@ -0,0 +1,27 @@ +# Enforce Allowed SBOM Components +**Type:** Rule +**ID:** `sbom-allowed-components` +**Uses:** `sbom/allowed-components@v2/rules` +**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/allowed-components.yaml) +**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/allowed-components.rego) +**Labels:** SBOM, Image + +Verify the artifact contains only allowed components. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| types | ['library', 'operating-system'] | +| allowlist | [] | diff --git a/docs/configuration/rules/sbom/artifact-signed.md b/docs/configuration/rules/sbom/artifact-signed.md new file mode 100644 index 000000000..e7e103ae1 --- /dev/null +++ b/docs/configuration/rules/sbom/artifact-signed.md @@ -0,0 +1,25 @@ +# Require SBOM Signature +**Type:** Rule +**ID:** `sbom-signed` +**Uses:** `sbom/artifact-signed@v2/rules` +**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/artifact-signed.rego) +**Labels:** SBOM, Blueprint + +Verify the SBOM is signed. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS** required by default. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | True | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | {'common-names': [], 'emails': []} | diff --git a/docs/configuration/rules/sbom/banned-licenses.md b/docs/configuration/rules/sbom/banned-licenses.md new file mode 100644 index 000000000..498c82df1 --- /dev/null +++ b/docs/configuration/rules/sbom/banned-licenses.md @@ -0,0 +1,27 @@ +# Restrict Disallowed SBOM Licenses +**Type:** Rule +**ID:** `sbom-disallowed-licenses` +**Uses:** `sbom/banned-licenses@v2/rules` +**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-licenses.yaml) +**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-licenses.rego) +**Labels:** SBOM, Image + +Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | +| blocklisted_limit | 0 | diff --git a/docs/configuration/rules/sbom/banned-users.md b/docs/configuration/rules/sbom/banned-users.md new file mode 100644 index 000000000..3da488306 --- /dev/null +++ b/docs/configuration/rules/sbom/banned-users.md @@ -0,0 +1,24 @@ +# Disallow Specific Users in SBOM +**Type:** Rule +**ID:** `sbom-disallowed-users` +**Uses:** `sbom/banned-users@v2/rules` +**Source:** [v2/rules/sbom/banned-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-users.yaml) +**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-users.rego) +**Labels:** SBOM, Image + +Verify specific users are not allowed in an SBOM. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| users | ['root'] | diff --git a/docs/configuration/rules/sbom/blocklist-packages.md b/docs/configuration/rules/sbom/blocklist-packages.md new file mode 100644 index 000000000..ab2afde32 --- /dev/null +++ b/docs/configuration/rules/sbom/blocklist-packages.md @@ -0,0 +1,27 @@ +# Restrict Disallowed Dependencies +**Type:** Rule +**ID:** `sbom-disallow-dependencies` +**Uses:** `sbom/blocklist-packages@v2/rules` +**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/blocklist-packages.yaml) +**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/blocklist-packages.rego) +**Labels:** SBOM, Image, Blueprint + +Verify the number of disallowed dependencies remains below the specified threshold. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | +| blocklisted_limit | 0 | diff --git a/docs/configuration/rules/sbom/complete-licenses.md b/docs/configuration/rules/sbom/complete-licenses.md new file mode 100644 index 000000000..c9a9fc0f3 --- /dev/null +++ b/docs/configuration/rules/sbom/complete-licenses.md @@ -0,0 +1,22 @@ +# Enforce SBOM License Completeness +**Type:** Rule +**ID:** `sbom-require-complete-license-set` +**Uses:** `sbom/complete-licenses@v2/rules` +**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/complete-licenses.yaml) +**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/complete-licenses.rego) +**Labels:** SBOM, Image + +Verify all dependencies in the artifact have a license. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + diff --git a/docs/configuration/rules/sbom/evidence-exists.md b/docs/configuration/rules/sbom/evidence-exists.md new file mode 100644 index 000000000..5860a11f0 --- /dev/null +++ b/docs/configuration/rules/sbom/evidence-exists.md @@ -0,0 +1,21 @@ +# Require SBOM Existence +**Type:** Rule +**ID:** `require-sbom` +**Uses:** `sbom/evidence-exists@v2/rules` +**Source:** [v2/rules/sbom/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/evidence-exists.rego) +**Labels:** SBOM, Blueprint + +Verify the SBOM exists as evidence. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | False | + diff --git a/docs/configuration/rules/sbom/fresh-sbom.md b/docs/configuration/rules/sbom/fresh-sbom.md new file mode 100644 index 000000000..2e9f4b518 --- /dev/null +++ b/docs/configuration/rules/sbom/fresh-sbom.md @@ -0,0 +1,25 @@ +# Enforce SBOM Freshness +**Type:** Rule +**ID:** `fresh-sbom` +**Uses:** `sbom/fresh-sbom@v2/rules` +**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/fresh-sbom.yaml) +**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/fresh-sbom.rego) +**Labels:** SBOM + +Verify the SBOM is not older than the specified duration. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 30 | diff --git a/docs/configuration/rules/sbom/required-packages.md b/docs/configuration/rules/sbom/required-packages.md new file mode 100644 index 000000000..3bf944ed2 --- /dev/null +++ b/docs/configuration/rules/sbom/required-packages.md @@ -0,0 +1,27 @@ +# Enforce SBOM Dependencies +**Type:** Rule +**ID:** `sbom-required-dependencies` +**Uses:** `sbom/required-packages@v2/rules` +**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/required-packages.yaml) +**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/required-packages.rego) +**Labels:** SBOM, Image + +Verify the artifact includes all required dependencies. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| required_pkgs | [] | +| violations_limit | 0 | diff --git a/docs/configuration/rules/sbom/verify-huggingface-license.md b/docs/configuration/rules/sbom/verify-huggingface-license.md new file mode 100644 index 000000000..8f5634994 --- /dev/null +++ b/docs/configuration/rules/sbom/verify-huggingface-license.md @@ -0,0 +1,26 @@ +# Require Specified SBOM Licenses +**Type:** Rule +**ID:** `sbom-hf-license` +**Uses:** `sbom/verify-huggingface-license@v2/rules` +**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/verify-huggingface-license.yaml) +**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/verify-hf-license.rego) +**Labels:** SBOM, Image + +Verify the artifact includes all specified licenses. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| licenses | [] | diff --git a/docs/configuration/rules/slsa/banned-builder-deps.md b/docs/configuration/rules/slsa/banned-builder-deps.md new file mode 100644 index 000000000..e689cb77d --- /dev/null +++ b/docs/configuration/rules/slsa/banned-builder-deps.md @@ -0,0 +1,24 @@ +# Disallow dependencies in SLSA Provenance Document +**Type:** Rule +**ID:** `slsa-builder-unallowed-dependencies` +**Uses:** `slsa/banned-builder-deps@v2/rules` +**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/banned-builder-deps.yaml) +**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/banned-builder-deps.rego) +**Labels:** SLSA, Image + +Verify that dependencies in the block list do not appear in the SLSA Proveance document. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | diff --git a/docs/configuration/rules/slsa/build-time.md b/docs/configuration/rules/slsa/build-time.md new file mode 100644 index 000000000..193d346f1 --- /dev/null +++ b/docs/configuration/rules/slsa/build-time.md @@ -0,0 +1,26 @@ +# Verify build time +**Type:** Rule +**ID:** `slsa-build-time` +**Uses:** `slsa/build-time@v2/rules` +**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/build-time.yaml) +**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/build-time.rego) +**Labels:** SLSA, Image + +Verify the artifact was created within the specified time window. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| start_hour | 8 | +| end_hour | 20 | +| workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] | diff --git a/docs/configuration/rules/slsa/field-exists.md b/docs/configuration/rules/slsa/field-exists.md new file mode 100644 index 000000000..4eff15cbe --- /dev/null +++ b/docs/configuration/rules/slsa/field-exists.md @@ -0,0 +1,25 @@ +# SLSA Field Exists in Provenance Document +**Type:** Rule +**ID:** `slsa-field-exists` +**Uses:** `slsa/field-exists@v2/rules` +**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/field-exists.yaml) +**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/field-exists.rego) +**Labels:** SLSA, Image + +Verify the specified field exists in the provenance document. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| paths | [] | +| violations_threshold | 0 | diff --git a/docs/configuration/rules/slsa/l1-provenance-exists.md b/docs/configuration/rules/slsa/l1-provenance-exists.md new file mode 100644 index 000000000..8d23f55e7 --- /dev/null +++ b/docs/configuration/rules/slsa/l1-provenance-exists.md @@ -0,0 +1,26 @@ +# Verify Provenance Document Exists +**Type:** Rule +**ID:** `SLSA.L1` +**Uses:** `slsa/l1-provenance-exists@v2/rules` +**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l1-provenance-exists.yaml) +**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l1-provenance-exists.rego) +**Help:** https://slsa.dev/spec/v1.0/requirements +**Labels:** SLSA + +Verify that the Provenance document evidence exists. + + +## Mitigation +Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | slsa | + diff --git a/docs/configuration/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/rules/slsa/l2-provenance-authenticated.md new file mode 100644 index 000000000..53002f8e0 --- /dev/null +++ b/docs/configuration/rules/slsa/l2-provenance-authenticated.md @@ -0,0 +1,31 @@ +# Verify that provenance is authenticated +**Type:** Rule +**ID:** `SLSA.L2` +**Uses:** `slsa/l2-provenance-authenticated@v2/rules` +**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l2-provenance-authenticated.yaml) +**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l2-provenance-authenticated.rego) +**Help:** https://slsa.dev/spec/v1.0/requirements +**Labels:** SLSA + +Verify the artifact is signed. + + +## Mitigation +Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. + + +> Evidence **IS** required for this rule and will fail if missing. +> Signed Evidence for this rule **IS** required by default. +> This rule scoped by product and target. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | True | +| content_body_type | slsa | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | {'common-names': [], 'emails': []} | diff --git a/docs/configuration/rules/slsa/verify-builder.md b/docs/configuration/rules/slsa/verify-builder.md new file mode 100644 index 000000000..b395e1bba --- /dev/null +++ b/docs/configuration/rules/slsa/verify-builder.md @@ -0,0 +1,26 @@ +# Verify that artifact was created by the specified builder +**Type:** Rule +**ID:** `slsa-verify-builder` +**Uses:** `slsa/verify-builder@v2/rules` +**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-builder.yaml) +**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-builder.rego) +**Labels:** SLSA, Image + +Verify the artifact was created by the specified builder. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. +> This rule scoped by pipeline and product. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['pipeline', 'product'] | +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| id | {{ .Env.HOSTNAME }} | diff --git a/docs/configuration/rules/slsa/verify-byproducts.md b/docs/configuration/rules/slsa/verify-byproducts.md new file mode 100644 index 000000000..ed91d42aa --- /dev/null +++ b/docs/configuration/rules/slsa/verify-byproducts.md @@ -0,0 +1,24 @@ +# Verify that artifact has no disallowed builder dependencies +**Type:** Rule +**ID:** `slsa-verify-byproducts` +**Uses:** `slsa/verify-byproducts@v2/rules` +**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-byproducts.yaml) +**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-byproducts.rego) +**Labels:** SLSA, Image + +Verify the artifact has no disallowed builder dependencies. + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| byproducts | [] | diff --git a/docs/configuration/rules/ssdf/ps-1-2fa.md b/docs/configuration/rules/ssdf/ps-1-2fa.md new file mode 100644 index 000000000..4e398d34a --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-1-2fa.md @@ -0,0 +1,21 @@ +# Enforce 2FA +**Type:** Rule +**ID:** `PS.1.1` +**Uses:** `ssdf/ps-1-2fa@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-2fa.yaml) +**Labels:** SSDF + +PS.1 Require 2FA for accessing code + + +## Mitigation +Enforces two-factor authentication (2FA), significantly reducing the risk of compromised credentials. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | diff --git a/docs/configuration/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/rules/ssdf/ps-1-branch-protection.md new file mode 100644 index 000000000..5c50f21d0 --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-1-branch-protection.md @@ -0,0 +1,21 @@ +# Branch protected +**Type:** Rule +**ID:** `PS.1.2` +**Uses:** `ssdf/ps-1-branch-protection@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-branch-protection.yaml) +**Labels:** SSDF + +PS.1 Require branch protection for the repository + + +## Mitigation +Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_protected | True | diff --git a/docs/configuration/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/rules/ssdf/ps-1-limit-admins.md new file mode 100644 index 000000000..224e664cc --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-1-limit-admins.md @@ -0,0 +1,21 @@ +# Limit admins +**Type:** Rule +**ID:** `PS.1.3` +**Uses:** `ssdf/ps-1-limit-admins@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-limit-admins.yaml) +**Labels:** SSDF + +PS.1 Restrict the maximum number of organization admins + + +## Mitigation +Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 3 | diff --git a/docs/configuration/rules/ssdf/ps-1-repo-private.md b/docs/configuration/rules/ssdf/ps-1-repo-private.md new file mode 100644 index 000000000..3e7baa798 --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-1-repo-private.md @@ -0,0 +1,21 @@ +# Repo private +**Type:** Rule +**ID:** `PS.1.4` +**Uses:** `ssdf/ps-1-repo-private@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-repo-private.yaml) +**Labels:** SSDF + +PS.1 Assure the repository is private + + +## Mitigation +Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | diff --git a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md new file mode 100644 index 000000000..f8009edbc --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md @@ -0,0 +1,21 @@ +# Require signoff on web commits +**Type:** Rule +**ID:** `PS.1.5` +**Uses:** `ssdf/ps-1-web-commit-signoff@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) +**Labels:** SSDF + +PS.1 Require contributors to sign when committing to Github through the web interface + + +## Mitigation +Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | diff --git a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md new file mode 100644 index 000000000..adcb30226 --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md @@ -0,0 +1,22 @@ +# Image-verifiable +**Type:** Rule +**ID:** `PS.2` +**Uses:** `ssdf/ps-2-image-verifiable@v2/rules` +**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-2-image-verifiable.yaml) +**Labels:** SSDF + +PS.2 Provide a mechanism to verify the integrity of the image + + +## Mitigation +Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| target_type | container | + diff --git a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md new file mode 100644 index 000000000..93e8de4d4 --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md @@ -0,0 +1,26 @@ +# Code archived +**Type:** Rule +**ID:** `PS.3.1` +**Uses:** `ssdf/ps-3.1-code-archived@v2/rules` +**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-3.1-code-archived.yaml) +**Labels:** SSDF + +PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + + + +## Mitigation +Archives code changes to maintain a secure, immutable history for auditing and traceability. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allow | True | +| short_description | Code is archived. | +| description | Since the code is within a repository, it is archived. | +| reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. | diff --git a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md new file mode 100644 index 000000000..5dc1946a8 --- /dev/null +++ b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md @@ -0,0 +1,17 @@ +# SBOM archived +**Type:** Rule +**ID:** `PS.3.2` +**Uses:** `ssdf/ps-3.2-archived-sbom@v2/rules` +**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) +**Labels:** SSDF + +PS.3.2 Archive SBOM + + +## Mitigation +Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. + + +> Rule Result will be set as 'open' if evidence is missing. +> Signed Evidence for this rule **IS NOT** required by default but is recommended. + diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index ce78c7d95..f95205bf5 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -4,7 +4,7 @@ submodules_dir="sub" [ ! -d "${submodules_dir}" ] && mkdir "${submodules_dir}" base="git@github.com:scribe-security" base_public="git@github.com:scribe-public" -supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" ) +supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" ) pull_submodules() { repos=$1 @@ -17,10 +17,23 @@ pull_submodules() { repo_url="${base}/${repo}" fi repo_dir="${submodules_dir}/${repo}" - [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}" + if [ ! -z "$BRANCH" ]; then + git clone --depth 1 --branch "$BRANCH" "${repo_url}" "${repo_dir}" + else + git clone --depth 1 "${repo_url}" "${repo_dir}" + fi pushd "${repo_dir}" - git checkout master || git checkout main - git pull origin master || git pull origin main + # if BRANCH + if [ ! -z "$BRANCH" ]; then + git fetch origin $BRANCH + git checkout $BRANCH + git config pull.rebase false # Or `true` if you prefer rebasing + git pull origin $BRANCH + else + git checkout master || git checkout main + git pull origin master || git pull origin main + fi + popd done } @@ -34,8 +47,14 @@ checkout_submodules() { repo_dir="${submodules_dir}/${repo}" [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}" pushd "${repo_dir}" - git checkout master || git checkout main - git pull origin master || git pull origin main + if [ ! -z "$BRANCH" ]; then + git branch -D $BRANCH + git checkout -b $BRANCH + else + git checkout master || git checkout main + git pull origin master || git pull origin main + fi + git branch -D doc_export git checkout -b doc_export popd @@ -241,23 +260,24 @@ import_sample-policies() { repo="sample-policies" repo_dir="${submodules_dir}/${repo}" dst_dir="docs/guides" + cp -r "${repo_dir}/docs/v2/" "docs/configuration/" - echo '--- -sidebar_label: "Applying Policies to your SDLC" -title: Applying Policies to your SDLC -sidebar_position: 3 -toc_min_heading_level: 2 -toc_max_heading_level: 5 ----' > "${dst_dir}/enforcing-sdlc-policy.md" +# echo '--- +# sidebar_label: "Applying Policies to your SDLC" +# title: Applying Policies to your SDLC +# sidebar_position: 3 +# toc_min_heading_level: 2 +# toc_max_heading_level: 5 +# ---' > "${dst_dir}/enforcing-sdlc-policy.md" - tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md" +# tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md" } export_sample-policies() { repo="sample-policies" repo_dir="${submodules_dir}/${repo}" dst_dir="docs/guides" - export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-policy.md" + export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-initiative.md" sed -i '/^---$/,/^---$/c\ # Sample policies' "${repo_dir}/README.md" } @@ -376,7 +396,7 @@ EOF parse_args() { - while getopts "r:IESLdh?x" arg; do + while getopts "b:r:IESLdh?x" arg; do case "$arg" in x) set -x ;; r) repos+=(${OPTARG});; @@ -384,6 +404,7 @@ parse_args() { E) COMMAND="export";; S) COMMAND="status";; L) LOCAL="true";; + b) BRANCH=${OPTARG};; h | \?) usage "$0" ;; esac done From 62206db8bea68e93090174715222dc45c74822c7 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:21:29 +0200 Subject: [PATCH 062/191] tmp gen docs --- docs/configuration/initiatives/bp1.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/sp-800-190.md | 87 +++++++++++++++++++ docs/configuration/initiatives/sp-800-53.md | 87 +++++++++++++++++++ .../rules/api/scribe-api-cve-product.md | 15 +++- .../configuration/rules/api/scribe-api-cve.md | 19 +++- .../rules/api/scribe-api-published.md | 15 +++- docs/configuration/rules/api/scribe-api.md | 15 +++- .../rules/bitbucket/project/allow-admins.md | 11 ++- .../rules/bitbucket/project/allow-users.md | 11 ++- .../bitbucket/project/exposed-credentials.md | 11 ++- .../bitbucket/project/long-live-tokens.md | 11 ++- .../bitbucket/repository/allow-admins.md | 11 ++- .../rules/bitbucket/repository/allow-users.md | 11 ++- .../bitbucket/repository/branch-protection.md | 11 ++- .../rules/bitbucket/workspace/allow-admins.md | 11 ++- .../rules/bitbucket/workspace/allow-users.md | 11 ++- .../rules/dockerhub/token-expiration.md | 11 ++- .../rules/dockerhub/token-not-used.md | 11 ++- .../rules/generic/artifact-signed.md | 9 +- .../rules/generic/evidence-exists.md | 9 +- .../rules/generic/k8s-jailbreak.md | 11 ++- .../rules/generic/trivy-exists.md | 11 ++- .../rules/git/artifact-signed.md | 13 ++- .../rules/git/coding-permissions.md | 15 +++- .../rules/git/evidence-exists.md | 13 ++- .../rules/git/no-commit-to-main.md | 15 +++- .../rules/git/no-unsigned-commits.md | 15 +++- .../rules/github/api/branch-protection.md | 11 ++- .../rules/github/api/signed-commits-list.md | 11 ++- .../rules/github/api/signed-commits-range.md | 11 ++- docs/configuration/rules/github/org/2fa.md | 31 ++++++- .../rules/github/org/advanced-security.md | 11 ++- .../rules/github/org/allow-admins.md | 11 ++- .../rules/github/org/allow-users.md | 11 ++- .../rules/github/org/create-private-repos.md | 11 ++- .../rules/github/org/create-repos.md | 11 ++- .../rules/github/org/dependabot-alerts.md | 11 ++- .../org/dependabot-security-updates-sa.md | 11 ++- .../github/org/dependabot-security-updates.md | 11 ++- .../rules/github/org/dependency-graph.md | 11 ++- .../rules/github/org/max-admins.md | 11 ++- .../rules/github/org/old-secrets.md | 11 ++- .../rules/github/org/pp-custom-link.md | 11 ++- .../rules/github/org/push-protection-sa.md | 11 ++- .../rules/github/org/push-protection.md | 11 ++- .../rules/github/org/repo-visibility.md | 11 ++- .../rules/github/org/secret-scanning-sa.md | 11 ++- .../rules/github/org/secret-scanning.md | 11 ++- .../rules/github/org/validity-checks-sa.md | 11 ++- .../rules/github/org/validity-checks.md | 11 ++- .../rules/github/org/web-commit-signoff.md | 11 ++- .../github/repository/branch-protection.md | 11 ++- .../github/repository/branch-verification.md | 11 ++- .../github/repository/check-signed-commits.md | 11 ++- .../repository/default-branch-protection.md | 11 ++- .../rules/github/repository/dependabot.md | 11 ++- .../repository/ephemeral-runners-only.md | 11 ++- .../rules/github/repository/no-cache-usage.md | 11 ++- .../rules/github/repository/no-org-secrets.md | 11 ++- .../rules/github/repository/old-secrets.md | 11 ++- .../github/repository/push-protection.md | 11 ++- .../rules/github/repository/repo-private.md | 11 ++- .../github/repository/secret-scanning.md | 11 ++- .../rules/github/repository/signed-commits.md | 11 ++- .../github/repository/validity-checks.md | 11 ++- .../rules/github/repository/visibility.md | 11 ++- .../github/repository/web-commit-signoff.md | 11 ++- .../rules/gitlab/api/push-rules.md | 11 ++- .../rules/gitlab/api/signed-commits-list.md | 11 ++- .../rules/gitlab/api/signed-commits-range.md | 11 ++- .../rules/gitlab/org/allow-admins.md | 11 ++- .../rules/gitlab/org/allow-token-scopes.md | 11 ++- .../rules/gitlab/org/allow-users.md | 11 ++- .../rules/gitlab/org/blocked-users.md | 11 ++- .../rules/gitlab/org/expiring-tokens.md | 11 ++- .../rules/gitlab/org/forbid-token-scopes.md | 11 ++- .../rules/gitlab/org/inactive-projects.md | 11 ++- .../rules/gitlab/org/longlive-tokens.md | 11 ++- .../rules/gitlab/org/max-admins.md | 11 ++- .../rules/gitlab/org/projects-visibility.md | 11 ++- .../rules/gitlab/org/unused-tokens.md | 11 ++- .../gitlab/pipeline/verify-labels-exist.md | 11 ++- .../rules/gitlab/pipeline/verify-labels.md | 11 ++- .../rules/gitlab/project/abandoned-project.md | 11 ++- .../gitlab/project/approvals-policy-check.md | 11 ++- .../project/approvers-per-merge-request.md | 11 ++- .../gitlab/project/author-email-regex.md | 11 ++- .../rules/gitlab/project/check-cwe.md | 11 ++- .../gitlab/project/check-signed-commits.md | 11 ++- .../gitlab/project/co-approval-required.md | 11 ++- .../project/commit-author-email-check.md | 11 ++- .../project/commit-author-name-check.md | 11 ++- .../gitlab/project/commit-committer-check.md | 11 ++- .../gitlab/project/commit-message-check.md | 11 ++- .../rules/gitlab/project/commits-validated.md | 11 ++- .../gitlab/project/committer-email-check.md | 11 ++- .../gitlab/project/committer-name-check.md | 11 ++- .../gitlab/project/critical-severity-limit.md | 11 ++- .../project/description-substring-check.md | 11 ++- .../project/disallowed-banned-approvers.md | 11 ++- .../gitlab/project/force-push-protection.md | 11 ++- .../gitlab/project/medium-severity-limit.md | 11 ++- .../rules/gitlab/project/member-check.md | 11 ++- .../gitlab/project/merge-access-level.md | 11 ++- .../project/merge-requests-author-approval.md | 11 ++- ...ge-requests-disable-committers-approval.md | 11 ++- .../gitlab/project/message-substring-check.md | 11 ++- .../gitlab/project/prevent-secrets-check.md | 11 ++- .../gitlab/project/protect-ci-secrets.md | 11 ++- .../rules/gitlab/project/push-access-level.md | 11 ++- .../rules/gitlab/project/push-rules-set.md | 11 ++- .../gitlab/project/reject-unsigned-commits.md | 11 ++- .../project/require-password-to-approve.md | 11 ++- .../project/required-minimal-approvers.md | 11 ++- .../gitlab/project/reset-pprovals-on-push.md | 11 ++- .../rules/gitlab/project/sast-scan-pass.md | 11 ++- .../rules/gitlab/project/sast-scanning.md | 11 ++- .../rules/gitlab/project/secrets-scan-pass.md | 11 ++- .../rules/gitlab/project/secrets-scanning.md | 11 ++- .../project/selective-code-owner-removals.md | 11 ++- .../rules/gitlab/project/visibility-check.md | 11 ++- .../rules/images/allowed-base-image.md | 39 +++++++++ .../rules/images/allowed-image-source.md | 36 ++++++++ .../rules/images/banned-ports.md | 37 ++++++++ .../rules/images/banned-users.md | 35 ++++++++ .../rules/images/blocklist-build-scripts.md | 11 ++- .../rules/images/blocklist-user.md | 34 ++++++++ .../rules/images/enforce-https-registry.md | 34 ++++++++ .../rules/images/forbid-large-images.md | 11 ++- .../rules/images/fresh-base-image.md | 36 ++++++++ .../configuration/rules/images/fresh-image.md | 15 +++- .../rules/images/image-signed.md | 39 +++++++++ .../rules/images/require-healthcheck.md | 33 +++++++ .../rules/images/restrict-shell-entrypoint.md | 11 ++- .../rules/images/verify-labels-exist.md | 11 ++- .../rules/images/verify-labels.md | 11 ++- .../jenkins/folder/exposed-credentials.md | 11 ++- .../rules/jenkins/instance/inactive-users.md | 11 ++- .../rules/jenkins/instance/unused-users.md | 11 ++- .../rules/k8s/namespace/allowed-images.md | 11 ++- .../rules/k8s/namespace/allowed-registries.md | 11 ++- .../namespace/verify-namespace-duration.md | 11 ++- .../namespace/verify-namespace-termination.md | 11 ++- .../k8s/namespace/white-listed-namespaces.md | 11 ++- .../rules/k8s/namespace/white-listed-pod.md | 11 ++- .../rules/k8s/pods/verify-pod-duration.md | 11 ++- .../rules/k8s/pods/verify-pod-termination.md | 11 ++- .../rules/k8s/pods/white-listed-pod.md | 11 ++- .../rules/multievidence/files_integrity.md | 11 ++- .../rules/sarif/artifact-signed.md | 26 +++++- .../rules/sarif/evidence-exists.md | 14 ++- .../rules/sarif/patcheck/updates-needed.md | 11 ++- .../rules/sarif/report-iac-errors.md | 28 +++++- .../rules/sarif/trivy/blocklist-cve.md | 59 +++++++++++++ .../sarif/trivy/report-trivy-iac-errors.md | 31 ++++++- .../rules/sarif/trivy/verify-cve-severity.md | 58 +++++++++++++ .../sarif/trivy/verify-trivy-attack-vector.md | 13 ++- .../rules/sarif/trivy/verify-trivy-report.md | 37 +++++++- .../rules/sarif/verify-attack-vector.md | 36 +++++++- .../configuration/rules/sarif/verify-sarif.md | 35 +++++++- .../rules/sarif/verify-semgrep-report.md | 35 +++++++- .../rules/sarif/verify-tool-evidence.md | 26 +++++- .../rules/sbom/NTIA-compliance.md | 41 +++++++++ .../rules/sbom/allowed-components.md | 16 +++- .../rules/sbom/artifact-signed.md | 13 ++- .../rules/sbom/banned-licenses.md | 16 +++- .../rules/sbom/blocklist-packages.md | 15 +++- .../rules/sbom/complete-licenses.md | 16 +++- docs/configuration/rules/sbom/fresh-sbom.md | 15 +++- docs/configuration/rules/sbom/require-sbom.md | 30 +++++++ .../rules/sbom/required-packages.md | 16 +++- .../rules/sbom/verify-huggingface-license.md | 16 +++- .../rules/slsa/banned-builder-deps.md | 11 ++- docs/configuration/rules/slsa/build-time.md | 11 ++- docs/configuration/rules/slsa/field-exists.md | 11 ++- .../rules/slsa/l1-provenance-exists.md | 13 ++- .../rules/slsa/l2-provenance-authenticated.md | 13 ++- .../rules/slsa/verify-builder.md | 12 ++- .../rules/slsa/verify-byproducts.md | 11 ++- docs/configuration/rules/ssdf/ps-1-2fa.md | 28 +++++- .../rules/ssdf/ps-1-branch-protection.md | 11 ++- .../rules/ssdf/ps-1-limit-admins.md | 11 ++- .../rules/ssdf/ps-1-repo-private.md | 11 ++- .../rules/ssdf/ps-1-web-commit-signoff.md | 11 ++- .../rules/ssdf/ps-2-image-verifiable.md | 11 ++- .../rules/ssdf/ps-3.1-code-archived.md | 11 ++- .../rules/ssdf/ps-3.2-archived-sbom.md | 11 ++- 188 files changed, 2490 insertions(+), 364 deletions(-) create mode 100644 docs/configuration/initiatives/sp-800-190.md create mode 100644 docs/configuration/initiatives/sp-800-53.md create mode 100644 docs/configuration/rules/images/allowed-base-image.md create mode 100644 docs/configuration/rules/images/allowed-image-source.md create mode 100644 docs/configuration/rules/images/banned-ports.md create mode 100644 docs/configuration/rules/images/banned-users.md create mode 100644 docs/configuration/rules/images/blocklist-user.md create mode 100644 docs/configuration/rules/images/enforce-https-registry.md create mode 100644 docs/configuration/rules/images/fresh-base-image.md create mode 100644 docs/configuration/rules/images/image-signed.md create mode 100644 docs/configuration/rules/images/require-healthcheck.md create mode 100644 docs/configuration/rules/sarif/trivy/blocklist-cve.md create mode 100644 docs/configuration/rules/sarif/trivy/verify-cve-severity.md create mode 100644 docs/configuration/rules/sbom/NTIA-compliance.md create mode 100644 docs/configuration/rules/sbom/require-sbom.md diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 3c1eae405..f6b916047 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -173,7 +173,7 @@ Before deployment, an artifact’s digest is checked against the expected value | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/evidence-exists.md) | [Require SBOM Existence](../rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | +| sbom/evidence-exists@v2 | sbom/evidence-exists@v2 | | ## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 76fde98bf..6400b0cdc 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -5,7 +5,7 @@ **Bundle-Version:** `v2` **Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l1.yaml) -Evaluate SLSA L1 +Evaluate SLSA Level 1 **Help:** https://slsa.dev/ > Evidence for this initiative **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md new file mode 100644 index 000000000..6b4fb2f90 --- /dev/null +++ b/docs/configuration/initiatives/sp-800-190.md @@ -0,0 +1,87 @@ +# NIST Application Container Security Initiative +**Type:** Initiative +**ID:** `SP-800-190` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-190.yaml) + +This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. + + +**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final +> Evidence for this initiative **IS NOT** required by default but is recommended. + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [4.1](#41-41-image-countermeasures) | 4.1 IMAGE COUNTERMEASURES | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. + | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. + | +| [4.2](#42-42-registry-countermeasures) | 4.2 REGISTRY COUNTERMEASURES | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. + | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. + | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [4.1] 4.1 IMAGE COUNTERMEASURES + +Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. + + + +### Mitigation +Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](../rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. + | +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](../rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. + | +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](../rules/images/banned-users.md) | Ensures that containers do not run as the root user. + | +| [images-banned-ports](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](../rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. + | +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](../rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. + | +| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](../rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. + | +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](../rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. + | +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](../rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. + | +| [images-require-signed-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/image-signed.md) | [4.1.5 Signed Images](../rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. + | + +## [4.2] 4.2 REGISTRY COUNTERMEASURES + +Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. + + + +### Mitigation +Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [images-registry-https-check](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](../rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. + | +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](../rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. + | +| [fresh-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](../rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. + | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md new file mode 100644 index 000000000..d63cd2e05 --- /dev/null +++ b/docs/configuration/initiatives/sp-800-53.md @@ -0,0 +1,87 @@ +# SP-800-53 Supply Chain Integrity Initiative +**Type:** Initiative +**ID:** `SP-800-53` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-53.yaml) + +This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: + - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, + addressing requirements from SR-4 and CM-8. + - Provenance data to support architectural traceability, as outlined in SA-8. +Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. + + +**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final +> Evidence for this initiative **IS NOT** required by default but is recommended. + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [SR4_CM8](#sr4_cm8-sbom-requirement-sr-4-cm-8) | SBOM Requirement (SR-4 / CM-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. + | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | +| [SA8](#sa8-provenance-requirement-sa-8) | Provenance Requirement (SA-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. + | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | +| [SA12](#sa12-sbom-signature-enforcement-sa-12) | SBOM Signature Enforcement (SA-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. + | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [SR4_CM8] SBOM Requirement (SR-4 / CM-8) + +Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. + + + +### Mitigation +Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Require SBOM](../rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [Verify Supply Chain Labels](../rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: + | +| [NTIA-compliance](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](../rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. + | + +## [SA8] Provenance Requirement (SA-8) + +Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. + + + +### Mitigation +Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [SLSA.L1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Require Provenance](../rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | + +## [SA12] SBOM Signature Enforcement (SA-12) + +Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. + + + +### Mitigation +Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](../rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](../rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/rules/api/scribe-api-cve-product.md b/docs/configuration/rules/api/scribe-api-cve-product.md index 771566344..487b938d7 100644 --- a/docs/configuration/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/rules/api/scribe-api-cve-product.md @@ -8,9 +8,18 @@ Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. -> Rule requires the Scribe API to be enabled. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/api/scribe-api-cve.md b/docs/configuration/rules/api/scribe-api-cve.md index 6c1eefd22..f79067a79 100644 --- a/docs/configuration/rules/api/scribe-api-cve.md +++ b/docs/configuration/rules/api/scribe-api-cve.md @@ -8,10 +8,21 @@ Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). -> Rule Result will be set as 'open' if evidence is missing. -> Rule requires the Scribe API to be enabled. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/api/scribe-api-published.md b/docs/configuration/rules/api/scribe-api-published.md index ea876ae30..59f87359b 100644 --- a/docs/configuration/rules/api/scribe-api-published.md +++ b/docs/configuration/rules/api/scribe-api-published.md @@ -8,9 +8,18 @@ Verify image Scribe Publish flag is set for container image. -> Rule Result will be set as 'open' if evidence is missing. -> Rule requires the Scribe API to be enabled. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/api/scribe-api.md b/docs/configuration/rules/api/scribe-api.md index a3d8704be..a49c5005f 100644 --- a/docs/configuration/rules/api/scribe-api.md +++ b/docs/configuration/rules/api/scribe-api.md @@ -7,9 +7,18 @@ Verify XX using the Scribe API template rule. -> Rule Result will be set as 'open' if evidence is missing. -> Rule requires the Scribe API to be enabled. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/project/allow-admins.md b/docs/configuration/rules/bitbucket/project/allow-admins.md index f53b37763..86eef1ae0 100644 --- a/docs/configuration/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/rules/bitbucket/project/allow-admins.md @@ -7,8 +7,15 @@ Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/project/allow-users.md b/docs/configuration/rules/bitbucket/project/allow-users.md index 9301eab95..16760aa85 100644 --- a/docs/configuration/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/rules/bitbucket/project/allow-users.md @@ -7,8 +7,15 @@ Verify only users specified in the Allowed List have user access to the Bitbucket project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/rules/bitbucket/project/exposed-credentials.md index c8b857d62..384c1d1a1 100644 --- a/docs/configuration/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/rules/bitbucket/project/exposed-credentials.md @@ -8,8 +8,15 @@ Verify access to the Bitbucket project is blocked if exposed credentials are detected. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/rules/bitbucket/project/long-live-tokens.md index 7b4b4d11f..7501f80ca 100644 --- a/docs/configuration/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/rules/bitbucket/project/long-live-tokens.md @@ -8,8 +8,15 @@ Verify Bitbucket API tokens expire before the maximum time to live. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/repository/allow-admins.md b/docs/configuration/rules/bitbucket/repository/allow-admins.md index ef73ab6f7..930dfe28e 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/rules/bitbucket/repository/allow-admins.md @@ -8,8 +8,15 @@ Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/repository/allow-users.md b/docs/configuration/rules/bitbucket/repository/allow-users.md index 08a5899ea..8cc9419e9 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/rules/bitbucket/repository/allow-users.md @@ -8,8 +8,15 @@ Verify only users specified in the Allowed List have user access to the Bitbucket repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/repository/branch-protection.md b/docs/configuration/rules/bitbucket/repository/branch-protection.md index ade8f0b38..6147dcadf 100644 --- a/docs/configuration/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/rules/bitbucket/repository/branch-protection.md @@ -8,8 +8,15 @@ Verify the default branch protection is enabled in the Bitbucket repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/rules/bitbucket/workspace/allow-admins.md index 56d608453..1d7678726 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-admins.md @@ -8,8 +8,15 @@ Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-users.md b/docs/configuration/rules/bitbucket/workspace/allow-users.md index 3aed9fc1f..c1c47dc9c 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-users.md @@ -8,8 +8,15 @@ Verify only users specified in the Allowed List have user access to the Bitbucket workspace. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/dockerhub/token-expiration.md b/docs/configuration/rules/dockerhub/token-expiration.md index 03353e39e..81c5255d0 100644 --- a/docs/configuration/rules/dockerhub/token-expiration.md +++ b/docs/configuration/rules/dockerhub/token-expiration.md @@ -8,8 +8,15 @@ Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/dockerhub/token-not-used.md b/docs/configuration/rules/dockerhub/token-not-used.md index 744d20e9a..300a5d84f 100644 --- a/docs/configuration/rules/dockerhub/token-not-used.md +++ b/docs/configuration/rules/dockerhub/token-not-used.md @@ -8,8 +8,15 @@ Verify that there are no unused Dockerhub. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/generic/artifact-signed.md b/docs/configuration/rules/generic/artifact-signed.md index 50155324c..5258a9e8b 100644 --- a/docs/configuration/rules/generic/artifact-signed.md +++ b/docs/configuration/rules/generic/artifact-signed.md @@ -8,8 +8,15 @@ Verify required evidence is signed. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS** required by default. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/generic/evidence-exists.md b/docs/configuration/rules/generic/evidence-exists.md index 87d9d0589..b3c385546 100644 --- a/docs/configuration/rules/generic/evidence-exists.md +++ b/docs/configuration/rules/generic/evidence-exists.md @@ -8,8 +8,15 @@ Verify required evidence exists. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/generic/k8s-jailbreak.md b/docs/configuration/rules/generic/k8s-jailbreak.md index dbba96264..291a2f0c0 100644 --- a/docs/configuration/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/rules/generic/k8s-jailbreak.md @@ -8,8 +8,15 @@ Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/generic/trivy-exists.md b/docs/configuration/rules/generic/trivy-exists.md index f1e829b9c..2c5329e30 100644 --- a/docs/configuration/rules/generic/trivy-exists.md +++ b/docs/configuration/rules/generic/trivy-exists.md @@ -7,8 +7,15 @@ Verify required Trivy evidence exists -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/git/artifact-signed.md b/docs/configuration/rules/git/artifact-signed.md index aa41f390b..ee9cd1143 100644 --- a/docs/configuration/rules/git/artifact-signed.md +++ b/docs/configuration/rules/git/artifact-signed.md @@ -8,9 +8,18 @@ Verify the Git artifact is signed. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS** required by default. -> This rule scoped by product and target. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/git/coding-permissions.md b/docs/configuration/rules/git/coding-permissions.md index 8a6026f57..db33bcefa 100644 --- a/docs/configuration/rules/git/coding-permissions.md +++ b/docs/configuration/rules/git/coding-permissions.md @@ -8,9 +8,18 @@ Verify only allowed users committed to the repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/git/evidence-exists.md b/docs/configuration/rules/git/evidence-exists.md index 21f7624d1..8eccd9bd7 100644 --- a/docs/configuration/rules/git/evidence-exists.md +++ b/docs/configuration/rules/git/evidence-exists.md @@ -8,9 +8,18 @@ Verify required Git evidence exists. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/git/no-commit-to-main.md b/docs/configuration/rules/git/no-commit-to-main.md index 66e74f5bb..a8507cf9e 100644 --- a/docs/configuration/rules/git/no-commit-to-main.md +++ b/docs/configuration/rules/git/no-commit-to-main.md @@ -8,9 +8,18 @@ Verify commits made directly to the main branch are disallowed. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/git/no-unsigned-commits.md b/docs/configuration/rules/git/no-unsigned-commits.md index ae3ff6e8c..af2c4f451 100644 --- a/docs/configuration/rules/git/no-unsigned-commits.md +++ b/docs/configuration/rules/git/no-unsigned-commits.md @@ -8,9 +8,18 @@ Verify all commits are signed. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/rules/github/api/branch-protection.md index f25cd8370..6e64d9f2c 100644 --- a/docs/configuration/rules/github/api/branch-protection.md +++ b/docs/configuration/rules/github/api/branch-protection.md @@ -8,8 +8,15 @@ Verify GitHub branch protection rules -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/api/signed-commits-list.md b/docs/configuration/rules/github/api/signed-commits-list.md index d787719fa..7a4c4a79d 100644 --- a/docs/configuration/rules/github/api/signed-commits-list.md +++ b/docs/configuration/rules/github/api/signed-commits-list.md @@ -8,8 +8,15 @@ Verify selected commits are signed in the GitHub organization. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/api/signed-commits-range.md b/docs/configuration/rules/github/api/signed-commits-range.md index c28a66729..d8bc6d5d8 100644 --- a/docs/configuration/rules/github/api/signed-commits-range.md +++ b/docs/configuration/rules/github/api/signed-commits-range.md @@ -8,8 +8,15 @@ Verify commits in the specified time range are signed. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/2fa.md b/docs/configuration/rules/github/org/2fa.md index 03a641f4c..4f645a5ba 100644 --- a/docs/configuration/rules/github/org/2fa.md +++ b/docs/configuration/rules/github/org/2fa.md @@ -8,8 +8,35 @@ Verify `two_factor_requirement` is enabled in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. +It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the +`organization_details.two_factor_requirement_enabled` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match +the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional +layer of security against unauthorized access. + +**Evidence Requirements:** +- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. +- The data should come from a trusted source (e.g., a GitHub organization scan). +- The evidence must clearly indicate whether 2FA is enabled. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/advanced-security.md b/docs/configuration/rules/github/org/advanced-security.md index cce729349..340b345fa 100644 --- a/docs/configuration/rules/github/org/advanced-security.md +++ b/docs/configuration/rules/github/org/advanced-security.md @@ -8,8 +8,15 @@ Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/allow-admins.md b/docs/configuration/rules/github/org/allow-admins.md index a9e390973..05dfda55d 100644 --- a/docs/configuration/rules/github/org/allow-admins.md +++ b/docs/configuration/rules/github/org/allow-admins.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List have admin privileges in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/allow-users.md b/docs/configuration/rules/github/org/allow-users.md index e97f52169..0864a2b4a 100644 --- a/docs/configuration/rules/github/org/allow-users.md +++ b/docs/configuration/rules/github/org/allow-users.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List have user access to the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/create-private-repos.md b/docs/configuration/rules/github/org/create-private-repos.md index f4b7b8211..4698adbc2 100644 --- a/docs/configuration/rules/github/org/create-private-repos.md +++ b/docs/configuration/rules/github/org/create-private-repos.md @@ -8,8 +8,15 @@ Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/create-repos.md b/docs/configuration/rules/github/org/create-repos.md index bee12cc1b..efb91e485 100644 --- a/docs/configuration/rules/github/org/create-repos.md +++ b/docs/configuration/rules/github/org/create-repos.md @@ -8,8 +8,15 @@ Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/dependabot-alerts.md b/docs/configuration/rules/github/org/dependabot-alerts.md index 45cbe605f..1fe8a5718 100644 --- a/docs/configuration/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/rules/github/org/dependabot-alerts.md @@ -8,8 +8,15 @@ Verify Dependabot alerts for new repositories are enabled in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md index 6aebca515..e6bbc09bd 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md @@ -8,8 +8,15 @@ Verify Dependabot security updates are configured in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/dependabot-security-updates.md b/docs/configuration/rules/github/org/dependabot-security-updates.md index 26a0363d2..db941ba50 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates.md @@ -8,8 +8,15 @@ Verify Dependabot security updates for new repositories are configured in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/dependency-graph.md b/docs/configuration/rules/github/org/dependency-graph.md index 0ba23356b..42a1602e1 100644 --- a/docs/configuration/rules/github/org/dependency-graph.md +++ b/docs/configuration/rules/github/org/dependency-graph.md @@ -8,8 +8,15 @@ Verify `dependency_graph` is enabled for new repositories in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/max-admins.md b/docs/configuration/rules/github/org/max-admins.md index 0b58ec268..86d9b5ec8 100644 --- a/docs/configuration/rules/github/org/max-admins.md +++ b/docs/configuration/rules/github/org/max-admins.md @@ -8,8 +8,15 @@ Verify the maximum number of GitHub organization admins is restricted. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/old-secrets.md b/docs/configuration/rules/github/org/old-secrets.md index 38a98afc9..8f7406790 100644 --- a/docs/configuration/rules/github/org/old-secrets.md +++ b/docs/configuration/rules/github/org/old-secrets.md @@ -8,8 +8,15 @@ Verify secrets in the GitHub organization are not older than the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/pp-custom-link.md b/docs/configuration/rules/github/org/pp-custom-link.md index edf17616c..3d40ee15c 100644 --- a/docs/configuration/rules/github/org/pp-custom-link.md +++ b/docs/configuration/rules/github/org/pp-custom-link.md @@ -8,8 +8,15 @@ Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/push-protection-sa.md b/docs/configuration/rules/github/org/push-protection-sa.md index 410cc5c0e..e38329345 100644 --- a/docs/configuration/rules/github/org/push-protection-sa.md +++ b/docs/configuration/rules/github/org/push-protection-sa.md @@ -8,8 +8,15 @@ Verify `secret_scanning_push_protection` is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/push-protection.md b/docs/configuration/rules/github/org/push-protection.md index 1b42a9c6c..3d2b613b8 100644 --- a/docs/configuration/rules/github/org/push-protection.md +++ b/docs/configuration/rules/github/org/push-protection.md @@ -8,8 +8,15 @@ Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/repo-visibility.md b/docs/configuration/rules/github/org/repo-visibility.md index 92e15e28f..e009907f7 100644 --- a/docs/configuration/rules/github/org/repo-visibility.md +++ b/docs/configuration/rules/github/org/repo-visibility.md @@ -8,8 +8,15 @@ Verify only repositories in the Allowed List are public in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/secret-scanning-sa.md b/docs/configuration/rules/github/org/secret-scanning-sa.md index 8858c847a..c471de565 100644 --- a/docs/configuration/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/rules/github/org/secret-scanning-sa.md @@ -8,8 +8,15 @@ Verify `secret_scanning` is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/secret-scanning.md b/docs/configuration/rules/github/org/secret-scanning.md index ab9b71a48..0e71cbcf8 100644 --- a/docs/configuration/rules/github/org/secret-scanning.md +++ b/docs/configuration/rules/github/org/secret-scanning.md @@ -8,8 +8,15 @@ Verify `secret_scanning` is enabled for new repositories in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/validity-checks-sa.md b/docs/configuration/rules/github/org/validity-checks-sa.md index d40bd9a64..7339df3e5 100644 --- a/docs/configuration/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/rules/github/org/validity-checks-sa.md @@ -8,8 +8,15 @@ Verify `secret_scanning_validity_checks` is configured in the GitHub organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/validity-checks.md b/docs/configuration/rules/github/org/validity-checks.md index fc0f27c57..d8d3c0fe3 100644 --- a/docs/configuration/rules/github/org/validity-checks.md +++ b/docs/configuration/rules/github/org/validity-checks.md @@ -8,8 +8,15 @@ Verify `secret_scanning_validity_checks` is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/org/web-commit-signoff.md b/docs/configuration/rules/github/org/web-commit-signoff.md index c843a088d..4bcffeaf0 100644 --- a/docs/configuration/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/rules/github/org/web-commit-signoff.md @@ -8,8 +8,15 @@ Verify contributors sign commits through the GitHub web interface. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/branch-protection.md b/docs/configuration/rules/github/repository/branch-protection.md index 65500373a..87b3bdd53 100644 --- a/docs/configuration/rules/github/repository/branch-protection.md +++ b/docs/configuration/rules/github/repository/branch-protection.md @@ -8,8 +8,15 @@ Verify branch protection is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/branch-verification.md b/docs/configuration/rules/github/repository/branch-verification.md index 58c3e545b..59a905cb2 100644 --- a/docs/configuration/rules/github/repository/branch-verification.md +++ b/docs/configuration/rules/github/repository/branch-verification.md @@ -8,8 +8,15 @@ Verify branch verification in the GitHub repository matches the value defined in the configuration file. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/check-signed-commits.md b/docs/configuration/rules/github/repository/check-signed-commits.md index b68c5d336..6d572e1af 100644 --- a/docs/configuration/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/rules/github/repository/check-signed-commits.md @@ -8,8 +8,15 @@ Verify all commits in the GitHub repository are signed. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/default-branch-protection.md b/docs/configuration/rules/github/repository/default-branch-protection.md index 19f6c5ed4..fc14f647e 100644 --- a/docs/configuration/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/rules/github/repository/default-branch-protection.md @@ -8,8 +8,15 @@ Verify the default branch protection is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/dependabot.md b/docs/configuration/rules/github/repository/dependabot.md index 7261bafee..07edfeb61 100644 --- a/docs/configuration/rules/github/repository/dependabot.md +++ b/docs/configuration/rules/github/repository/dependabot.md @@ -8,8 +8,15 @@ Verify Dependabot security updates are configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/rules/github/repository/ephemeral-runners-only.md index c72c576bd..006776d08 100644 --- a/docs/configuration/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/rules/github/repository/ephemeral-runners-only.md @@ -8,8 +8,15 @@ Verify self-hosted runners are disallowed in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/no-cache-usage.md b/docs/configuration/rules/github/repository/no-cache-usage.md index 519db0bfb..94f4f2d36 100644 --- a/docs/configuration/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/rules/github/repository/no-cache-usage.md @@ -8,8 +8,15 @@ Verify the GitHub repository has no cache usage. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/no-org-secrets.md b/docs/configuration/rules/github/repository/no-org-secrets.md index e9e0f64ae..547e254df 100644 --- a/docs/configuration/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/rules/github/repository/no-org-secrets.md @@ -8,8 +8,15 @@ Verify no organization secrets exist in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/old-secrets.md b/docs/configuration/rules/github/repository/old-secrets.md index 42537bd66..385fce9b8 100644 --- a/docs/configuration/rules/github/repository/old-secrets.md +++ b/docs/configuration/rules/github/repository/old-secrets.md @@ -8,8 +8,15 @@ Verify secrets in the GitHub repository are not older than the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/push-protection.md b/docs/configuration/rules/github/repository/push-protection.md index 23bce23b3..b2cbffc92 100644 --- a/docs/configuration/rules/github/repository/push-protection.md +++ b/docs/configuration/rules/github/repository/push-protection.md @@ -8,8 +8,15 @@ Verify `secret_scanning_push_protection` is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/repo-private.md b/docs/configuration/rules/github/repository/repo-private.md index a9ade5bd7..86241bbfb 100644 --- a/docs/configuration/rules/github/repository/repo-private.md +++ b/docs/configuration/rules/github/repository/repo-private.md @@ -8,8 +8,15 @@ Verify the GitHub repository is private. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/secret-scanning.md b/docs/configuration/rules/github/repository/secret-scanning.md index 99c98d277..29bdcb97a 100644 --- a/docs/configuration/rules/github/repository/secret-scanning.md +++ b/docs/configuration/rules/github/repository/secret-scanning.md @@ -8,8 +8,15 @@ Verify `secret_scanning` is configured in the GitHub repository. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/signed-commits.md b/docs/configuration/rules/github/repository/signed-commits.md index b7110f117..03a4644ad 100644 --- a/docs/configuration/rules/github/repository/signed-commits.md +++ b/docs/configuration/rules/github/repository/signed-commits.md @@ -8,8 +8,15 @@ Verify all commits are signed in a repository attestation. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/validity-checks.md b/docs/configuration/rules/github/repository/validity-checks.md index d9c2bd18d..0375b9b07 100644 --- a/docs/configuration/rules/github/repository/validity-checks.md +++ b/docs/configuration/rules/github/repository/validity-checks.md @@ -8,8 +8,15 @@ Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/visibility.md b/docs/configuration/rules/github/repository/visibility.md index d26c984a5..50804abc1 100644 --- a/docs/configuration/rules/github/repository/visibility.md +++ b/docs/configuration/rules/github/repository/visibility.md @@ -8,8 +8,15 @@ Verify only GitHub repositories in the Allowed List are public. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/github/repository/web-commit-signoff.md b/docs/configuration/rules/github/repository/web-commit-signoff.md index eae021abb..22b07dcbc 100644 --- a/docs/configuration/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/rules/github/repository/web-commit-signoff.md @@ -8,8 +8,15 @@ Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/rules/gitlab/api/push-rules.md index 9a6cc7acb..18b9c2668 100644 --- a/docs/configuration/rules/gitlab/api/push-rules.md +++ b/docs/configuration/rules/gitlab/api/push-rules.md @@ -8,8 +8,15 @@ Verify GitLab push rules are configured via the API. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/api/signed-commits-list.md b/docs/configuration/rules/gitlab/api/signed-commits-list.md index 29bee1783..3c0a8d311 100644 --- a/docs/configuration/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/rules/gitlab/api/signed-commits-list.md @@ -8,8 +8,15 @@ Verify the selected commits are signed in the GitLab organization. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/api/signed-commits-range.md b/docs/configuration/rules/gitlab/api/signed-commits-range.md index 6ec4343a4..50aa9ff64 100644 --- a/docs/configuration/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/rules/gitlab/api/signed-commits-range.md @@ -8,8 +8,15 @@ Verify the selected range of commits is signed via the GitLab API. -> Evidence **IS NOT** required for this rule. -> Rule Result will be set as 'open' if evidence is missing. +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/allow-admins.md b/docs/configuration/rules/gitlab/org/allow-admins.md index bc0b92755..298aa4457 100644 --- a/docs/configuration/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/rules/gitlab/org/allow-admins.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List have admin privileges in the GitLab organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/rules/gitlab/org/allow-token-scopes.md index 322ee4197..072f6b361 100644 --- a/docs/configuration/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/allow-token-scopes.md @@ -8,8 +8,15 @@ Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/allow-users.md b/docs/configuration/rules/gitlab/org/allow-users.md index f64dbd342..21342cb42 100644 --- a/docs/configuration/rules/gitlab/org/allow-users.md +++ b/docs/configuration/rules/gitlab/org/allow-users.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List have access to the GitLab organization. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/blocked-users.md b/docs/configuration/rules/gitlab/org/blocked-users.md index 7551a6e9f..34dd9a899 100644 --- a/docs/configuration/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/rules/gitlab/org/blocked-users.md @@ -8,8 +8,15 @@ Verify no users in the GitLab organization are on the block list. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/expiring-tokens.md b/docs/configuration/rules/gitlab/org/expiring-tokens.md index 0e4f29c17..da597e634 100644 --- a/docs/configuration/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/rules/gitlab/org/expiring-tokens.md @@ -8,8 +8,15 @@ Verify no GitLab organization tokens are about to expire. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md index a85359a84..eb20afb6c 100644 --- a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md @@ -8,8 +8,15 @@ Verify no GitLab organization tokens have disallowed scopes. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/inactive-projects.md b/docs/configuration/rules/gitlab/org/inactive-projects.md index de98105fc..555518e4c 100644 --- a/docs/configuration/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/rules/gitlab/org/inactive-projects.md @@ -8,8 +8,15 @@ Verify no GitLab organization projects are inactive. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/longlive-tokens.md b/docs/configuration/rules/gitlab/org/longlive-tokens.md index f67fff937..0037cd56b 100644 --- a/docs/configuration/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/rules/gitlab/org/longlive-tokens.md @@ -8,8 +8,15 @@ Verify no GitLab organization tokens have an excessively long lifespan. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/max-admins.md b/docs/configuration/rules/gitlab/org/max-admins.md index 29c730113..52e8df914 100644 --- a/docs/configuration/rules/gitlab/org/max-admins.md +++ b/docs/configuration/rules/gitlab/org/max-admins.md @@ -8,8 +8,15 @@ Verify the maximum number of admins for the GitLab project is restricted. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/projects-visibility.md b/docs/configuration/rules/gitlab/org/projects-visibility.md index 1d62a1dee..c0efad385 100644 --- a/docs/configuration/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/rules/gitlab/org/projects-visibility.md @@ -8,8 +8,15 @@ Verify only allowed projects in the GitLab organization have public visibility. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/org/unused-tokens.md b/docs/configuration/rules/gitlab/org/unused-tokens.md index eacc9671f..a45aafefd 100644 --- a/docs/configuration/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/rules/gitlab/org/unused-tokens.md @@ -8,8 +8,15 @@ Verify there are no unused GitLab organization tokens. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md index de26c58a7..207da9774 100644 --- a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md @@ -8,8 +8,15 @@ Verify the pipeline has all required label keys and values. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/rules/gitlab/pipeline/verify-labels.md index 61cbbb7d0..ed106b68b 100644 --- a/docs/configuration/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels.md @@ -8,8 +8,15 @@ Verify the pipeline includes all required label keys and values. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/abandoned-project.md b/docs/configuration/rules/gitlab/project/abandoned-project.md index 38ef939b0..ad7ed901d 100644 --- a/docs/configuration/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/rules/gitlab/project/abandoned-project.md @@ -8,8 +8,15 @@ Verify the GitLab project is active for a specified duration. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/rules/gitlab/project/approvals-policy-check.md index f9af4c85b..fe8d9130b 100644 --- a/docs/configuration/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/rules/gitlab/project/approvals-policy-check.md @@ -8,8 +8,15 @@ Verify the project's merge approval policy complies with requirements. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md index a1d5b8cdc..f9d95b78d 100644 --- a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md @@ -8,8 +8,15 @@ Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/author-email-regex.md b/docs/configuration/rules/gitlab/project/author-email-regex.md index 3e23894dc..8bc3a23d2 100644 --- a/docs/configuration/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/rules/gitlab/project/author-email-regex.md @@ -8,8 +8,15 @@ Verify the `author_email_regex` for the GitLab project is set to the specified value. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/check-cwe.md b/docs/configuration/rules/gitlab/project/check-cwe.md index 271c61286..eec4e7636 100644 --- a/docs/configuration/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/rules/gitlab/project/check-cwe.md @@ -8,8 +8,15 @@ Verify that specified CWEs were not detected in the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/check-signed-commits.md b/docs/configuration/rules/gitlab/project/check-signed-commits.md index 0d0f8b2b4..8598bdb4f 100644 --- a/docs/configuration/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/rules/gitlab/project/check-signed-commits.md @@ -8,8 +8,15 @@ Verify all commits in the GitLab project are signed. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/co-approval-required.md b/docs/configuration/rules/gitlab/project/co-approval-required.md index 15d525383..993dda1b2 100644 --- a/docs/configuration/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/rules/gitlab/project/co-approval-required.md @@ -8,8 +8,15 @@ Verify code owner approval is required for specific branches in the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/rules/gitlab/project/commit-author-email-check.md index 63bfd8d79..4dfdb65ce 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-email-check.md @@ -8,8 +8,15 @@ Verify only GitLab project users in the Allowed List have commit author permissions. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/rules/gitlab/project/commit-author-name-check.md index a67801f92..ec88811ab 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-name-check.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List author commits in the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/commit-committer-check.md b/docs/configuration/rules/gitlab/project/commit-committer-check.md index e1778c1e4..81bca03df 100644 --- a/docs/configuration/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/rules/gitlab/project/commit-committer-check.md @@ -8,8 +8,15 @@ Verify `commit_committer_check` is enabled for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/commit-message-check.md b/docs/configuration/rules/gitlab/project/commit-message-check.md index bb15ec851..139fa7296 100644 --- a/docs/configuration/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/rules/gitlab/project/commit-message-check.md @@ -8,8 +8,15 @@ Verify that commit messages in the GitLab project adhere to the specified format template. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/commits-validated.md b/docs/configuration/rules/gitlab/project/commits-validated.md index b2b18f58e..f596d0bb7 100644 --- a/docs/configuration/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/rules/gitlab/project/commits-validated.md @@ -8,8 +8,15 @@ Verify all commits in the GitLab project are validated. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/committer-email-check.md b/docs/configuration/rules/gitlab/project/committer-email-check.md index 33b208d1a..5d39521f6 100644 --- a/docs/configuration/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/rules/gitlab/project/committer-email-check.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List use committer email addresses in the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/committer-name-check.md b/docs/configuration/rules/gitlab/project/committer-name-check.md index 65e0191ab..c4fbfb7e2 100644 --- a/docs/configuration/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/rules/gitlab/project/committer-name-check.md @@ -8,8 +8,15 @@ Verify only users in the Allowed List commit by name in the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/rules/gitlab/project/critical-severity-limit.md index 80a247e99..c6cb63eac 100644 --- a/docs/configuration/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/critical-severity-limit.md @@ -8,8 +8,15 @@ Verify the maximum allowed critical severity alerts for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/description-substring-check.md b/docs/configuration/rules/gitlab/project/description-substring-check.md index 0a80b5ddc..fda18f85d 100644 --- a/docs/configuration/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/rules/gitlab/project/description-substring-check.md @@ -8,8 +8,15 @@ Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md index 099c58807..2f5e3c010 100644 --- a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md @@ -8,8 +8,15 @@ Verify approvers in the GitLab project are not on the banned list. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/force-push-protection.md b/docs/configuration/rules/gitlab/project/force-push-protection.md index 6b73f1073..f33043ff6 100644 --- a/docs/configuration/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/rules/gitlab/project/force-push-protection.md @@ -8,8 +8,15 @@ Verify force pushes in the GitLab project are disallowed to maintain repository integrity. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/rules/gitlab/project/medium-severity-limit.md index 4ac7c60fa..6696cc141 100644 --- a/docs/configuration/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/medium-severity-limit.md @@ -8,8 +8,15 @@ Verify the maximum allowed medium severity alerts for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/member-check.md b/docs/configuration/rules/gitlab/project/member-check.md index 97c0a15be..c4fe97379 100644 --- a/docs/configuration/rules/gitlab/project/member-check.md +++ b/docs/configuration/rules/gitlab/project/member-check.md @@ -8,8 +8,15 @@ Verify `member_check` is enabled for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/merge-access-level.md b/docs/configuration/rules/gitlab/project/merge-access-level.md index c4695c9b7..b46a2c250 100644 --- a/docs/configuration/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/rules/gitlab/project/merge-access-level.md @@ -8,8 +8,15 @@ Verify the GitLab project's merge access level complies with requirements. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md index d6e7f7aba..1606d721c 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md @@ -8,8 +8,15 @@ Verify the binary field `merge_requests_author_approval` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md index 385f90733..bc947e713 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -8,8 +8,15 @@ Verify `merge_requests_disable_committers_approval` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/message-substring-check.md b/docs/configuration/rules/gitlab/project/message-substring-check.md index 533279fa2..c59fa7a77 100644 --- a/docs/configuration/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/rules/gitlab/project/message-substring-check.md @@ -8,8 +8,15 @@ Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md index 2d54c2706..c5c1442a4 100644 --- a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md @@ -8,8 +8,15 @@ Verify `prevent_secrets` is enabled for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md index 6bb4e355d..fc64e77a5 100644 --- a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md @@ -8,8 +8,15 @@ Verify secrets in the GitLab project are not shared. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/push-access-level.md b/docs/configuration/rules/gitlab/project/push-access-level.md index 4d19f5a4a..22ebffd2a 100644 --- a/docs/configuration/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/rules/gitlab/project/push-access-level.md @@ -8,8 +8,15 @@ Verify the GitLab project's push access level policy complies with requirements. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/push-rules-set.md b/docs/configuration/rules/gitlab/project/push-rules-set.md index f64acc55b..55fc24358 100644 --- a/docs/configuration/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/rules/gitlab/project/push-rules-set.md @@ -8,8 +8,15 @@ Verify push rules are set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md index 485a9285b..5275c96c7 100644 --- a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md @@ -8,8 +8,15 @@ Verify `reject_unsigned_commits` is enabled for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/rules/gitlab/project/require-password-to-approve.md index a586964e0..fe4d9763a 100644 --- a/docs/configuration/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/rules/gitlab/project/require-password-to-approve.md @@ -8,8 +8,15 @@ Verify the binary field `require_password_to_approve` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md index 93757e3b0..08ec5f4da 100644 --- a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md @@ -8,8 +8,15 @@ Verify the required number of approvers for the GitLab project is met. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md index 9ac95865c..a104c37f3 100644 --- a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md @@ -8,8 +8,15 @@ Verify `reset_approvals_on_push` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/rules/gitlab/project/sast-scan-pass.md index 2968bd3ac..1c7e9192c 100644 --- a/docs/configuration/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/sast-scan-pass.md @@ -8,8 +8,15 @@ Verify SAST scanning is successful for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/sast-scanning.md b/docs/configuration/rules/gitlab/project/sast-scanning.md index 383ef4967..15648792e 100644 --- a/docs/configuration/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/rules/gitlab/project/sast-scanning.md @@ -8,8 +8,15 @@ Verify SAST scanning is performed for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md index 49eed6531..ef4fe19fe 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md @@ -8,8 +8,15 @@ Verify secrets scanning is successful for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/secrets-scanning.md b/docs/configuration/rules/gitlab/project/secrets-scanning.md index 07a4dd747..c19e0d922 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/rules/gitlab/project/secrets-scanning.md @@ -8,8 +8,15 @@ Verify secrets scanning is performed for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md index 9c74c8e3c..8018111d6 100644 --- a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md @@ -8,8 +8,15 @@ Verify `selective_code_owner_removals` is set for the GitLab project. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/gitlab/project/visibility-check.md b/docs/configuration/rules/gitlab/project/visibility-check.md index 4b2ed1707..509edb8cd 100644 --- a/docs/configuration/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/rules/gitlab/project/visibility-check.md @@ -8,8 +8,15 @@ Verify the GitLab project's visibility matches the required level. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/images/allowed-base-image.md b/docs/configuration/rules/images/allowed-base-image.md new file mode 100644 index 000000000..998d621ec --- /dev/null +++ b/docs/configuration/rules/images/allowed-base-image.md @@ -0,0 +1,39 @@ +# Allowed Base Image +**Type:** Rule +**ID:** `images-allowed-base-image` +**Uses:** `images/allowed-base-image@v2/rules` +**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-base-image.yaml) +**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-base-image.rego) +**Labels:** SBOM, Images + +Verifies that every base image is from an approved source. The rule returns a summary +including the component names and versions of valid base images, or lists the invalid ones. +This rule requires Dockerfile context; for example, run it with: +`valint my_image --base-image Dockerfile`. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| approved_sources | [] | diff --git a/docs/configuration/rules/images/allowed-image-source.md b/docs/configuration/rules/images/allowed-image-source.md new file mode 100644 index 000000000..476885d59 --- /dev/null +++ b/docs/configuration/rules/images/allowed-image-source.md @@ -0,0 +1,36 @@ +# Allowed Main Image Source +**Type:** Rule +**ID:** `images-allowed-image-source` +**Uses:** `images/allowed-image-source@v2/rules` +**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-image-source.yaml) +**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-image-source.rego) +**Labels:** SBOM, Images + +Ensures the main container image referenced in the SBOM is from an approved source. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| approved_sources | [] | diff --git a/docs/configuration/rules/images/banned-ports.md b/docs/configuration/rules/images/banned-ports.md new file mode 100644 index 000000000..c6382e89c --- /dev/null +++ b/docs/configuration/rules/images/banned-ports.md @@ -0,0 +1,37 @@ +# Banned Ports +**Type:** Rule +**ID:** `images-banned-ports` +**Uses:** `images/banned-ports@v2/rules` +**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-ports.yaml) +**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-ports.rego) +**Labels:** SBOM, Images + +Ensures that the container image does not expose ports that are disallowed by organizational policy. +The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. +It fails if any banned port is exposed or if no banned ports list is provided. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| banned_ports | [{'port': '3000', 'protocol': 'tcp'}] | diff --git a/docs/configuration/rules/images/banned-users.md b/docs/configuration/rules/images/banned-users.md new file mode 100644 index 000000000..9359114e2 --- /dev/null +++ b/docs/configuration/rules/images/banned-users.md @@ -0,0 +1,35 @@ +# Disallow Specific Users in SBOM +**Type:** Rule +**ID:** `sbom-disallowed-users` +**Uses:** `images/banned-users@v2/rules` +**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-users.yaml) +**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-users.rego) +**Labels:** SBOM, Image + +Verify specific users are not allowed in an SBOM. + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| users | ['root'] | diff --git a/docs/configuration/rules/images/blocklist-build-scripts.md b/docs/configuration/rules/images/blocklist-build-scripts.md index b6cb4a2fd..67549ea69 100644 --- a/docs/configuration/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/rules/images/blocklist-build-scripts.md @@ -13,8 +13,15 @@ Verify no build scripts commands appear in block list. Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Description This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". diff --git a/docs/configuration/rules/images/blocklist-user.md b/docs/configuration/rules/images/blocklist-user.md new file mode 100644 index 000000000..47b9b1a1b --- /dev/null +++ b/docs/configuration/rules/images/blocklist-user.md @@ -0,0 +1,34 @@ +# Blocklist Container User +**Type:** Rule +**ID:** `images-blocklist-user` +**Uses:** `images/blocklist-user@v2/rules` +**Source:** [v2/rules/images/blocklist-user.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.yaml) +**Rego Source:** [blocklist-user.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.rego) +**Labels:** SBOM, Images + +Ensures that the container image does not use a user in the blocklist. +We look for a SBOM property named "user" in metadata.component.properties. +If it matches any username from the 'users' list, we fail. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| users | [] | diff --git a/docs/configuration/rules/images/enforce-https-registry.md b/docs/configuration/rules/images/enforce-https-registry.md new file mode 100644 index 000000000..72c30d728 --- /dev/null +++ b/docs/configuration/rules/images/enforce-https-registry.md @@ -0,0 +1,34 @@ +# 4.2.1 Registry Connection HTTPS +**Type:** Rule +**ID:** `images-registry-https-check` +**Uses:** `images/enforce-https-registry@v2/rules` +**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/enforce-https-registry.yaml) +**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/enforce-https-registry.rego) +**Labels:** Registry, Images + +Checks if the container's registry scheme is HTTPS by looking for a +property named 'registry_scheme' with value 'https'. If none found, +the rule fails, indicating a non-HTTPS registry. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['product', 'target'] | + diff --git a/docs/configuration/rules/images/forbid-large-images.md b/docs/configuration/rules/images/forbid-large-images.md index 8392fc76a..7cc295c4a 100644 --- a/docs/configuration/rules/images/forbid-large-images.md +++ b/docs/configuration/rules/images/forbid-large-images.md @@ -13,8 +13,15 @@ Verify the image size is below the specified threshold. Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Description This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components diff --git a/docs/configuration/rules/images/fresh-base-image.md b/docs/configuration/rules/images/fresh-base-image.md new file mode 100644 index 000000000..a83911f12 --- /dev/null +++ b/docs/configuration/rules/images/fresh-base-image.md @@ -0,0 +1,36 @@ +# Fresh Base Image +**Type:** Rule +**ID:** `images-fresh-base-image` +**Uses:** `images/fresh-base-image@v2/rules` +**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-base-image.yaml) +**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-base-image.rego) +**Labels:** SBOM, Images + +Verifies that each base image is not older than the specified threshold (max_days) from its creation date. The rule fails if no base image is found or if any base image exceeds the allowed age. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 183 | diff --git a/docs/configuration/rules/images/fresh-image.md b/docs/configuration/rules/images/fresh-image.md index 6eda47239..7f5888689 100644 --- a/docs/configuration/rules/images/fresh-image.md +++ b/docs/configuration/rules/images/fresh-image.md @@ -13,8 +13,18 @@ Verify the image is not older than the specified threshold. Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: ## Description This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" @@ -34,6 +44,7 @@ the rule flags the image as too old and generates a violation with details on th | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/images/image-signed.md b/docs/configuration/rules/images/image-signed.md new file mode 100644 index 000000000..17bbf5608 --- /dev/null +++ b/docs/configuration/rules/images/image-signed.md @@ -0,0 +1,39 @@ +# Require Signed Container Image +**Type:** Rule +**ID:** `images-require-signed-image` +**Uses:** `images/image-signed@v2/rules` +**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/image-signed.yaml) +**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/image-signed.rego) +**Labels:** Images, Blueprint + +Enforces that container images (target_type=container) are cryptographically signed. +Allows you to skip checks for certain images matching skip_regex, and optionally +ensures that the signer's identity matches specified emails or common-names. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| target_type | container | +| signed | False | +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| skip_image_regex | ['.*alpine.*'] | +| identity | {'emails': [], 'common-names': []} | diff --git a/docs/configuration/rules/images/require-healthcheck.md b/docs/configuration/rules/images/require-healthcheck.md new file mode 100644 index 000000000..6df4034d3 --- /dev/null +++ b/docs/configuration/rules/images/require-healthcheck.md @@ -0,0 +1,33 @@ +# Require Healthcheck +**Type:** Rule +**ID:** `images-require-healthcheck` +**Uses:** `images/require-healthcheck@v2/rules` +**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/require-healthcheck.yaml) +**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/require-healthcheck.rego) +**Labels:** SBOM, Images + +Checks that the container image includes at least one healthcheck property. +otherwise, it fails with a violation. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by target and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + diff --git a/docs/configuration/rules/images/restrict-shell-entrypoint.md b/docs/configuration/rules/images/restrict-shell-entrypoint.md index c0d3a3baf..7d6b6f7d2 100644 --- a/docs/configuration/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/rules/images/restrict-shell-entrypoint.md @@ -13,8 +13,15 @@ Verify the container image disallows shell entrypoint. Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Description This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). diff --git a/docs/configuration/rules/images/verify-labels-exist.md b/docs/configuration/rules/images/verify-labels-exist.md index 0dd55aea0..a5c6524de 100644 --- a/docs/configuration/rules/images/verify-labels-exist.md +++ b/docs/configuration/rules/images/verify-labels-exist.md @@ -13,8 +13,15 @@ Verify the image has the specified labels. Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label diff --git a/docs/configuration/rules/images/verify-labels.md b/docs/configuration/rules/images/verify-labels.md index 9b0abdd10..bb0ab06cd 100644 --- a/docs/configuration/rules/images/verify-labels.md +++ b/docs/configuration/rules/images/verify-labels.md @@ -13,8 +13,15 @@ Verify specified labels key-value pairs exist in the image. Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each diff --git a/docs/configuration/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/rules/jenkins/folder/exposed-credentials.md index 94acafe8e..8b13a1869 100644 --- a/docs/configuration/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/rules/jenkins/folder/exposed-credentials.md @@ -8,8 +8,15 @@ Verify there are no exposed credentials. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/jenkins/instance/inactive-users.md b/docs/configuration/rules/jenkins/instance/inactive-users.md index 75b982be6..ffc836bfb 100644 --- a/docs/configuration/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/rules/jenkins/instance/inactive-users.md @@ -8,8 +8,15 @@ Verify there are no inactive users. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/jenkins/instance/unused-users.md b/docs/configuration/rules/jenkins/instance/unused-users.md index 10ad14ce7..12df7e9bf 100644 --- a/docs/configuration/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/rules/jenkins/instance/unused-users.md @@ -8,8 +8,15 @@ Verify there are no users with zero activity. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/allowed-images.md b/docs/configuration/rules/k8s/namespace/allowed-images.md index d88c4070c..f913cf99c 100644 --- a/docs/configuration/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/rules/k8s/namespace/allowed-images.md @@ -8,8 +8,15 @@ Verify only container images specified in the Allowed List run within the Kubernetes namespace. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/allowed-registries.md b/docs/configuration/rules/k8s/namespace/allowed-registries.md index 120244f49..bc57638e5 100644 --- a/docs/configuration/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/rules/k8s/namespace/allowed-registries.md @@ -8,8 +8,15 @@ Verify container images in Kubernetes namespaces originate from registries in the Allowed List. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md index c158b3560..8c2573d3d 100644 --- a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md @@ -8,8 +8,15 @@ Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md index 11e7ca77b..b94e1c379 100644 --- a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md @@ -8,8 +8,15 @@ Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md index 1f8c6d7e7..1fde0e5df 100644 --- a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md @@ -8,8 +8,15 @@ Verify only namespaces specified in the Allowed List are allowed within the cluster. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/rules/k8s/namespace/white-listed-pod.md index efd3a6001..d9a0a3234 100644 --- a/docs/configuration/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/rules/k8s/namespace/white-listed-pod.md @@ -8,8 +8,15 @@ Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/rules/k8s/pods/verify-pod-duration.md index 8fe319bc0..288bcd031 100644 --- a/docs/configuration/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/rules/k8s/pods/verify-pod-duration.md @@ -8,8 +8,15 @@ Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/rules/k8s/pods/verify-pod-termination.md index 6601f5e10..8e29e2f01 100644 --- a/docs/configuration/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/rules/k8s/pods/verify-pod-termination.md @@ -8,8 +8,15 @@ Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/k8s/pods/white-listed-pod.md b/docs/configuration/rules/k8s/pods/white-listed-pod.md index f36b37150..5b2b10c8e 100644 --- a/docs/configuration/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/rules/k8s/pods/white-listed-pod.md @@ -8,8 +8,15 @@ Verify only pods explicitly listed in the Allowed List are allowed to run. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md index f4e0e83ba..989e82a4b 100644 --- a/docs/configuration/rules/multievidence/files_integrity.md +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -8,8 +8,15 @@ Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS** required by default. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/rules/sarif/artifact-signed.md index 6ec8eb6e7..6696bcbc9 100644 --- a/docs/configuration/rules/sarif/artifact-signed.md +++ b/docs/configuration/rules/sarif/artifact-signed.md @@ -8,8 +8,32 @@ Verify the artifact referenced in the SARIF report is signed to confirm its integrity. + +## Mitigation +Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. + + +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS** required by default. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed. +It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists. +The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation. +Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration. + +**Evidence Requirements:** +- Evidence must be provided in a generic format conforming to SARIF 2.1.0. +- The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true). +- The signer's identity should match one of the specified common names or emails in the configuration. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/evidence-exists.md b/docs/configuration/rules/sarif/evidence-exists.md index 729329715..7659c295b 100644 --- a/docs/configuration/rules/sarif/evidence-exists.md +++ b/docs/configuration/rules/sarif/evidence-exists.md @@ -8,8 +8,20 @@ Verify all required evidence exists as defined by the SARIF policy. + +## Mitigation +By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. + + +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/patcheck/updates-needed.md b/docs/configuration/rules/sarif/patcheck/updates-needed.md index 01ad48e98..411a9b702 100644 --- a/docs/configuration/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/rules/sarif/patcheck/updates-needed.md @@ -8,8 +8,15 @@ Verify no security packages require updates. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/report-iac-errors.md b/docs/configuration/rules/sarif/report-iac-errors.md index 7838e0faf..c1229ff87 100644 --- a/docs/configuration/rules/sarif/report-iac-errors.md +++ b/docs/configuration/rules/sarif/report-iac-errors.md @@ -8,8 +8,32 @@ Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match +a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving +the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. +If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes +details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. + +**Evidence Requirements:** + +Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/rules/sarif/trivy/blocklist-cve.md new file mode 100644 index 000000000..ca7937ff3 --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/blocklist-cve.md @@ -0,0 +1,59 @@ +# Trivy Blocklist CVE Check +**Type:** Rule +**ID:** `trivy-blocklist-cve` +**Uses:** `sarif/trivy/blocklist-cve@v2/rules` +**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/blocklist-cve.yaml) +**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../blocklist-report.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verify a CVE Blocklist against a SARIF report + + +## Mitigation +Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by product. +::: + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities +matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows: + +The rule iterates over the vulnerability results in the SARIF report (located under +`input.evidence.predicate.content.runs[0].results`), and for each result, retrieves the corresponding rule definition from +`input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. It then checks if the result's +ruleId contains any of the CVE identifiers provided in the `with.rule_ids` configuration parameter. If the total number of such +findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including +the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". +- Evidence filtering based on the product must be applied as defined in the configuration. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| rule_ids | [] | +| violations_threshold | 0 | diff --git a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md index 2fbdda371..8105482de 100644 --- a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md @@ -4,12 +4,37 @@ **Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` **Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) **Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../report-iac-errors.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by product. +::: + +## Description +This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match +a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving +the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. +If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes +details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. + +**Evidence Requirements:** + +Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner. + ## Evidence Requirements | Field | Value | @@ -18,6 +43,8 @@ Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF repo | content_body_type | generic | | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/rules/sarif/trivy/verify-cve-severity.md new file mode 100644 index 000000000..cbd6e6d41 --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/verify-cve-severity.md @@ -0,0 +1,58 @@ +# Trivy Vulnerability Findings Check +**Type:** Rule +**ID:** `trivy-verify-vulnerability-findings` +**Uses:** `sarif/trivy/verify-cve-severity@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-cve-severity.yaml) +**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-cve-severity.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed +the defined severity threshold. + + + +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by product. +::: + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it +complies with a set of predefined rules. The evaluation is based on several configurable parameters: + +The rule iterates over the vulnerability results in the SARIF report (provided under +`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding +rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's +ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified +threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| severity_threshold | 0 | diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md index a66f02791..2ac3be67c 100644 --- a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -8,8 +8,15 @@ Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by product. +::: ## Evidence Requirements | Field | Value | @@ -18,6 +25,8 @@ Verify no attack vector in the Trivy SARIF report exceeds the specified threshol | content_body_type | generic | | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md index 4d99da78a..10197a09c 100644 --- a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md @@ -4,12 +4,42 @@ **Uses:** `sarif/trivy/verify-trivy-report@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-trivy-report.yaml) **Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../verify-sarif.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by product. +::: + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it +complies with a set of predefined rules. The evaluation is based on several configurable parameters: + +The rule iterates over the vulnerability results in the SARIF report (provided under +`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding +rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's +ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified +threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". +- The evidence must include proper filtering based on the product as defined in the configuration. + ## Evidence Requirements | Field | Value | @@ -17,8 +47,9 @@ Verify the Trivy SARIF report complies with predefined rules to ensure complianc | signed | False | | content_body_type | generic | | target_type | data | -| tool | Trivy Vulnerability Scanner | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sarif/verify-attack-vector.md b/docs/configuration/rules/sarif/verify-attack-vector.md index a598e814c..5276d8c1d 100644 --- a/docs/configuration/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/rules/sarif/verify-attack-vector.md @@ -8,8 +8,40 @@ Verify required evidence validates attack vectors in the SARIF report. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities +associated with specific attack vectors are properly identified. The rule works as follows: + +1. It iterates over the vulnerability results in the SARIF report (from `input.evidence.predicate.content.runs[0].results`). +2. For each result, it retrieves the corresponding rule definition from + `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. +3. The rule checks if the rule’s full description contains the phrase "The attack vector is" and whether it + includes any of the attack vectors specified in the configuration (`with.attack_vectors`). +4. If such a vulnerability is found and the total number of matching findings exceeds the configured threshold + (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the + associated description. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by a tool like the Vulnerability Scanner. +- The report must include detailed rule definitions and descriptions that mention attack vectors. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/verify-sarif.md b/docs/configuration/rules/sarif/verify-sarif.md index 713501603..092d00a9f 100644 --- a/docs/configuration/rules/sarif/verify-sarif.md +++ b/docs/configuration/rules/sarif/verify-sarif.md @@ -8,8 +8,39 @@ Verify the SARIF report complies with defined generic rules for compliance and security. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules. +It does so by using helper functions from the `data.sarif` module to: + +1. Check that the vulnerability results in the report (found under `input.evidence.predicate.content.runs[0].results`) + conform to the expected type and severity level as defined by configuration parameters (such as `rule_level`, `precision`, + `rule_ids`, and `ignore`). +2. Ensure that the total number of reported violations does not exceed the maximum allowed (`with.max_allowed`). + +If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier, +severity, and the corresponding location in the artifact. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema. +- The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions. +- The evaluation uses the configuration parameters provided in the `with` section to guide the verification process. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/verify-semgrep-report.md b/docs/configuration/rules/sarif/verify-semgrep-report.md index 2db6a148a..a33e9813e 100644 --- a/docs/configuration/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/rules/sarif/verify-semgrep-report.md @@ -3,13 +3,42 @@ **ID:** `sarif-semgrep-report` **Uses:** `sarif/verify-semgrep-report@v2/rules` **Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-semgrep-report.yaml) -**Rego Source:** [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-semgrep-report.rego) +**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/blocklist-report.rego) **Labels:** SARIF, Semgrep Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. + +## Mitigation +Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules. +It iterates over the vulnerability results in the SARIF report (located under +`input.evidence.predicate.content.runs[0].results`) and retrieves the corresponding rule definitions +from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on each result's ruleIndex. + +The rule checks whether the result’s ruleId contains any of the identifiers specified in the configuration (`with.rule_ids`). +If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded. +Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding. + +**Evidence Requirements:** + +- Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema. +- The SARIF report should be generated by Semgrep. +- The report must include detailed rule definitions and descriptions that support matching against the specified blocklist. + ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sarif/verify-tool-evidence.md b/docs/configuration/rules/sarif/verify-tool-evidence.md index 70db62dc4..e76441595 100644 --- a/docs/configuration/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/rules/sarif/verify-tool-evidence.md @@ -8,8 +8,31 @@ Verify required tools were used to generate the SARIF report. + +## Mitigation +Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. + + +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner +(e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: +the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool. +A mismatch indicates that the report may not be reliable. + +**Evidence Requirements:** +- Evidence must adhere to the SARIF 2.1.0 schema. +- The report must include a valid `tool` field. + ## Evidence Requirements | Field | Value | @@ -17,6 +40,5 @@ Verify required tools were used to generate the SARIF report. | signed | False | | content_body_type | generic | | target_type | data | -| tool | semgrep | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | diff --git a/docs/configuration/rules/sbom/NTIA-compliance.md b/docs/configuration/rules/sbom/NTIA-compliance.md new file mode 100644 index 000000000..f9c8513b1 --- /dev/null +++ b/docs/configuration/rules/sbom/NTIA-compliance.md @@ -0,0 +1,41 @@ +# NTIA SBOM Compliance Check +**Type:** Rule +**ID:** `NTIA-compliance` +**Uses:** `sbom/NTIA-compliance@v2/rules` +**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/NTIA-compliance.yaml) +**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/NTIA-compliance.rego) +**Labels:** SBOM, Compliance + +Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. +Checks that: + 1) Authors exist, are non-empty, and each author has both a name and email. + 2) Supplier exists with non-empty name, url, and contact. At least one contact has non-empty email. + 3) Optionally enforces a required author (case-insensitive match for name/email). + 4) Optionally enforces a required supplier (case-insensitive match for supplier name). + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| required_author | {} | +| required_supplier | {} | diff --git a/docs/configuration/rules/sbom/allowed-components.md b/docs/configuration/rules/sbom/allowed-components.md index daf979e6d..9e715c562 100644 --- a/docs/configuration/rules/sbom/allowed-components.md +++ b/docs/configuration/rules/sbom/allowed-components.md @@ -8,9 +8,18 @@ Verify the artifact contains only allowed components. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | @@ -18,7 +27,6 @@ Verify the artifact contains only allowed components. | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| target_type | container | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sbom/artifact-signed.md b/docs/configuration/rules/sbom/artifact-signed.md index e7e103ae1..970e504c4 100644 --- a/docs/configuration/rules/sbom/artifact-signed.md +++ b/docs/configuration/rules/sbom/artifact-signed.md @@ -8,9 +8,18 @@ Verify the SBOM is signed. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS** required by default. -> This rule scoped by product and target. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sbom/banned-licenses.md b/docs/configuration/rules/sbom/banned-licenses.md index 498c82df1..cc33a26df 100644 --- a/docs/configuration/rules/sbom/banned-licenses.md +++ b/docs/configuration/rules/sbom/banned-licenses.md @@ -8,9 +8,18 @@ Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | @@ -18,7 +27,6 @@ Verify the number of disallowed licenses in SBOM dependencies remains below the | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| target_type | container | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sbom/blocklist-packages.md b/docs/configuration/rules/sbom/blocklist-packages.md index ab2afde32..f9e447cd9 100644 --- a/docs/configuration/rules/sbom/blocklist-packages.md +++ b/docs/configuration/rules/sbom/blocklist-packages.md @@ -8,9 +8,18 @@ Verify the number of disallowed dependencies remains below the specified threshold. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sbom/complete-licenses.md b/docs/configuration/rules/sbom/complete-licenses.md index c9a9fc0f3..7191710de 100644 --- a/docs/configuration/rules/sbom/complete-licenses.md +++ b/docs/configuration/rules/sbom/complete-licenses.md @@ -8,9 +8,18 @@ Verify all dependencies in the artifact have a license. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | @@ -18,5 +27,4 @@ Verify all dependencies in the artifact have a license. | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| target_type | container | diff --git a/docs/configuration/rules/sbom/fresh-sbom.md b/docs/configuration/rules/sbom/fresh-sbom.md index 2e9f4b518..26b40d098 100644 --- a/docs/configuration/rules/sbom/fresh-sbom.md +++ b/docs/configuration/rules/sbom/fresh-sbom.md @@ -8,9 +8,18 @@ Verify the SBOM is not older than the specified duration. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/sbom/require-sbom.md b/docs/configuration/rules/sbom/require-sbom.md new file mode 100644 index 000000000..49f99c574 --- /dev/null +++ b/docs/configuration/rules/sbom/require-sbom.md @@ -0,0 +1,30 @@ +# Require SBOM Existence +**Type:** Rule +**ID:** `require-sbom` +**Uses:** `sbom/require-sbom@v2/rules` +**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/require-sbom.yaml) +**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/require-sbom.rego) +**Labels:** SBOM, Blueprint + +Verify the SBOM exists as evidence. + +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | False | + diff --git a/docs/configuration/rules/sbom/required-packages.md b/docs/configuration/rules/sbom/required-packages.md index 3bf944ed2..ef95d6b41 100644 --- a/docs/configuration/rules/sbom/required-packages.md +++ b/docs/configuration/rules/sbom/required-packages.md @@ -8,9 +8,18 @@ Verify the artifact includes all required dependencies. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | @@ -18,7 +27,6 @@ Verify the artifact includes all required dependencies. | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| target_type | container | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/sbom/verify-huggingface-license.md b/docs/configuration/rules/sbom/verify-huggingface-license.md index 8f5634994..99745ca2f 100644 --- a/docs/configuration/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/rules/sbom/verify-huggingface-license.md @@ -8,9 +8,18 @@ Verify the artifact includes all specified licenses. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | @@ -18,7 +27,6 @@ Verify the artifact includes all specified licenses. | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| target_type | container | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/slsa/banned-builder-deps.md b/docs/configuration/rules/slsa/banned-builder-deps.md index e689cb77d..7fcedbee4 100644 --- a/docs/configuration/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/rules/slsa/banned-builder-deps.md @@ -8,8 +8,15 @@ Verify that dependencies in the block list do not appear in the SLSA Proveance document. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/build-time.md b/docs/configuration/rules/slsa/build-time.md index 193d346f1..be858ee0a 100644 --- a/docs/configuration/rules/slsa/build-time.md +++ b/docs/configuration/rules/slsa/build-time.md @@ -8,8 +8,15 @@ Verify the artifact was created within the specified time window. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/field-exists.md b/docs/configuration/rules/slsa/field-exists.md index 4eff15cbe..b11601c6c 100644 --- a/docs/configuration/rules/slsa/field-exists.md +++ b/docs/configuration/rules/slsa/field-exists.md @@ -8,8 +8,15 @@ Verify the specified field exists in the provenance document. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/l1-provenance-exists.md b/docs/configuration/rules/slsa/l1-provenance-exists.md index 8d23f55e7..42864253d 100644 --- a/docs/configuration/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/rules/slsa/l1-provenance-exists.md @@ -13,9 +13,18 @@ Verify that the Provenance document evidence exists. ## Mitigation Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/rules/slsa/l2-provenance-authenticated.md index 53002f8e0..0f1687bf3 100644 --- a/docs/configuration/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/rules/slsa/l2-provenance-authenticated.md @@ -14,9 +14,18 @@ Verify the artifact is signed. Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. +:::tip > Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS** required by default. -> This rule scoped by product and target. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: +:::info +This rule scoped by product and target. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/verify-builder.md b/docs/configuration/rules/slsa/verify-builder.md index b395e1bba..97b699685 100644 --- a/docs/configuration/rules/slsa/verify-builder.md +++ b/docs/configuration/rules/slsa/verify-builder.md @@ -8,9 +8,15 @@ Verify the artifact was created by the specified builder. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by pipeline and product. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +This rule scoped by pipeline and product. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/slsa/verify-byproducts.md b/docs/configuration/rules/slsa/verify-byproducts.md index ed91d42aa..0278b2584 100644 --- a/docs/configuration/rules/slsa/verify-byproducts.md +++ b/docs/configuration/rules/slsa/verify-byproducts.md @@ -8,8 +8,15 @@ Verify the artifact has no disallowed builder dependencies. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/ssdf/ps-1-2fa.md b/docs/configuration/rules/ssdf/ps-1-2fa.md index 4e398d34a..0b5c35703 100644 --- a/docs/configuration/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/rules/ssdf/ps-1-2fa.md @@ -9,11 +9,33 @@ PS.1 Require 2FA for accessing code ## Mitigation -Enforces two-factor authentication (2FA), significantly reducing the risk of compromised credentials. +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Description +This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. +It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the +`organization_details.two_factor_requirement_enabled` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match +the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional +layer of security against unauthorized access. + +**Evidence Requirements:** +- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. +- The data should come from a trusted source (e.g., a GitHub organization scan). +- The evidence must clearly indicate whether 2FA is enabled. + ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/rules/ssdf/ps-1-branch-protection.md index 5c50f21d0..b63af02ec 100644 --- a/docs/configuration/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/rules/ssdf/ps-1-branch-protection.md @@ -12,8 +12,15 @@ PS.1 Require branch protection for the repository Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/rules/ssdf/ps-1-limit-admins.md index 224e664cc..9e2f1dc3b 100644 --- a/docs/configuration/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/rules/ssdf/ps-1-limit-admins.md @@ -12,8 +12,15 @@ PS.1 Restrict the maximum number of organization admins Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-1-repo-private.md b/docs/configuration/rules/ssdf/ps-1-repo-private.md index 3e7baa798..3b79c9911 100644 --- a/docs/configuration/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/rules/ssdf/ps-1-repo-private.md @@ -12,8 +12,15 @@ PS.1 Assure the repository is private Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md index f8009edbc..b9ed72cce 100644 --- a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,8 +12,15 @@ PS.1 Require contributors to sign when committing to Github through the web inte Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md index adcb30226..2687285ed 100644 --- a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md @@ -12,8 +12,15 @@ PS.2 Provide a mechanism to verify the integrity of the image Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Evidence Requirements | Field | Value | diff --git a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md index 93e8de4d4..610ce05f0 100644 --- a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md @@ -14,8 +14,15 @@ We assume running in Github thus the code is allways stored in a repository Archives code changes to maintain a secure, immutable history for auditing and traceability. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md index 5dc1946a8..3ba9a39e5 100644 --- a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,6 +12,13 @@ PS.3.2 Archive SBOM Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: From 9434429f8515ef0945f3d2765da5203f4ac52fc3 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:27:59 +0200 Subject: [PATCH 063/191] tmp gen docs --- docs/configuration/_category_.json | 4 ++++ docs/configuration/initiatives/_category_.json | 4 ++++ docs/configuration/rules/bitbucket/project/allow-admins.md | 2 +- docs/configuration/rules/bitbucket/project/allow-users.md | 2 +- .../rules/bitbucket/project/exposed-credentials.md | 2 +- .../configuration/rules/bitbucket/project/long-live-tokens.md | 2 +- docs/configuration/rules/bitbucket/repository/allow-admins.md | 2 +- docs/configuration/rules/bitbucket/repository/allow-users.md | 2 +- .../rules/bitbucket/repository/branch-protection.md | 2 +- docs/configuration/rules/bitbucket/workspace/allow-admins.md | 2 +- docs/configuration/rules/bitbucket/workspace/allow-users.md | 2 +- docs/configuration/rules/github/org/2fa.md | 2 +- docs/configuration/rules/github/org/advanced-security.md | 2 +- docs/configuration/rules/github/org/allow-admins.md | 2 +- docs/configuration/rules/github/org/allow-users.md | 2 +- docs/configuration/rules/github/org/create-private-repos.md | 2 +- docs/configuration/rules/github/org/create-repos.md | 2 +- docs/configuration/rules/github/org/dependabot-alerts.md | 2 +- .../rules/github/org/dependabot-security-updates-sa.md | 2 +- .../rules/github/org/dependabot-security-updates.md | 2 +- docs/configuration/rules/github/org/dependency-graph.md | 2 +- docs/configuration/rules/github/org/max-admins.md | 2 +- docs/configuration/rules/github/org/old-secrets.md | 2 +- docs/configuration/rules/github/org/pp-custom-link.md | 2 +- docs/configuration/rules/github/org/push-protection-sa.md | 2 +- docs/configuration/rules/github/org/push-protection.md | 2 +- docs/configuration/rules/github/org/repo-visibility.md | 2 +- docs/configuration/rules/github/org/secret-scanning-sa.md | 2 +- docs/configuration/rules/github/org/secret-scanning.md | 2 +- docs/configuration/rules/github/org/validity-checks-sa.md | 2 +- docs/configuration/rules/github/org/validity-checks.md | 2 +- docs/configuration/rules/github/org/web-commit-signoff.md | 2 +- .../rules/github/repository/branch-protection.md | 2 +- .../rules/github/repository/branch-verification.md | 2 +- .../rules/github/repository/check-signed-commits.md | 2 +- .../rules/github/repository/default-branch-protection.md | 2 +- docs/configuration/rules/github/repository/dependabot.md | 2 +- .../rules/github/repository/ephemeral-runners-only.md | 2 +- docs/configuration/rules/github/repository/no-cache-usage.md | 2 +- docs/configuration/rules/github/repository/no-org-secrets.md | 2 +- docs/configuration/rules/github/repository/old-secrets.md | 2 +- docs/configuration/rules/github/repository/push-protection.md | 2 +- docs/configuration/rules/github/repository/repo-private.md | 2 +- docs/configuration/rules/github/repository/secret-scanning.md | 2 +- docs/configuration/rules/github/repository/signed-commits.md | 2 +- docs/configuration/rules/github/repository/validity-checks.md | 2 +- docs/configuration/rules/github/repository/visibility.md | 2 +- .../rules/github/repository/web-commit-signoff.md | 2 +- docs/configuration/rules/gitlab/org/allow-admins.md | 2 +- docs/configuration/rules/gitlab/org/allow-token-scopes.md | 2 +- docs/configuration/rules/gitlab/org/allow-users.md | 2 +- docs/configuration/rules/gitlab/org/blocked-users.md | 2 +- docs/configuration/rules/gitlab/org/expiring-tokens.md | 2 +- docs/configuration/rules/gitlab/org/forbid-token-scopes.md | 2 +- docs/configuration/rules/gitlab/org/inactive-projects.md | 2 +- docs/configuration/rules/gitlab/org/longlive-tokens.md | 2 +- docs/configuration/rules/gitlab/org/max-admins.md | 2 +- docs/configuration/rules/gitlab/org/projects-visibility.md | 2 +- docs/configuration/rules/gitlab/org/unused-tokens.md | 2 +- docs/configuration/rules/gitlab/project/abandoned-project.md | 2 +- .../rules/gitlab/project/approvals-policy-check.md | 2 +- .../rules/gitlab/project/approvers-per-merge-request.md | 2 +- docs/configuration/rules/gitlab/project/author-email-regex.md | 2 +- docs/configuration/rules/gitlab/project/check-cwe.md | 2 +- .../rules/gitlab/project/check-signed-commits.md | 2 +- .../rules/gitlab/project/co-approval-required.md | 2 +- .../rules/gitlab/project/commit-author-email-check.md | 2 +- .../rules/gitlab/project/commit-author-name-check.md | 2 +- .../rules/gitlab/project/commit-committer-check.md | 2 +- .../rules/gitlab/project/commit-message-check.md | 2 +- docs/configuration/rules/gitlab/project/commits-validated.md | 2 +- .../rules/gitlab/project/committer-email-check.md | 2 +- .../rules/gitlab/project/committer-name-check.md | 2 +- .../rules/gitlab/project/critical-severity-limit.md | 2 +- .../rules/gitlab/project/description-substring-check.md | 2 +- .../rules/gitlab/project/disallowed-banned-approvers.md | 2 +- .../rules/gitlab/project/force-push-protection.md | 2 +- .../rules/gitlab/project/medium-severity-limit.md | 2 +- docs/configuration/rules/gitlab/project/member-check.md | 2 +- docs/configuration/rules/gitlab/project/merge-access-level.md | 2 +- .../rules/gitlab/project/merge-requests-author-approval.md | 2 +- .../project/merge-requests-disable-committers-approval.md | 2 +- .../rules/gitlab/project/message-substring-check.md | 2 +- .../rules/gitlab/project/prevent-secrets-check.md | 2 +- docs/configuration/rules/gitlab/project/protect-ci-secrets.md | 2 +- docs/configuration/rules/gitlab/project/push-access-level.md | 2 +- docs/configuration/rules/gitlab/project/push-rules-set.md | 2 +- .../rules/gitlab/project/reject-unsigned-commits.md | 2 +- .../rules/gitlab/project/require-password-to-approve.md | 2 +- .../rules/gitlab/project/required-minimal-approvers.md | 2 +- .../rules/gitlab/project/reset-pprovals-on-push.md | 2 +- docs/configuration/rules/gitlab/project/sast-scan-pass.md | 2 +- docs/configuration/rules/gitlab/project/sast-scanning.md | 2 +- docs/configuration/rules/gitlab/project/secrets-scan-pass.md | 2 +- docs/configuration/rules/gitlab/project/secrets-scanning.md | 2 +- .../rules/gitlab/project/selective-code-owner-removals.md | 2 +- docs/configuration/rules/gitlab/project/visibility-check.md | 2 +- docs/configuration/rules/jenkins/instance/inactive-users.md | 2 +- docs/configuration/rules/jenkins/instance/unused-users.md | 2 +- 99 files changed, 105 insertions(+), 97 deletions(-) create mode 100644 docs/configuration/_category_.json create mode 100644 docs/configuration/initiatives/_category_.json diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json new file mode 100644 index 000000000..5a66c74b8 --- /dev/null +++ b/docs/configuration/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Configuration", + "position": 30 + } \ No newline at end of file diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json new file mode 100644 index 000000000..120d1a7ed --- /dev/null +++ b/docs/configuration/initiatives/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Reference: Policies and Configuration Guide", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/bitbucket/project/allow-admins.md b/docs/configuration/rules/bitbucket/project/allow-admins.md index 86eef1ae0..c71b58135 100644 --- a/docs/configuration/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/rules/bitbucket/project/allow-admins.md @@ -24,7 +24,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | +| labels | - platform=bitbucket
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/project/allow-users.md b/docs/configuration/rules/bitbucket/project/allow-users.md index 16760aa85..73be01702 100644 --- a/docs/configuration/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/rules/bitbucket/project/allow-users.md @@ -24,7 +24,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | +| labels | - platform=bitbucket
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/rules/bitbucket/project/exposed-credentials.md index 384c1d1a1..b8305a41b 100644 --- a/docs/configuration/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/rules/bitbucket/project/exposed-credentials.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | +| labels | - platform=bitbucket
- asset_type=project | diff --git a/docs/configuration/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/rules/bitbucket/project/long-live-tokens.md index 7501f80ca..608cc7c2a 100644 --- a/docs/configuration/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/rules/bitbucket/project/long-live-tokens.md @@ -24,7 +24,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | signed | False | | content_body_type | generic | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | +| labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/repository/allow-admins.md b/docs/configuration/rules/bitbucket/repository/allow-admins.md index 930dfe28e..27b709ff8 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/rules/bitbucket/repository/allow-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | +| labels | - platform=bitbucket
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/repository/allow-users.md b/docs/configuration/rules/bitbucket/repository/allow-users.md index 8cc9419e9..f3b326cd8 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/rules/bitbucket/repository/allow-users.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | +| labels | - platform=bitbucket
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/repository/branch-protection.md b/docs/configuration/rules/bitbucket/repository/branch-protection.md index 6147dcadf..270bdc7c3 100644 --- a/docs/configuration/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/rules/bitbucket/repository/branch-protection.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | +| labels | - platform=bitbucket
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/rules/bitbucket/workspace/allow-admins.md index 1d7678726..10d05c685 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=workspace | +| labels | - platform=bitbucket
- asset_type=workspace | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/bitbucket/workspace/allow-users.md b/docs/configuration/rules/bitbucket/workspace/allow-users.md index c1c47dc9c..7b51045ac 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-users.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=workspace | +| labels | - platform=bitbucket
- asset_type=workspace | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/2fa.md b/docs/configuration/rules/github/org/2fa.md index 4f645a5ba..f9946667d 100644 --- a/docs/configuration/rules/github/org/2fa.md +++ b/docs/configuration/rules/github/org/2fa.md @@ -45,7 +45,7 @@ layer of security against unauthorized access. | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/advanced-security.md b/docs/configuration/rules/github/org/advanced-security.md index 340b345fa..45b38b2ef 100644 --- a/docs/configuration/rules/github/org/advanced-security.md +++ b/docs/configuration/rules/github/org/advanced-security.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/allow-admins.md b/docs/configuration/rules/github/org/allow-admins.md index 05dfda55d..c0ad8954b 100644 --- a/docs/configuration/rules/github/org/allow-admins.md +++ b/docs/configuration/rules/github/org/allow-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/allow-users.md b/docs/configuration/rules/github/org/allow-users.md index 0864a2b4a..889dc6604 100644 --- a/docs/configuration/rules/github/org/allow-users.md +++ b/docs/configuration/rules/github/org/allow-users.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/create-private-repos.md b/docs/configuration/rules/github/org/create-private-repos.md index 4698adbc2..3909258bf 100644 --- a/docs/configuration/rules/github/org/create-private-repos.md +++ b/docs/configuration/rules/github/org/create-private-repos.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/create-repos.md b/docs/configuration/rules/github/org/create-repos.md index efb91e485..35a44899a 100644 --- a/docs/configuration/rules/github/org/create-repos.md +++ b/docs/configuration/rules/github/org/create-repos.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/dependabot-alerts.md b/docs/configuration/rules/github/org/dependabot-alerts.md index 1fe8a5718..f749a0622 100644 --- a/docs/configuration/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/rules/github/org/dependabot-alerts.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md index e6bbc09bd..78128fee3 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | diff --git a/docs/configuration/rules/github/org/dependabot-security-updates.md b/docs/configuration/rules/github/org/dependabot-security-updates.md index db941ba50..a234399e3 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/dependency-graph.md b/docs/configuration/rules/github/org/dependency-graph.md index 42a1602e1..ce1e1024b 100644 --- a/docs/configuration/rules/github/org/dependency-graph.md +++ b/docs/configuration/rules/github/org/dependency-graph.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/max-admins.md b/docs/configuration/rules/github/org/max-admins.md index 86d9b5ec8..dd5bf4ab5 100644 --- a/docs/configuration/rules/github/org/max-admins.md +++ b/docs/configuration/rules/github/org/max-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/old-secrets.md b/docs/configuration/rules/github/org/old-secrets.md index 8f7406790..bbff36fd7 100644 --- a/docs/configuration/rules/github/org/old-secrets.md +++ b/docs/configuration/rules/github/org/old-secrets.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/pp-custom-link.md b/docs/configuration/rules/github/org/pp-custom-link.md index 3d40ee15c..c10c38025 100644 --- a/docs/configuration/rules/github/org/pp-custom-link.md +++ b/docs/configuration/rules/github/org/pp-custom-link.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/push-protection-sa.md b/docs/configuration/rules/github/org/push-protection-sa.md index e38329345..16248bbc4 100644 --- a/docs/configuration/rules/github/org/push-protection-sa.md +++ b/docs/configuration/rules/github/org/push-protection-sa.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | diff --git a/docs/configuration/rules/github/org/push-protection.md b/docs/configuration/rules/github/org/push-protection.md index 3d2b613b8..14d44c4f0 100644 --- a/docs/configuration/rules/github/org/push-protection.md +++ b/docs/configuration/rules/github/org/push-protection.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/repo-visibility.md b/docs/configuration/rules/github/org/repo-visibility.md index e009907f7..c9959e630 100644 --- a/docs/configuration/rules/github/org/repo-visibility.md +++ b/docs/configuration/rules/github/org/repo-visibility.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/secret-scanning-sa.md b/docs/configuration/rules/github/org/secret-scanning-sa.md index c471de565..fc9a29180 100644 --- a/docs/configuration/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/rules/github/org/secret-scanning-sa.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | diff --git a/docs/configuration/rules/github/org/secret-scanning.md b/docs/configuration/rules/github/org/secret-scanning.md index 0e71cbcf8..bba65eb2e 100644 --- a/docs/configuration/rules/github/org/secret-scanning.md +++ b/docs/configuration/rules/github/org/secret-scanning.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/validity-checks-sa.md b/docs/configuration/rules/github/org/validity-checks-sa.md index 7339df3e5..f359428c2 100644 --- a/docs/configuration/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/rules/github/org/validity-checks-sa.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | diff --git a/docs/configuration/rules/github/org/validity-checks.md b/docs/configuration/rules/github/org/validity-checks.md index d8d3c0fe3..e36cb5efa 100644 --- a/docs/configuration/rules/github/org/validity-checks.md +++ b/docs/configuration/rules/github/org/validity-checks.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/org/web-commit-signoff.md b/docs/configuration/rules/github/org/web-commit-signoff.md index 4bcffeaf0..179d6b5e9 100644 --- a/docs/configuration/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/rules/github/org/web-commit-signoff.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | +| labels | - platform=github
- asset_type=organization | diff --git a/docs/configuration/rules/github/repository/branch-protection.md b/docs/configuration/rules/github/repository/branch-protection.md index 87b3bdd53..ec80bf2a6 100644 --- a/docs/configuration/rules/github/repository/branch-protection.md +++ b/docs/configuration/rules/github/repository/branch-protection.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/repository/branch-verification.md b/docs/configuration/rules/github/repository/branch-verification.md index 59a905cb2..36e6ffb45 100644 --- a/docs/configuration/rules/github/repository/branch-verification.md +++ b/docs/configuration/rules/github/repository/branch-verification.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/repository/check-signed-commits.md b/docs/configuration/rules/github/repository/check-signed-commits.md index 6d572e1af..1ffa7ceb9 100644 --- a/docs/configuration/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/rules/github/repository/check-signed-commits.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/default-branch-protection.md b/docs/configuration/rules/github/repository/default-branch-protection.md index fc14f647e..50b1b1633 100644 --- a/docs/configuration/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/rules/github/repository/default-branch-protection.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/dependabot.md b/docs/configuration/rules/github/repository/dependabot.md index 07edfeb61..3e08aa62b 100644 --- a/docs/configuration/rules/github/repository/dependabot.md +++ b/docs/configuration/rules/github/repository/dependabot.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/rules/github/repository/ephemeral-runners-only.md index 006776d08..2524a14cd 100644 --- a/docs/configuration/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/rules/github/repository/ephemeral-runners-only.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/no-cache-usage.md b/docs/configuration/rules/github/repository/no-cache-usage.md index 94f4f2d36..cda33f22e 100644 --- a/docs/configuration/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/rules/github/repository/no-cache-usage.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/no-org-secrets.md b/docs/configuration/rules/github/repository/no-org-secrets.md index 547e254df..51017d85f 100644 --- a/docs/configuration/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/rules/github/repository/no-org-secrets.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/old-secrets.md b/docs/configuration/rules/github/repository/old-secrets.md index 385fce9b8..093ac71ae 100644 --- a/docs/configuration/rules/github/repository/old-secrets.md +++ b/docs/configuration/rules/github/repository/old-secrets.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/repository/push-protection.md b/docs/configuration/rules/github/repository/push-protection.md index b2cbffc92..d1e5cfa5c 100644 --- a/docs/configuration/rules/github/repository/push-protection.md +++ b/docs/configuration/rules/github/repository/push-protection.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/repo-private.md b/docs/configuration/rules/github/repository/repo-private.md index 86241bbfb..fcaf1599d 100644 --- a/docs/configuration/rules/github/repository/repo-private.md +++ b/docs/configuration/rules/github/repository/repo-private.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/secret-scanning.md b/docs/configuration/rules/github/repository/secret-scanning.md index 29bdcb97a..190724ad8 100644 --- a/docs/configuration/rules/github/repository/secret-scanning.md +++ b/docs/configuration/rules/github/repository/secret-scanning.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/signed-commits.md b/docs/configuration/rules/github/repository/signed-commits.md index 03a4644ad..5f55a3e04 100644 --- a/docs/configuration/rules/github/repository/signed-commits.md +++ b/docs/configuration/rules/github/repository/signed-commits.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/validity-checks.md b/docs/configuration/rules/github/repository/validity-checks.md index 0375b9b07..5c09cb0b6 100644 --- a/docs/configuration/rules/github/repository/validity-checks.md +++ b/docs/configuration/rules/github/repository/validity-checks.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/github/repository/visibility.md b/docs/configuration/rules/github/repository/visibility.md index 50804abc1..4df249640 100644 --- a/docs/configuration/rules/github/repository/visibility.md +++ b/docs/configuration/rules/github/repository/visibility.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/github/repository/web-commit-signoff.md b/docs/configuration/rules/github/repository/web-commit-signoff.md index 22b07dcbc..2cde4eb1b 100644 --- a/docs/configuration/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/rules/github/repository/web-commit-signoff.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | +| labels | - platform=github
- asset_type=repository | diff --git a/docs/configuration/rules/gitlab/org/allow-admins.md b/docs/configuration/rules/gitlab/org/allow-admins.md index 298aa4457..b5a1d6be3 100644 --- a/docs/configuration/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/rules/gitlab/org/allow-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/rules/gitlab/org/allow-token-scopes.md index 072f6b361..4b5674e7e 100644 --- a/docs/configuration/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/allow-token-scopes.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/allow-users.md b/docs/configuration/rules/gitlab/org/allow-users.md index 21342cb42..3c4d8ebb0 100644 --- a/docs/configuration/rules/gitlab/org/allow-users.md +++ b/docs/configuration/rules/gitlab/org/allow-users.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/blocked-users.md b/docs/configuration/rules/gitlab/org/blocked-users.md index 34dd9a899..98b737e53 100644 --- a/docs/configuration/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/rules/gitlab/org/blocked-users.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/expiring-tokens.md b/docs/configuration/rules/gitlab/org/expiring-tokens.md index da597e634..1f5579083 100644 --- a/docs/configuration/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/rules/gitlab/org/expiring-tokens.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md index eb20afb6c..88abd688b 100644 --- a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/inactive-projects.md b/docs/configuration/rules/gitlab/org/inactive-projects.md index 555518e4c..6af0640a6 100644 --- a/docs/configuration/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/rules/gitlab/org/inactive-projects.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/longlive-tokens.md b/docs/configuration/rules/gitlab/org/longlive-tokens.md index 0037cd56b..052fed38c 100644 --- a/docs/configuration/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/rules/gitlab/org/longlive-tokens.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/max-admins.md b/docs/configuration/rules/gitlab/org/max-admins.md index 52e8df914..790ed3040 100644 --- a/docs/configuration/rules/gitlab/org/max-admins.md +++ b/docs/configuration/rules/gitlab/org/max-admins.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/projects-visibility.md b/docs/configuration/rules/gitlab/org/projects-visibility.md index c0efad385..9a39b7c7c 100644 --- a/docs/configuration/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/rules/gitlab/org/projects-visibility.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/org/unused-tokens.md b/docs/configuration/rules/gitlab/org/unused-tokens.md index a45aafefd..6de1beb8c 100644 --- a/docs/configuration/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/rules/gitlab/org/unused-tokens.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | +| labels | - platform=gitlab
- asset_type=organization | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/abandoned-project.md b/docs/configuration/rules/gitlab/project/abandoned-project.md index ad7ed901d..0d02c04a5 100644 --- a/docs/configuration/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/rules/gitlab/project/abandoned-project.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/rules/gitlab/project/approvals-policy-check.md index fe8d9130b..a5ea48577 100644 --- a/docs/configuration/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/rules/gitlab/project/approvals-policy-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md index f9d95b78d..42799c0f4 100644 --- a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/author-email-regex.md b/docs/configuration/rules/gitlab/project/author-email-regex.md index 8bc3a23d2..b51afde13 100644 --- a/docs/configuration/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/rules/gitlab/project/author-email-regex.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/check-cwe.md b/docs/configuration/rules/gitlab/project/check-cwe.md index eec4e7636..7f5675dc6 100644 --- a/docs/configuration/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/rules/gitlab/project/check-cwe.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/check-signed-commits.md b/docs/configuration/rules/gitlab/project/check-signed-commits.md index 8598bdb4f..adfe9bdf2 100644 --- a/docs/configuration/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/rules/gitlab/project/check-signed-commits.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/co-approval-required.md b/docs/configuration/rules/gitlab/project/co-approval-required.md index 993dda1b2..cd64db427 100644 --- a/docs/configuration/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/rules/gitlab/project/co-approval-required.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/rules/gitlab/project/commit-author-email-check.md index 4dfdb65ce..a5ef63703 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-email-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/rules/gitlab/project/commit-author-name-check.md index ec88811ab..723027cd5 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-name-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/commit-committer-check.md b/docs/configuration/rules/gitlab/project/commit-committer-check.md index 81bca03df..09f069ca5 100644 --- a/docs/configuration/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/rules/gitlab/project/commit-committer-check.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/commit-message-check.md b/docs/configuration/rules/gitlab/project/commit-message-check.md index 139fa7296..56eba70d6 100644 --- a/docs/configuration/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/rules/gitlab/project/commit-message-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/commits-validated.md b/docs/configuration/rules/gitlab/project/commits-validated.md index f596d0bb7..eca72e964 100644 --- a/docs/configuration/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/rules/gitlab/project/commits-validated.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/committer-email-check.md b/docs/configuration/rules/gitlab/project/committer-email-check.md index 5d39521f6..1d1a40e08 100644 --- a/docs/configuration/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/rules/gitlab/project/committer-email-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/committer-name-check.md b/docs/configuration/rules/gitlab/project/committer-name-check.md index c4fbfb7e2..8b3c7c5f2 100644 --- a/docs/configuration/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/rules/gitlab/project/committer-name-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/rules/gitlab/project/critical-severity-limit.md index c6cb63eac..8f827009a 100644 --- a/docs/configuration/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/critical-severity-limit.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/description-substring-check.md b/docs/configuration/rules/gitlab/project/description-substring-check.md index fda18f85d..fa496068d 100644 --- a/docs/configuration/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/rules/gitlab/project/description-substring-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md index 2f5e3c010..d8368c618 100644 --- a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/force-push-protection.md b/docs/configuration/rules/gitlab/project/force-push-protection.md index f33043ff6..29afc45c0 100644 --- a/docs/configuration/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/rules/gitlab/project/force-push-protection.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/rules/gitlab/project/medium-severity-limit.md index 6696cc141..bd9d1ba82 100644 --- a/docs/configuration/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/medium-severity-limit.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/member-check.md b/docs/configuration/rules/gitlab/project/member-check.md index c4fe97379..da294c8c3 100644 --- a/docs/configuration/rules/gitlab/project/member-check.md +++ b/docs/configuration/rules/gitlab/project/member-check.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/merge-access-level.md b/docs/configuration/rules/gitlab/project/merge-access-level.md index b46a2c250..b2537a09d 100644 --- a/docs/configuration/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/rules/gitlab/project/merge-access-level.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md index 1606d721c..3d12577ea 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md index bc947e713..fa091dc0e 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/message-substring-check.md b/docs/configuration/rules/gitlab/project/message-substring-check.md index c59fa7a77..64b43ea90 100644 --- a/docs/configuration/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/rules/gitlab/project/message-substring-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md index c5c1442a4..ff78bcbb5 100644 --- a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md index fc64e77a5..221391cbd 100644 --- a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/push-access-level.md b/docs/configuration/rules/gitlab/project/push-access-level.md index 22ebffd2a..a64ab8bb9 100644 --- a/docs/configuration/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/rules/gitlab/project/push-access-level.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/push-rules-set.md b/docs/configuration/rules/gitlab/project/push-rules-set.md index 55fc24358..27d9f0b84 100644 --- a/docs/configuration/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/rules/gitlab/project/push-rules-set.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md index 5275c96c7..ba68d448d 100644 --- a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/rules/gitlab/project/require-password-to-approve.md index fe4d9763a..3e3eff855 100644 --- a/docs/configuration/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/rules/gitlab/project/require-password-to-approve.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md index 08ec5f4da..df614a427 100644 --- a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md index a104c37f3..23da81179 100644 --- a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/rules/gitlab/project/sast-scan-pass.md index 1c7e9192c..cd02de6b1 100644 --- a/docs/configuration/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/sast-scan-pass.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/sast-scanning.md b/docs/configuration/rules/gitlab/project/sast-scanning.md index 15648792e..d4640948b 100644 --- a/docs/configuration/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/rules/gitlab/project/sast-scanning.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md index ef4fe19fe..483024787 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/secrets-scanning.md b/docs/configuration/rules/gitlab/project/secrets-scanning.md index c19e0d922..284c27fbe 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/rules/gitlab/project/secrets-scanning.md @@ -25,5 +25,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | diff --git a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md index 8018111d6..f1e1d1cbb 100644 --- a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/gitlab/project/visibility-check.md b/docs/configuration/rules/gitlab/project/visibility-check.md index 509edb8cd..a500cf78e 100644 --- a/docs/configuration/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/rules/gitlab/project/visibility-check.md @@ -25,7 +25,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | +| labels | - platform=gitlab
- asset_type=project | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/jenkins/instance/inactive-users.md b/docs/configuration/rules/jenkins/instance/inactive-users.md index ffc836bfb..47cb2d449 100644 --- a/docs/configuration/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/rules/jenkins/instance/inactive-users.md @@ -24,7 +24,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa | signed | False | | content_body_type | generic | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=instance
- platform=jenkins | +| labels | - asset_type=instance
- platform=jenkins | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/rules/jenkins/instance/unused-users.md b/docs/configuration/rules/jenkins/instance/unused-users.md index 12df7e9bf..14b350f74 100644 --- a/docs/configuration/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/rules/jenkins/instance/unused-users.md @@ -24,5 +24,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa | signed | False | | content_body_type | generic | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=instance
- platform=jenkins | +| labels | - asset_type=instance
- platform=jenkins | From e6d6ca04d462fc8cf7c735545d6d3f8110521b66 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:34:31 +0200 Subject: [PATCH 064/191] tmp gen docs --- docs/configuration/rules/github/api/branch-protection.md | 8 ++++---- docs/configuration/rules/gitlab/api/push-rules.md | 4 ++-- docs/configuration/rules/multievidence/files_integrity.md | 2 +- docs/configuration/rules/slsa/verify-builder.md | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/rules/github/api/branch-protection.md index 6e64d9f2c..b263dc505 100644 --- a/docs/configuration/rules/github/api/branch-protection.md +++ b/docs/configuration/rules/github/api/branch-protection.md @@ -21,8 +21,8 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| api_token | {{ .Args.Token }} | -| owner | {{ .Args.Owner }} | -| repo | {{ .Args.Repo }} | -| branch | {{ .Args.Branch }} | +| api_token | `{{ .Args.Token }}` | +| owner | `{{ .Args.Owner }}` | +| repo | `{{ .Args.Repo }}` | +| branch | `{{ .Args.Branch }}` | | branch_protection_rules | {'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False} | diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/rules/gitlab/api/push-rules.md index 18b9c2668..28cb0c65a 100644 --- a/docs/configuration/rules/gitlab/api/push-rules.md +++ b/docs/configuration/rules/gitlab/api/push-rules.md @@ -21,6 +21,6 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| api_token | {{ .Args.Token }} | -| project | {{ .Args.Project }} | +| api_token | `{{ .Args.Token }}` | +| project | `{{ .Args.Project }}` | | push_rule | {'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None} | diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md index 989e82a4b..fd1326ebb 100644 --- a/docs/configuration/rules/multievidence/files_integrity.md +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -29,5 +29,5 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| ref_sbom | {{ .Env.REF_SBOM_DATA }} | +| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | | path_prefix | pkg:file/ | diff --git a/docs/configuration/rules/slsa/verify-builder.md b/docs/configuration/rules/slsa/verify-builder.md index 97b699685..92ad4f2c1 100644 --- a/docs/configuration/rules/slsa/verify-builder.md +++ b/docs/configuration/rules/slsa/verify-builder.md @@ -29,4 +29,4 @@ This rule scoped by pipeline and product. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| id | {{ .Env.HOSTNAME }} | +| id | `{{ .Env.HOSTNAME }}` | From 7f85022e0812977401b32ff9d4f98cd6badbe3c6 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:43:50 +0200 Subject: [PATCH 065/191] tmp gen docs --- docs/configuration/rules/multievidence/files_integrity.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md index fd1326ebb..f68debaaa 100644 --- a/docs/configuration/rules/multievidence/files_integrity.md +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -31,3 +31,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa |-----------|---------| | ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | | path_prefix | pkg:file/ | + From fc6c20050d7d75e47bf5a0251d1bb1d4c54d6229 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:51:23 +0200 Subject: [PATCH 066/191] tmp gen docs --- docs/configuration/rules/api/scribe-api-cve-product.md | 2 +- docs/configuration/rules/api/scribe-api-cve.md | 2 +- docs/configuration/rules/api/scribe-api-published.md | 2 +- docs/configuration/rules/git/artifact-signed.md | 2 +- docs/configuration/rules/github/api/branch-protection.md | 2 +- docs/configuration/rules/gitlab/api/push-rules.md | 2 +- docs/configuration/rules/gitlab/pipeline/verify-labels.md | 2 +- docs/configuration/rules/images/image-signed.md | 2 +- docs/configuration/rules/multievidence/files_integrity.md | 1 - docs/configuration/rules/sarif/artifact-signed.md | 2 +- docs/configuration/rules/sbom/NTIA-compliance.md | 4 ++-- docs/configuration/rules/sbom/artifact-signed.md | 2 +- docs/configuration/rules/slsa/l2-provenance-authenticated.md | 2 +- 13 files changed, 13 insertions(+), 14 deletions(-) diff --git a/docs/configuration/rules/api/scribe-api-cve-product.md b/docs/configuration/rules/api/scribe-api-cve-product.md index 487b938d7..efb9b3c3b 100644 --- a/docs/configuration/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/rules/api/scribe-api-cve-product.md @@ -24,4 +24,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| superset | {'cve': {'max': 0, 'severity': 6}} | +| superset | `{'cve': {'max': 0, 'severity': 6}}` | diff --git a/docs/configuration/rules/api/scribe-api-cve.md b/docs/configuration/rules/api/scribe-api-cve.md index f79067a79..15ff3ef6c 100644 --- a/docs/configuration/rules/api/scribe-api-cve.md +++ b/docs/configuration/rules/api/scribe-api-cve.md @@ -35,4 +35,4 @@ This rule scoped by product and target. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| superset | {'cve': {'max': 0, 'severity': 6}} | +| superset | `{'cve': {'max': 0, 'severity': 6}}` | diff --git a/docs/configuration/rules/api/scribe-api-published.md b/docs/configuration/rules/api/scribe-api-published.md index 59f87359b..053e1a284 100644 --- a/docs/configuration/rules/api/scribe-api-published.md +++ b/docs/configuration/rules/api/scribe-api-published.md @@ -30,4 +30,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| superset | {'published': None} | +| superset | `{'published': None}` | diff --git a/docs/configuration/rules/git/artifact-signed.md b/docs/configuration/rules/git/artifact-signed.md index ee9cd1143..55eaf83d6 100644 --- a/docs/configuration/rules/git/artifact-signed.md +++ b/docs/configuration/rules/git/artifact-signed.md @@ -32,4 +32,4 @@ This rule scoped by product and target. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| identity | {'common-names': [], 'emails': []} | +| identity | `{'common-names': [], 'emails': []}` | diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/rules/github/api/branch-protection.md index b263dc505..da040635f 100644 --- a/docs/configuration/rules/github/api/branch-protection.md +++ b/docs/configuration/rules/github/api/branch-protection.md @@ -25,4 +25,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa | owner | `{{ .Args.Owner }}` | | repo | `{{ .Args.Repo }}` | | branch | `{{ .Args.Branch }}` | -| branch_protection_rules | {'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False} | +| branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` | diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/rules/gitlab/api/push-rules.md index 28cb0c65a..b071fb8c6 100644 --- a/docs/configuration/rules/gitlab/api/push-rules.md +++ b/docs/configuration/rules/gitlab/api/push-rules.md @@ -23,4 +23,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa |-----------|---------| | api_token | `{{ .Args.Token }}` | | project | `{{ .Args.Project }}` | -| push_rule | {'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None} | +| push_rule | `{'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None}` | diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/rules/gitlab/pipeline/verify-labels.md index ed106b68b..1defbd8c9 100644 --- a/docs/configuration/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels.md @@ -30,4 +30,4 @@ his rule requires evaluation with a target; without one, the rule will be **disa ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| labels | {'app.kubernetes.io/instance': 'defaul1t'} | +| labels | `{'app.kubernetes.io/instance': 'defaul1t'}` | diff --git a/docs/configuration/rules/images/image-signed.md b/docs/configuration/rules/images/image-signed.md index 17bbf5608..8299000c9 100644 --- a/docs/configuration/rules/images/image-signed.md +++ b/docs/configuration/rules/images/image-signed.md @@ -36,4 +36,4 @@ This rule scoped by product and target. | Parameter | Default | |-----------|---------| | skip_image_regex | ['.*alpine.*'] | -| identity | {'emails': [], 'common-names': []} | +| identity | `{'emails': [], 'common-names': []}` | diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md index f68debaaa..fd1326ebb 100644 --- a/docs/configuration/rules/multievidence/files_integrity.md +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -31,4 +31,3 @@ his rule requires evaluation with a target; without one, the rule will be **disa |-----------|---------| | ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | | path_prefix | pkg:file/ | - diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/rules/sarif/artifact-signed.md index 6696bcbc9..ee5f60483 100644 --- a/docs/configuration/rules/sarif/artifact-signed.md +++ b/docs/configuration/rules/sarif/artifact-signed.md @@ -46,4 +46,4 @@ Additionally, the rule validates that the signature corresponds to one of the ex ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| identity | {'common-names': [], 'emails': []} | +| identity | `{'common-names': [], 'emails': []}` | diff --git a/docs/configuration/rules/sbom/NTIA-compliance.md b/docs/configuration/rules/sbom/NTIA-compliance.md index f9c8513b1..602ef3c1b 100644 --- a/docs/configuration/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/rules/sbom/NTIA-compliance.md @@ -37,5 +37,5 @@ This rule scoped by product and target. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| required_author | {} | -| required_supplier | {} | +| required_author | `{}` | +| required_supplier | `{}` | diff --git a/docs/configuration/rules/sbom/artifact-signed.md b/docs/configuration/rules/sbom/artifact-signed.md index 970e504c4..fafb1089f 100644 --- a/docs/configuration/rules/sbom/artifact-signed.md +++ b/docs/configuration/rules/sbom/artifact-signed.md @@ -31,4 +31,4 @@ This rule scoped by product and target. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| identity | {'common-names': [], 'emails': []} | +| identity | `{'common-names': [], 'emails': []}` | diff --git a/docs/configuration/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/rules/slsa/l2-provenance-authenticated.md index 0f1687bf3..e94a7fb85 100644 --- a/docs/configuration/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/rules/slsa/l2-provenance-authenticated.md @@ -37,4 +37,4 @@ This rule scoped by product and target. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| identity | {'common-names': [], 'emails': []} | +| identity | `{'common-names': [], 'emails': []}` | From 2f611b821589d4d72f49d1c67bce3e0b67911a3d Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 11:55:54 +0200 Subject: [PATCH 067/191] tmp gen docs --- docs/configuration/rules/images/banned-ports.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/rules/images/banned-ports.md b/docs/configuration/rules/images/banned-ports.md index c6382e89c..6e1cad449 100644 --- a/docs/configuration/rules/images/banned-ports.md +++ b/docs/configuration/rules/images/banned-ports.md @@ -34,4 +34,4 @@ This rule scoped by target and product. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| banned_ports | [{'port': '3000', 'protocol': 'tcp'}] | +| banned_ports | ["`{'port': '3000', 'protocol': 'tcp'}`"] | From 7543f6c1b74edc6d7cd5611a9baf107043405b7b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 12:31:03 +0200 Subject: [PATCH 068/191] tmp gen docs --- docs/configuration/initiatives/bp1.md | 4 ++++ docs/configuration/initiatives/slsa.l1.md | 4 ++++ docs/configuration/initiatives/slsa.l2.md | 4 ++++ docs/configuration/initiatives/sp-800-190.md | 4 ++++ docs/configuration/initiatives/sp-800-53.md | 4 ++++ docs/configuration/initiatives/ssdf.md | 4 ++++ docs/configuration/rules/api/scribe-api-cve-product.md | 4 ++++ docs/configuration/rules/api/scribe-api-cve.md | 4 ++++ docs/configuration/rules/api/scribe-api-published.md | 4 ++++ docs/configuration/rules/api/scribe-api.md | 4 ++++ docs/configuration/rules/bitbucket/project/allow-admins.md | 4 ++++ docs/configuration/rules/bitbucket/project/allow-users.md | 4 ++++ .../rules/bitbucket/project/exposed-credentials.md | 4 ++++ .../rules/bitbucket/project/long-live-tokens.md | 4 ++++ .../configuration/rules/bitbucket/repository/allow-admins.md | 4 ++++ docs/configuration/rules/bitbucket/repository/allow-users.md | 4 ++++ .../rules/bitbucket/repository/branch-protection.md | 4 ++++ docs/configuration/rules/bitbucket/workspace/allow-admins.md | 4 ++++ docs/configuration/rules/bitbucket/workspace/allow-users.md | 4 ++++ docs/configuration/rules/dockerhub/token-expiration.md | 4 ++++ docs/configuration/rules/dockerhub/token-not-used.md | 4 ++++ docs/configuration/rules/generic/artifact-signed.md | 4 ++++ docs/configuration/rules/generic/evidence-exists.md | 4 ++++ docs/configuration/rules/generic/k8s-jailbreak.md | 4 ++++ docs/configuration/rules/generic/trivy-exists.md | 4 ++++ docs/configuration/rules/git/artifact-signed.md | 4 ++++ docs/configuration/rules/git/coding-permissions.md | 4 ++++ docs/configuration/rules/git/evidence-exists.md | 4 ++++ docs/configuration/rules/git/no-commit-to-main.md | 4 ++++ docs/configuration/rules/git/no-unsigned-commits.md | 4 ++++ docs/configuration/rules/github/api/branch-protection.md | 4 ++++ docs/configuration/rules/github/api/signed-commits-list.md | 4 ++++ docs/configuration/rules/github/api/signed-commits-range.md | 4 ++++ docs/configuration/rules/github/org/2fa.md | 4 ++++ docs/configuration/rules/github/org/advanced-security.md | 4 ++++ docs/configuration/rules/github/org/allow-admins.md | 4 ++++ docs/configuration/rules/github/org/allow-users.md | 4 ++++ docs/configuration/rules/github/org/create-private-repos.md | 4 ++++ docs/configuration/rules/github/org/create-repos.md | 4 ++++ docs/configuration/rules/github/org/dependabot-alerts.md | 4 ++++ .../rules/github/org/dependabot-security-updates-sa.md | 4 ++++ .../rules/github/org/dependabot-security-updates.md | 4 ++++ docs/configuration/rules/github/org/dependency-graph.md | 4 ++++ docs/configuration/rules/github/org/max-admins.md | 4 ++++ docs/configuration/rules/github/org/old-secrets.md | 4 ++++ docs/configuration/rules/github/org/pp-custom-link.md | 4 ++++ docs/configuration/rules/github/org/push-protection-sa.md | 4 ++++ docs/configuration/rules/github/org/push-protection.md | 5 +++++ docs/configuration/rules/github/org/repo-visibility.md | 4 ++++ docs/configuration/rules/github/org/secret-scanning-sa.md | 4 ++++ docs/configuration/rules/github/org/secret-scanning.md | 4 ++++ docs/configuration/rules/github/org/validity-checks-sa.md | 4 ++++ docs/configuration/rules/github/org/validity-checks.md | 4 ++++ docs/configuration/rules/github/org/web-commit-signoff.md | 4 ++++ .../rules/github/repository/branch-protection.md | 4 ++++ .../rules/github/repository/branch-verification.md | 4 ++++ .../rules/github/repository/check-signed-commits.md | 4 ++++ .../rules/github/repository/default-branch-protection.md | 4 ++++ docs/configuration/rules/github/repository/dependabot.md | 4 ++++ .../rules/github/repository/ephemeral-runners-only.md | 4 ++++ docs/configuration/rules/github/repository/no-cache-usage.md | 4 ++++ docs/configuration/rules/github/repository/no-org-secrets.md | 4 ++++ docs/configuration/rules/github/repository/old-secrets.md | 4 ++++ .../configuration/rules/github/repository/push-protection.md | 4 ++++ docs/configuration/rules/github/repository/repo-private.md | 4 ++++ .../configuration/rules/github/repository/secret-scanning.md | 4 ++++ docs/configuration/rules/github/repository/signed-commits.md | 4 ++++ .../configuration/rules/github/repository/validity-checks.md | 4 ++++ docs/configuration/rules/github/repository/visibility.md | 4 ++++ .../rules/github/repository/web-commit-signoff.md | 4 ++++ docs/configuration/rules/gitlab/api/push-rules.md | 4 ++++ docs/configuration/rules/gitlab/api/signed-commits-list.md | 4 ++++ docs/configuration/rules/gitlab/api/signed-commits-range.md | 4 ++++ docs/configuration/rules/gitlab/org/allow-admins.md | 4 ++++ docs/configuration/rules/gitlab/org/allow-token-scopes.md | 4 ++++ docs/configuration/rules/gitlab/org/allow-users.md | 4 ++++ docs/configuration/rules/gitlab/org/blocked-users.md | 4 ++++ docs/configuration/rules/gitlab/org/expiring-tokens.md | 4 ++++ docs/configuration/rules/gitlab/org/forbid-token-scopes.md | 4 ++++ docs/configuration/rules/gitlab/org/inactive-projects.md | 4 ++++ docs/configuration/rules/gitlab/org/longlive-tokens.md | 4 ++++ docs/configuration/rules/gitlab/org/max-admins.md | 4 ++++ docs/configuration/rules/gitlab/org/projects-visibility.md | 4 ++++ docs/configuration/rules/gitlab/org/unused-tokens.md | 4 ++++ .../rules/gitlab/pipeline/verify-labels-exist.md | 4 ++++ docs/configuration/rules/gitlab/pipeline/verify-labels.md | 4 ++++ docs/configuration/rules/gitlab/project/abandoned-project.md | 4 ++++ .../rules/gitlab/project/approvals-policy-check.md | 4 ++++ .../rules/gitlab/project/approvers-per-merge-request.md | 4 ++++ .../configuration/rules/gitlab/project/author-email-regex.md | 4 ++++ docs/configuration/rules/gitlab/project/check-cwe.md | 4 ++++ .../rules/gitlab/project/check-signed-commits.md | 4 ++++ .../rules/gitlab/project/co-approval-required.md | 4 ++++ .../rules/gitlab/project/commit-author-email-check.md | 4 ++++ .../rules/gitlab/project/commit-author-name-check.md | 4 ++++ .../rules/gitlab/project/commit-committer-check.md | 4 ++++ .../rules/gitlab/project/commit-message-check.md | 4 ++++ docs/configuration/rules/gitlab/project/commits-validated.md | 4 ++++ .../rules/gitlab/project/committer-email-check.md | 4 ++++ .../rules/gitlab/project/committer-name-check.md | 4 ++++ .../rules/gitlab/project/critical-severity-limit.md | 4 ++++ .../rules/gitlab/project/description-substring-check.md | 4 ++++ .../rules/gitlab/project/disallowed-banned-approvers.md | 4 ++++ .../rules/gitlab/project/force-push-protection.md | 4 ++++ .../rules/gitlab/project/medium-severity-limit.md | 4 ++++ docs/configuration/rules/gitlab/project/member-check.md | 4 ++++ .../configuration/rules/gitlab/project/merge-access-level.md | 4 ++++ .../rules/gitlab/project/merge-requests-author-approval.md | 4 ++++ .../project/merge-requests-disable-committers-approval.md | 4 ++++ .../rules/gitlab/project/message-substring-check.md | 4 ++++ .../rules/gitlab/project/prevent-secrets-check.md | 4 ++++ .../configuration/rules/gitlab/project/protect-ci-secrets.md | 4 ++++ docs/configuration/rules/gitlab/project/push-access-level.md | 4 ++++ docs/configuration/rules/gitlab/project/push-rules-set.md | 4 ++++ .../rules/gitlab/project/reject-unsigned-commits.md | 4 ++++ .../rules/gitlab/project/require-password-to-approve.md | 4 ++++ .../rules/gitlab/project/required-minimal-approvers.md | 4 ++++ .../rules/gitlab/project/reset-pprovals-on-push.md | 4 ++++ docs/configuration/rules/gitlab/project/sast-scan-pass.md | 4 ++++ docs/configuration/rules/gitlab/project/sast-scanning.md | 4 ++++ docs/configuration/rules/gitlab/project/secrets-scan-pass.md | 4 ++++ docs/configuration/rules/gitlab/project/secrets-scanning.md | 4 ++++ .../rules/gitlab/project/selective-code-owner-removals.md | 4 ++++ docs/configuration/rules/gitlab/project/visibility-check.md | 4 ++++ docs/configuration/rules/images/allowed-base-image.md | 4 ++++ docs/configuration/rules/images/allowed-image-source.md | 4 ++++ docs/configuration/rules/images/banned-ports.md | 4 ++++ docs/configuration/rules/images/banned-users.md | 4 ++++ docs/configuration/rules/images/blocklist-build-scripts.md | 4 ++++ docs/configuration/rules/images/blocklist-user.md | 4 ++++ docs/configuration/rules/images/enforce-https-registry.md | 4 ++++ docs/configuration/rules/images/forbid-large-images.md | 4 ++++ docs/configuration/rules/images/fresh-base-image.md | 4 ++++ docs/configuration/rules/images/fresh-image.md | 4 ++++ docs/configuration/rules/images/image-signed.md | 4 ++++ docs/configuration/rules/images/require-healthcheck.md | 4 ++++ docs/configuration/rules/images/restrict-shell-entrypoint.md | 4 ++++ docs/configuration/rules/images/verify-labels-exist.md | 4 ++++ docs/configuration/rules/images/verify-labels.md | 4 ++++ .../rules/jenkins/folder/exposed-credentials.md | 4 ++++ docs/configuration/rules/jenkins/instance/inactive-users.md | 4 ++++ docs/configuration/rules/jenkins/instance/unused-users.md | 4 ++++ docs/configuration/rules/k8s/namespace/allowed-images.md | 4 ++++ docs/configuration/rules/k8s/namespace/allowed-registries.md | 4 ++++ .../rules/k8s/namespace/verify-namespace-duration.md | 4 ++++ .../rules/k8s/namespace/verify-namespace-termination.md | 4 ++++ .../rules/k8s/namespace/white-listed-namespaces.md | 4 ++++ docs/configuration/rules/k8s/namespace/white-listed-pod.md | 4 ++++ docs/configuration/rules/k8s/pods/verify-pod-duration.md | 4 ++++ docs/configuration/rules/k8s/pods/verify-pod-termination.md | 4 ++++ docs/configuration/rules/k8s/pods/white-listed-pod.md | 4 ++++ docs/configuration/rules/multievidence/files_integrity.md | 4 ++++ docs/configuration/rules/sarif/artifact-signed.md | 4 ++++ docs/configuration/rules/sarif/evidence-exists.md | 4 ++++ docs/configuration/rules/sarif/patcheck/updates-needed.md | 4 ++++ docs/configuration/rules/sarif/report-iac-errors.md | 4 ++++ docs/configuration/rules/sarif/trivy/blocklist-cve.md | 4 ++++ .../rules/sarif/trivy/report-trivy-iac-errors.md | 4 ++++ docs/configuration/rules/sarif/trivy/verify-cve-severity.md | 4 ++++ .../rules/sarif/trivy/verify-trivy-attack-vector.md | 4 ++++ docs/configuration/rules/sarif/trivy/verify-trivy-report.md | 4 ++++ docs/configuration/rules/sarif/verify-attack-vector.md | 4 ++++ docs/configuration/rules/sarif/verify-sarif.md | 4 ++++ docs/configuration/rules/sarif/verify-semgrep-report.md | 4 ++++ docs/configuration/rules/sarif/verify-tool-evidence.md | 4 ++++ docs/configuration/rules/sbom/NTIA-compliance.md | 4 ++++ docs/configuration/rules/sbom/allowed-components.md | 4 ++++ docs/configuration/rules/sbom/artifact-signed.md | 4 ++++ docs/configuration/rules/sbom/banned-licenses.md | 4 ++++ docs/configuration/rules/sbom/blocklist-packages.md | 4 ++++ docs/configuration/rules/sbom/complete-licenses.md | 4 ++++ docs/configuration/rules/sbom/fresh-sbom.md | 4 ++++ docs/configuration/rules/sbom/require-sbom.md | 4 ++++ docs/configuration/rules/sbom/required-packages.md | 4 ++++ docs/configuration/rules/sbom/verify-huggingface-license.md | 4 ++++ docs/configuration/rules/slsa/banned-builder-deps.md | 4 ++++ docs/configuration/rules/slsa/build-time.md | 4 ++++ docs/configuration/rules/slsa/field-exists.md | 4 ++++ docs/configuration/rules/slsa/l1-provenance-exists.md | 4 ++++ docs/configuration/rules/slsa/l2-provenance-authenticated.md | 4 ++++ docs/configuration/rules/slsa/verify-builder.md | 4 ++++ docs/configuration/rules/slsa/verify-byproducts.md | 4 ++++ docs/configuration/rules/ssdf/ps-1-2fa.md | 4 ++++ docs/configuration/rules/ssdf/ps-1-branch-protection.md | 4 ++++ docs/configuration/rules/ssdf/ps-1-limit-admins.md | 4 ++++ docs/configuration/rules/ssdf/ps-1-repo-private.md | 4 ++++ docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md | 4 ++++ docs/configuration/rules/ssdf/ps-2-image-verifiable.md | 4 ++++ docs/configuration/rules/ssdf/ps-3.1-code-archived.md | 4 ++++ docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md | 4 ++++ 190 files changed, 761 insertions(+) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index f6b916047..75e2d0507 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Venafi Blueprint +title: Venafi Blueprint +--- # Venafi Blueprint **Type:** Initiative **ID:** `blueprint-securesoftwarepipeline` diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 6400b0cdc..559f15f01 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -1,3 +1,7 @@ +--- +sidebar_label: "SLSA L1 Framework\u201D" +title: "SLSA L1 Framework\u201D" +--- # SLSA L1 Framework” **Type:** Initiative **ID:** `SLSA.L1` diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index bfe0c0724..2ef4131ff 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -1,3 +1,7 @@ +--- +sidebar_label: "SLSA L2 Framework\u201D" +title: "SLSA L2 Framework\u201D" +--- # SLSA L2 Framework” **Type:** Initiative **ID:** `SLSA.L2` diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 6b4fb2f90..3745ccac7 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -1,3 +1,7 @@ +--- +sidebar_label: NIST Application Container Security Initiative +title: NIST Application Container Security Initiative +--- # NIST Application Container Security Initiative **Type:** Initiative **ID:** `SP-800-190` diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index d63cd2e05..2f598fcfa 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -1,3 +1,7 @@ +--- +sidebar_label: SP-800-53 Supply Chain Integrity Initiative +title: SP-800-53 Supply Chain Integrity Initiative +--- # SP-800-53 Supply Chain Integrity Initiative **Type:** Initiative **ID:** `SP-800-53` diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 22753fdea..1b8804c30 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -1,3 +1,7 @@ +--- +sidebar_label: SSDF Client Initiative +title: SSDF Client Initiative +--- # SSDF Client Initiative **Type:** Initiative **ID:** `SSDF` diff --git a/docs/configuration/rules/api/scribe-api-cve-product.md b/docs/configuration/rules/api/scribe-api-cve-product.md index efb9b3c3b..4d1d06ce8 100644 --- a/docs/configuration/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/rules/api/scribe-api-cve-product.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify No Critical or High Vulnerabilities in Product +title: Verify No Critical or High Vulnerabilities in Product +--- # Verify No Critical or High Vulnerabilities in Product **Type:** Rule **ID:** `scribe-cve-product` diff --git a/docs/configuration/rules/api/scribe-api-cve.md b/docs/configuration/rules/api/scribe-api-cve.md index 15ff3ef6c..1efc5d96b 100644 --- a/docs/configuration/rules/api/scribe-api-cve.md +++ b/docs/configuration/rules/api/scribe-api-cve.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify No Critical or High Vulnerabilities +title: Verify No Critical or High Vulnerabilities +--- # Verify No Critical or High Vulnerabilities **Type:** Rule **ID:** `scribe-cve` diff --git a/docs/configuration/rules/api/scribe-api-published.md b/docs/configuration/rules/api/scribe-api-published.md index 053e1a284..5b19ca170 100644 --- a/docs/configuration/rules/api/scribe-api-published.md +++ b/docs/configuration/rules/api/scribe-api-published.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Scribe Published Policy +title: Scribe Published Policy +--- # Scribe Published Policy **Type:** Rule **ID:** `scribe-published-policy` diff --git a/docs/configuration/rules/api/scribe-api.md b/docs/configuration/rules/api/scribe-api.md index a49c5005f..c8727eb73 100644 --- a/docs/configuration/rules/api/scribe-api.md +++ b/docs/configuration/rules/api/scribe-api.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Apply Scribe Template Policy +title: Apply Scribe Template Policy +--- # Apply Scribe Template Policy **Type:** Rule **ID:** `scribe-template` diff --git a/docs/configuration/rules/bitbucket/project/allow-admins.md b/docs/configuration/rules/bitbucket/project/allow-admins.md index c71b58135..9e78ad462 100644 --- a/docs/configuration/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/rules/bitbucket/project/allow-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Project Admins +title: Allowed Project Admins +--- # Allowed Project Admins **Type:** Rule **ID:** `bb-project-allowed-project-admins` diff --git a/docs/configuration/rules/bitbucket/project/allow-users.md b/docs/configuration/rules/bitbucket/project/allow-users.md index 73be01702..7b2a1de9b 100644 --- a/docs/configuration/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/rules/bitbucket/project/allow-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Project Users +title: Allowed Project Users +--- # Allowed Project Users **Type:** Rule **ID:** `bb-project-allowed-project-users` diff --git a/docs/configuration/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/rules/bitbucket/project/exposed-credentials.md index b8305a41b..ca00c12fe 100644 --- a/docs/configuration/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/rules/bitbucket/project/exposed-credentials.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Prevent Credential Exposure +title: Prevent Credential Exposure +--- # Prevent Credential Exposure **Type:** Rule **ID:** `bb-project-exposed-credentials` diff --git a/docs/configuration/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/rules/bitbucket/project/long-live-tokens.md index 608cc7c2a..750c0cdd2 100644 --- a/docs/configuration/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/rules/bitbucket/project/long-live-tokens.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Prevent Long-Lived Tokens +title: Prevent Long-Lived Tokens +--- # Prevent Long-Lived Tokens **Type:** Rule **ID:** `bb-project-long-live-tokens` diff --git a/docs/configuration/rules/bitbucket/repository/allow-admins.md b/docs/configuration/rules/bitbucket/repository/allow-admins.md index 27b709ff8..dd4ec2b5b 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/rules/bitbucket/repository/allow-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Repository Admins +title: Allowed Repository Admins +--- # Allowed Repository Admins **Type:** Rule **ID:** `bb-repo-allowed-repository-admins` diff --git a/docs/configuration/rules/bitbucket/repository/allow-users.md b/docs/configuration/rules/bitbucket/repository/allow-users.md index f3b326cd8..69a15ab68 100644 --- a/docs/configuration/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/rules/bitbucket/repository/allow-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Repository Users +title: Allowed Repository Users +--- # Allowed Repository Users **Type:** Rule **ID:** `bb-repo-allowed-repository-users` diff --git a/docs/configuration/rules/bitbucket/repository/branch-protection.md b/docs/configuration/rules/bitbucket/repository/branch-protection.md index 270bdc7c3..4a7576d62 100644 --- a/docs/configuration/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/rules/bitbucket/repository/branch-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Default Branch Protection Setting Is Configured +title: Verify Default Branch Protection Setting Is Configured +--- # Verify Default Branch Protection Setting Is Configured **Type:** Rule **ID:** `bb-repo-branch-protection` diff --git a/docs/configuration/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/rules/bitbucket/workspace/allow-admins.md index 10d05c685..14f85fa24 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Workspace Admins +title: Allowed Workspace Admins +--- # Allowed Workspace Admins **Type:** Rule **ID:** `bb-workspace-allowed-workspace-admins` diff --git a/docs/configuration/rules/bitbucket/workspace/allow-users.md b/docs/configuration/rules/bitbucket/workspace/allow-users.md index 7b51045ac..efcdf7244 100644 --- a/docs/configuration/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/rules/bitbucket/workspace/allow-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Workspace Users +title: Allowed Workspace Users +--- # Allowed Workspace Users **Type:** Rule **ID:** `bb-workspace-allowed-workspace-users` diff --git a/docs/configuration/rules/dockerhub/token-expiration.md b/docs/configuration/rules/dockerhub/token-expiration.md index 81c5255d0..88ff53833 100644 --- a/docs/configuration/rules/dockerhub/token-expiration.md +++ b/docs/configuration/rules/dockerhub/token-expiration.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify DockerHub Tokens are Active +title: Verify DockerHub Tokens are Active +--- # Verify DockerHub Tokens are Active **Type:** Rule **ID:** `dockerhub-token-expiration` diff --git a/docs/configuration/rules/dockerhub/token-not-used.md b/docs/configuration/rules/dockerhub/token-not-used.md index 300a5d84f..191cff830 100644 --- a/docs/configuration/rules/dockerhub/token-not-used.md +++ b/docs/configuration/rules/dockerhub/token-not-used.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify no unused Dockerhub +title: Verify no unused Dockerhub +--- # Verify no unused Dockerhub **Type:** Rule **ID:** `dockerhub-token-not-used` diff --git a/docs/configuration/rules/generic/artifact-signed.md b/docs/configuration/rules/generic/artifact-signed.md index 5258a9e8b..26b64c134 100644 --- a/docs/configuration/rules/generic/artifact-signed.md +++ b/docs/configuration/rules/generic/artifact-signed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Generic Artifact Signed +title: Generic Artifact Signed +--- # Generic Artifact Signed **Type:** Rule **ID:** `generic-artifact-signed` diff --git a/docs/configuration/rules/generic/evidence-exists.md b/docs/configuration/rules/generic/evidence-exists.md index b3c385546..ac9aa8213 100644 --- a/docs/configuration/rules/generic/evidence-exists.md +++ b/docs/configuration/rules/generic/evidence-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Required Generic Evidence Exists +title: Required Generic Evidence Exists +--- # Required Generic Evidence Exists **Type:** Rule **ID:** `generic-required-evidence` diff --git a/docs/configuration/rules/generic/k8s-jailbreak.md b/docs/configuration/rules/generic/k8s-jailbreak.md index 291a2f0c0..74459a677 100644 --- a/docs/configuration/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/rules/generic/k8s-jailbreak.md @@ -1,3 +1,7 @@ +--- +sidebar_label: K8s Jailbreak +title: K8s Jailbreak +--- # K8s Jailbreak **Type:** Rule **ID:** `k8s-jailbreak` diff --git a/docs/configuration/rules/generic/trivy-exists.md b/docs/configuration/rules/generic/trivy-exists.md index 2c5329e30..1c4dac501 100644 --- a/docs/configuration/rules/generic/trivy-exists.md +++ b/docs/configuration/rules/generic/trivy-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Required Trivy Evidence Exists +title: Required Trivy Evidence Exists +--- # Required Trivy Evidence Exists **Type:** Rule **ID:** `required-trivy-evidence` diff --git a/docs/configuration/rules/git/artifact-signed.md b/docs/configuration/rules/git/artifact-signed.md index 55eaf83d6..71c941f49 100644 --- a/docs/configuration/rules/git/artifact-signed.md +++ b/docs/configuration/rules/git/artifact-signed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Git Artifact Signed +title: Git Artifact Signed +--- # Git Artifact Signed **Type:** Rule **ID:** `git-artifact-signed` diff --git a/docs/configuration/rules/git/coding-permissions.md b/docs/configuration/rules/git/coding-permissions.md index db33bcefa..00d74c606 100644 --- a/docs/configuration/rules/git/coding-permissions.md +++ b/docs/configuration/rules/git/coding-permissions.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Coding Permissions +title: Restrict Coding Permissions +--- # Restrict Coding Permissions **Type:** Rule **ID:** `git-coding-permissions` diff --git a/docs/configuration/rules/git/evidence-exists.md b/docs/configuration/rules/git/evidence-exists.md index 8eccd9bd7..703890204 100644 --- a/docs/configuration/rules/git/evidence-exists.md +++ b/docs/configuration/rules/git/evidence-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Required Git Evidence Exists +title: Required Git Evidence Exists +--- # Required Git Evidence Exists **Type:** Rule **ID:** `required-git-evidence` diff --git a/docs/configuration/rules/git/no-commit-to-main.md b/docs/configuration/rules/git/no-commit-to-main.md index a8507cf9e..202ebd53e 100644 --- a/docs/configuration/rules/git/no-commit-to-main.md +++ b/docs/configuration/rules/git/no-commit-to-main.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Commits to Main Branch +title: Disallow Commits to Main Branch +--- # Disallow Commits to Main Branch **Type:** Rule **ID:** `git-disallow-commits-to-main` diff --git a/docs/configuration/rules/git/no-unsigned-commits.md b/docs/configuration/rules/git/no-unsigned-commits.md index af2c4f451..309d777da 100644 --- a/docs/configuration/rules/git/no-unsigned-commits.md +++ b/docs/configuration/rules/git/no-unsigned-commits.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Unsigned Commits +title: Disallow Unsigned Commits +--- # Disallow Unsigned Commits **Type:** Rule **ID:** `git-disallow-unsigned-commits` diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/rules/github/api/branch-protection.md index da040635f..9969cca39 100644 --- a/docs/configuration/rules/github/api/branch-protection.md +++ b/docs/configuration/rules/github/api/branch-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Branch protection enabled in GitHub repository +title: Branch protection enabled in GitHub repository +--- # Branch protection enabled in GitHub repository **Type:** Rule **ID:** `github-api-branch-protection` diff --git a/docs/configuration/rules/github/api/signed-commits-list.md b/docs/configuration/rules/github/api/signed-commits-list.md index 7a4c4a79d..16ba36cbb 100644 --- a/docs/configuration/rules/github/api/signed-commits-list.md +++ b/docs/configuration/rules/github/api/signed-commits-list.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Selected Commits Are Signed API +title: Verify Selected Commits Are Signed API +--- # Verify Selected Commits Are Signed API **Type:** Rule **ID:** `github-api-signed-commits-list` diff --git a/docs/configuration/rules/github/api/signed-commits-range.md b/docs/configuration/rules/github/api/signed-commits-range.md index d8bc6d5d8..cc93972f4 100644 --- a/docs/configuration/rules/github/api/signed-commits-range.md +++ b/docs/configuration/rules/github/api/signed-commits-range.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Unsigned Commits In Time Range +title: Disallow Unsigned Commits In Time Range +--- # Disallow Unsigned Commits In Time Range **Type:** Rule **ID:** `signed-commits-range` diff --git a/docs/configuration/rules/github/org/2fa.md b/docs/configuration/rules/github/org/2fa.md index f9946667d..7dbecb536 100644 --- a/docs/configuration/rules/github/org/2fa.md +++ b/docs/configuration/rules/github/org/2fa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify two_factor_requirement_enabled setting +title: Verify two_factor_requirement_enabled setting +--- # Verify two_factor_requirement_enabled setting **Type:** Rule **ID:** `github-org-2fa` diff --git a/docs/configuration/rules/github/org/advanced-security.md b/docs/configuration/rules/github/org/advanced-security.md index 45b38b2ef..91d4943ae 100644 --- a/docs/configuration/rules/github/org/advanced-security.md +++ b/docs/configuration/rules/github/org/advanced-security.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify advanced security setting is enabled +title: Verify advanced security setting is enabled +--- # Verify advanced security setting is enabled **Type:** Rule **ID:** `github-org-advanced-security` diff --git a/docs/configuration/rules/github/org/allow-admins.md b/docs/configuration/rules/github/org/allow-admins.md index c0ad8954b..9bcb0a995 100644 --- a/docs/configuration/rules/github/org/allow-admins.md +++ b/docs/configuration/rules/github/org/allow-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed GitHub Organization Admins +title: Allowed GitHub Organization Admins +--- # Allowed GitHub Organization Admins **Type:** Rule **ID:** `github-orgallowed-admins` diff --git a/docs/configuration/rules/github/org/allow-users.md b/docs/configuration/rules/github/org/allow-users.md index 889dc6604..663458467 100644 --- a/docs/configuration/rules/github/org/allow-users.md +++ b/docs/configuration/rules/github/org/allow-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed GitHub Organization Users +title: Allowed GitHub Organization Users +--- # Allowed GitHub Organization Users **Type:** Rule **ID:** `github-org-allowed-users` diff --git a/docs/configuration/rules/github/org/create-private-repos.md b/docs/configuration/rules/github/org/create-private-repos.md index 3909258bf..653cea7c1 100644 --- a/docs/configuration/rules/github/org/create-private-repos.md +++ b/docs/configuration/rules/github/org/create-private-repos.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify members_can_create_private_repositories setting +title: Verify members_can_create_private_repositories setting +--- # Verify members_can_create_private_repositories setting **Type:** Rule **ID:** `github-org-create-private-repos` diff --git a/docs/configuration/rules/github/org/create-repos.md b/docs/configuration/rules/github/org/create-repos.md index 35a44899a..4e1cd182e 100644 --- a/docs/configuration/rules/github/org/create-repos.md +++ b/docs/configuration/rules/github/org/create-repos.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify members_can_create_repositories setting +title: Verify members_can_create_repositories setting +--- # Verify members_can_create_repositories setting **Type:** Rule **ID:** `github-org-create-repos` diff --git a/docs/configuration/rules/github/org/dependabot-alerts.md b/docs/configuration/rules/github/org/dependabot-alerts.md index f749a0622..79bbfa454 100644 --- a/docs/configuration/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/rules/github/org/dependabot-alerts.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify dependabot_alerts_enabled_for_new_repositories setting +title: Verify dependabot_alerts_enabled_for_new_repositories setting +--- # Verify dependabot_alerts_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-alerts` diff --git a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md index 78128fee3..f50bc9aac 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates-sa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify dependabot_security_updates setting in security_and_analysis +title: Verify dependabot_security_updates setting in security_and_analysis +--- # Verify dependabot_security_updates setting in security_and_analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` diff --git a/docs/configuration/rules/github/org/dependabot-security-updates.md b/docs/configuration/rules/github/org/dependabot-security-updates.md index a234399e3..f9e81d19c 100644 --- a/docs/configuration/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/rules/github/org/dependabot-security-updates.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting +title: Verify dependabot_security_updates_enabled_for_new_repositories setting +--- # Verify dependabot_security_updates_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` diff --git a/docs/configuration/rules/github/org/dependency-graph.md b/docs/configuration/rules/github/org/dependency-graph.md index ce1e1024b..e354e7ffe 100644 --- a/docs/configuration/rules/github/org/dependency-graph.md +++ b/docs/configuration/rules/github/org/dependency-graph.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting +title: Verify dependency_graph_enabled_for_new_repositories setting +--- # Verify dependency_graph_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependency-graph` diff --git a/docs/configuration/rules/github/org/max-admins.md b/docs/configuration/rules/github/org/max-admins.md index dd5bf4ab5..ad5f39b55 100644 --- a/docs/configuration/rules/github/org/max-admins.md +++ b/docs/configuration/rules/github/org/max-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Limit Admin Number in GitHub Organization +title: Limit Admin Number in GitHub Organization +--- # Limit Admin Number in GitHub Organization **Type:** Rule **ID:** `github-org-max-admins` diff --git a/docs/configuration/rules/github/org/old-secrets.md b/docs/configuration/rules/github/org/old-secrets.md index bbff36fd7..d966083c7 100644 --- a/docs/configuration/rules/github/org/old-secrets.md +++ b/docs/configuration/rules/github/org/old-secrets.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify GitHub Organization Secrets Are Not Too Old +title: Verify GitHub Organization Secrets Are Not Too Old +--- # Verify GitHub Organization Secrets Are Not Too Old **Type:** Rule **ID:** `github-org-old-secrets` diff --git a/docs/configuration/rules/github/org/pp-custom-link.md b/docs/configuration/rules/github/org/pp-custom-link.md index c10c38025..abd94f896 100644 --- a/docs/configuration/rules/github/org/pp-custom-link.md +++ b/docs/configuration/rules/github/org/pp-custom-link.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +--- # Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting **Type:** Rule **ID:** `github-org-pp-custom-link` diff --git a/docs/configuration/rules/github/org/push-protection-sa.md b/docs/configuration/rules/github/org/push-protection-sa.md index 16248bbc4..b1c92961c 100644 --- a/docs/configuration/rules/github/org/push-protection-sa.md +++ b/docs/configuration/rules/github/org/push-protection-sa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection Setting +title: Verify Secret_Scanning_Push_Protection Setting +--- # Verify Secret_Scanning_Push_Protection Setting **Type:** Rule **ID:** `github-org-push-protection-sa` diff --git a/docs/configuration/rules/github/org/push-protection.md b/docs/configuration/rules/github/org/push-protection.md index 14d44c4f0..8ecc027e1 100644 --- a/docs/configuration/rules/github/org/push-protection.md +++ b/docs/configuration/rules/github/org/push-protection.md @@ -1,3 +1,8 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories + Setting +title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +--- # Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting **Type:** Rule **ID:** `github-org-push-protection` diff --git a/docs/configuration/rules/github/org/repo-visibility.md b/docs/configuration/rules/github/org/repo-visibility.md index c9959e630..634d98458 100644 --- a/docs/configuration/rules/github/org/repo-visibility.md +++ b/docs/configuration/rules/github/org/repo-visibility.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Repo Visibility Setting +title: Verify Repo Visibility Setting +--- # Verify Repo Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` diff --git a/docs/configuration/rules/github/org/secret-scanning-sa.md b/docs/configuration/rules/github/org/secret-scanning-sa.md index fc9a29180..46e9edec2 100644 --- a/docs/configuration/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/rules/github/org/secret-scanning-sa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Secret_Scanning Setting in Security_And_Analysis +title: Verify Secret_Scanning Setting in Security_And_Analysis +--- # Verify Secret_Scanning Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-secret-scanning-sa` diff --git a/docs/configuration/rules/github/org/secret-scanning.md b/docs/configuration/rules/github/org/secret-scanning.md index bba65eb2e..f7e6d6872 100644 --- a/docs/configuration/rules/github/org/secret-scanning.md +++ b/docs/configuration/rules/github/org/secret-scanning.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify secret_scanning_enabled_for_new_repositories setting +title: Verify secret_scanning_enabled_for_new_repositories setting +--- # Verify secret_scanning_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-secret-scanning` diff --git a/docs/configuration/rules/github/org/validity-checks-sa.md b/docs/configuration/rules/github/org/validity-checks-sa.md index f359428c2..be5c4b82e 100644 --- a/docs/configuration/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/rules/github/org/validity-checks-sa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +--- # Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-validity-checks-sa` diff --git a/docs/configuration/rules/github/org/validity-checks.md b/docs/configuration/rules/github/org/validity-checks.md index e36cb5efa..5c73e82ce 100644 --- a/docs/configuration/rules/github/org/validity-checks.md +++ b/docs/configuration/rules/github/org/validity-checks.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Secret_Scanning_Validity_Checks_Enabled Setting +title: Verify Secret_Scanning_Validity_Checks_Enabled Setting +--- # Verify Secret_Scanning_Validity_Checks_Enabled Setting **Type:** Rule **ID:** `github-org-validity-checks` diff --git a/docs/configuration/rules/github/org/web-commit-signoff.md b/docs/configuration/rules/github/org/web-commit-signoff.md index 179d6b5e9..a626c7778 100644 --- a/docs/configuration/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/rules/github/org/web-commit-signoff.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify GitHub Organization Requires Signoff on Web Commits +title: Verify GitHub Organization Requires Signoff on Web Commits +--- # Verify GitHub Organization Requires Signoff on Web Commits **Type:** Rule **ID:** `github-org-web-commit-signoff` diff --git a/docs/configuration/rules/github/repository/branch-protection.md b/docs/configuration/rules/github/repository/branch-protection.md index ec80bf2a6..b151c2bcd 100644 --- a/docs/configuration/rules/github/repository/branch-protection.md +++ b/docs/configuration/rules/github/repository/branch-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Branch Protection Setting +title: Verify Branch Protection Setting +--- # Verify Branch Protection Setting **Type:** Rule **ID:** `github-repo-branch-protection` diff --git a/docs/configuration/rules/github/repository/branch-verification.md b/docs/configuration/rules/github/repository/branch-verification.md index 36e6ffb45..cda89258e 100644 --- a/docs/configuration/rules/github/repository/branch-verification.md +++ b/docs/configuration/rules/github/repository/branch-verification.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Branch Verification Setting +title: Verify Branch Verification Setting +--- # Verify Branch Verification Setting **Type:** Rule **ID:** `github-repo-branch-verification` diff --git a/docs/configuration/rules/github/repository/check-signed-commits.md b/docs/configuration/rules/github/repository/check-signed-commits.md index 1ffa7ceb9..1b917f3c3 100644 --- a/docs/configuration/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/rules/github/repository/check-signed-commits.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify All Commits Are Signed in Repository +title: Verify All Commits Are Signed in Repository +--- # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` diff --git a/docs/configuration/rules/github/repository/default-branch-protection.md b/docs/configuration/rules/github/repository/default-branch-protection.md index 50b1b1633..e01292a21 100644 --- a/docs/configuration/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/rules/github/repository/default-branch-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Default Branch Protection +title: Verify Default Branch Protection +--- # Verify Default Branch Protection **Type:** Rule **ID:** `github-repo-default-branch-protection` diff --git a/docs/configuration/rules/github/repository/dependabot.md b/docs/configuration/rules/github/repository/dependabot.md index 3e08aa62b..ae031f906 100644 --- a/docs/configuration/rules/github/repository/dependabot.md +++ b/docs/configuration/rules/github/repository/dependabot.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Dependabot security updates setting +title: Verify Dependabot security updates setting +--- # Verify Dependabot security updates setting **Type:** Rule **ID:** `github-repo-dependabot` diff --git a/docs/configuration/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/rules/github/repository/ephemeral-runners-only.md index 2524a14cd..7daf18335 100644 --- a/docs/configuration/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/rules/github/repository/ephemeral-runners-only.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Only Ephemeral Runners Exist in Repository +title: Verify Only Ephemeral Runners Exist in Repository +--- # Verify Only Ephemeral Runners Exist in Repository **Type:** Rule **ID:** `github-repo-ephemeral-runners-only` diff --git a/docs/configuration/rules/github/repository/no-cache-usage.md b/docs/configuration/rules/github/repository/no-cache-usage.md index cda33f22e..f28922dbd 100644 --- a/docs/configuration/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/rules/github/repository/no-cache-usage.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify No Cache Usage Exists in Repository +title: Verify No Cache Usage Exists in Repository +--- # Verify No Cache Usage Exists in Repository **Type:** Rule **ID:** `github-repo-no-cache-usage` diff --git a/docs/configuration/rules/github/repository/no-org-secrets.md b/docs/configuration/rules/github/repository/no-org-secrets.md index 51017d85f..702b93aff 100644 --- a/docs/configuration/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/rules/github/repository/no-org-secrets.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify No Organization Secrets Exist in Repository +title: Verify No Organization Secrets Exist in Repository +--- # Verify No Organization Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-no-org-secrets` diff --git a/docs/configuration/rules/github/repository/old-secrets.md b/docs/configuration/rules/github/repository/old-secrets.md index 093ac71ae..093961ca6 100644 --- a/docs/configuration/rules/github/repository/old-secrets.md +++ b/docs/configuration/rules/github/repository/old-secrets.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify No Old Secrets Exist in Repository +title: Verify No Old Secrets Exist in Repository +--- # Verify No Old Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-old-secrets` diff --git a/docs/configuration/rules/github/repository/push-protection.md b/docs/configuration/rules/github/repository/push-protection.md index d1e5cfa5c..0d435df0d 100644 --- a/docs/configuration/rules/github/repository/push-protection.md +++ b/docs/configuration/rules/github/repository/push-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Push Protection Setting +title: Verify Push Protection Setting +--- # Verify Push Protection Setting **Type:** Rule **ID:** `github-repo-push-protection` diff --git a/docs/configuration/rules/github/repository/repo-private.md b/docs/configuration/rules/github/repository/repo-private.md index fcaf1599d..858975e77 100644 --- a/docs/configuration/rules/github/repository/repo-private.md +++ b/docs/configuration/rules/github/repository/repo-private.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Repository Is Private +title: Verify Repository Is Private +--- # Verify Repository Is Private **Type:** Rule **ID:** `github-repo-private` diff --git a/docs/configuration/rules/github/repository/secret-scanning.md b/docs/configuration/rules/github/repository/secret-scanning.md index 190724ad8..9f26fbfce 100644 --- a/docs/configuration/rules/github/repository/secret-scanning.md +++ b/docs/configuration/rules/github/repository/secret-scanning.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify secret_scanning setting +title: Verify secret_scanning setting +--- # Verify secret_scanning setting **Type:** Rule **ID:** `github-repo-secret-scanning` diff --git a/docs/configuration/rules/github/repository/signed-commits.md b/docs/configuration/rules/github/repository/signed-commits.md index 5f55a3e04..7d376281d 100644 --- a/docs/configuration/rules/github/repository/signed-commits.md +++ b/docs/configuration/rules/github/repository/signed-commits.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify All Commits Are Signed in Repository +title: Verify All Commits Are Signed in Repository +--- # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` diff --git a/docs/configuration/rules/github/repository/validity-checks.md b/docs/configuration/rules/github/repository/validity-checks.md index 5c09cb0b6..0f98d6d78 100644 --- a/docs/configuration/rules/github/repository/validity-checks.md +++ b/docs/configuration/rules/github/repository/validity-checks.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify secret scanning. +title: Verify secret scanning. +--- # Verify secret scanning. **Type:** Rule **ID:** `github-repo-validity-checks` diff --git a/docs/configuration/rules/github/repository/visibility.md b/docs/configuration/rules/github/repository/visibility.md index 4df249640..c5e33ee36 100644 --- a/docs/configuration/rules/github/repository/visibility.md +++ b/docs/configuration/rules/github/repository/visibility.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Public Repositories +title: Allowed Public Repositories +--- # Allowed Public Repositories **Type:** Rule **ID:** `github-repo-visibility` diff --git a/docs/configuration/rules/github/repository/web-commit-signoff.md b/docs/configuration/rules/github/repository/web-commit-signoff.md index 2cde4eb1b..fd4f84ee4 100644 --- a/docs/configuration/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/rules/github/repository/web-commit-signoff.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Repository Requires Commit Signoff +title: Verify Repository Requires Commit Signoff +--- # Verify Repository Requires Commit Signoff **Type:** Rule **ID:** `github-repo-web-commit-signoff` diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/rules/gitlab/api/push-rules.md index b071fb8c6..4568619b6 100644 --- a/docs/configuration/rules/gitlab/api/push-rules.md +++ b/docs/configuration/rules/gitlab/api/push-rules.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Set Push Rules in GitLab +title: Set Push Rules in GitLab +--- # Set Push Rules in GitLab **Type:** Rule **ID:** `gitlab-api-push-rules` diff --git a/docs/configuration/rules/gitlab/api/signed-commits-list.md b/docs/configuration/rules/gitlab/api/signed-commits-list.md index 3c0a8d311..0351a67e9 100644 --- a/docs/configuration/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/rules/gitlab/api/signed-commits-list.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Sign Selected Commits in GitLab +title: Sign Selected Commits in GitLab +--- # Sign Selected Commits in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-list` diff --git a/docs/configuration/rules/gitlab/api/signed-commits-range.md b/docs/configuration/rules/gitlab/api/signed-commits-range.md index 50aa9ff64..c3fa9cf89 100644 --- a/docs/configuration/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/rules/gitlab/api/signed-commits-range.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Sign Selected Commit Range in GitLab +title: Sign Selected Commit Range in GitLab +--- # Sign Selected Commit Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` diff --git a/docs/configuration/rules/gitlab/org/allow-admins.md b/docs/configuration/rules/gitlab/org/allow-admins.md index b5a1d6be3..9203cf6cb 100644 --- a/docs/configuration/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/rules/gitlab/org/allow-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Admins in GitLab Organization +title: Allowed Admins in GitLab Organization +--- # Allowed Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-admins` diff --git a/docs/configuration/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/rules/gitlab/org/allow-token-scopes.md index 4b5674e7e..ba6b7e095 100644 --- a/docs/configuration/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/allow-token-scopes.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Token Scopes in GitLab +title: Restrict Token Scopes in GitLab +--- # Restrict Token Scopes in GitLab **Type:** Rule **ID:** `gitlab-org-allowed-token-scope` diff --git a/docs/configuration/rules/gitlab/org/allow-users.md b/docs/configuration/rules/gitlab/org/allow-users.md index 3c4d8ebb0..2dd5f7cbd 100644 --- a/docs/configuration/rules/gitlab/org/allow-users.md +++ b/docs/configuration/rules/gitlab/org/allow-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Users in GitLab Organization +title: Allowed Users in GitLab Organization +--- # Allowed Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-users` diff --git a/docs/configuration/rules/gitlab/org/blocked-users.md b/docs/configuration/rules/gitlab/org/blocked-users.md index 98b737e53..e4927d179 100644 --- a/docs/configuration/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/rules/gitlab/org/blocked-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Block Users in GitLab Organization +title: Block Users in GitLab Organization +--- # Block Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-blocked-users` diff --git a/docs/configuration/rules/gitlab/org/expiring-tokens.md b/docs/configuration/rules/gitlab/org/expiring-tokens.md index 1f5579083..ff5a7a012 100644 --- a/docs/configuration/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/rules/gitlab/org/expiring-tokens.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Prevent Token Expiration in GitLab Organization +title: Prevent Token Expiration in GitLab Organization +--- # Prevent Token Expiration in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-about-to-expire` diff --git a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md index 88abd688b..c8c818534 100644 --- a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/rules/gitlab/org/forbid-token-scopes.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Forbid Token Scopes in GitLab Organization +title: Forbid Token Scopes in GitLab Organization +--- # Forbid Token Scopes in GitLab Organization **Type:** Rule **ID:** `gitlab-org-disallowed-token-scope` diff --git a/docs/configuration/rules/gitlab/org/inactive-projects.md b/docs/configuration/rules/gitlab/org/inactive-projects.md index 6af0640a6..bfb0d83ab 100644 --- a/docs/configuration/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/rules/gitlab/org/inactive-projects.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Ensure Active Projects in GitLab Organization +title: Ensure Active Projects in GitLab Organization +--- # Ensure Active Projects in GitLab Organization **Type:** Rule **ID:** `gitlab-org-inactive-projects` diff --git a/docs/configuration/rules/gitlab/org/longlive-tokens.md b/docs/configuration/rules/gitlab/org/longlive-tokens.md index 052fed38c..2f1aa2027 100644 --- a/docs/configuration/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/rules/gitlab/org/longlive-tokens.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Forbid Long-Lived Tokens in GitLab Organization +title: Forbid Long-Lived Tokens in GitLab Organization +--- # Forbid Long-Lived Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-excessive-lifespan` diff --git a/docs/configuration/rules/gitlab/org/max-admins.md b/docs/configuration/rules/gitlab/org/max-admins.md index 790ed3040..b7d2a23c9 100644 --- a/docs/configuration/rules/gitlab/org/max-admins.md +++ b/docs/configuration/rules/gitlab/org/max-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Limit Admins in GitLab Organization +title: Limit Admins in GitLab Organization +--- # Limit Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-max-admins` diff --git a/docs/configuration/rules/gitlab/org/projects-visibility.md b/docs/configuration/rules/gitlab/org/projects-visibility.md index 9a39b7c7c..7535adcb1 100644 --- a/docs/configuration/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/rules/gitlab/org/projects-visibility.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Public Visibility in GitLab Organization +title: Restrict Public Visibility in GitLab Organization +--- # Restrict Public Visibility in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-visible-projects` diff --git a/docs/configuration/rules/gitlab/org/unused-tokens.md b/docs/configuration/rules/gitlab/org/unused-tokens.md index 6de1beb8c..e18a2f912 100644 --- a/docs/configuration/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/rules/gitlab/org/unused-tokens.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Forbid Unused Tokens in GitLab Organization +title: Forbid Unused Tokens in GitLab Organization +--- # Forbid Unused Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-unused-tokens` diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md index 207da9774..87d2cff4e 100644 --- a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md @@ -1,3 +1,7 @@ +--- +sidebar_label: GitLab pipeline verify labels exist +title: GitLab pipeline verify labels exist +--- # GitLab pipeline verify labels exist **Type:** Rule **ID:** `gitlab-pipeline-verify-labels-exist` diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/rules/gitlab/pipeline/verify-labels.md index 1defbd8c9..d1e9a38b5 100644 --- a/docs/configuration/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/rules/gitlab/pipeline/verify-labels.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify GitLab Pipeline Labels +title: Verify GitLab Pipeline Labels +--- # Verify GitLab Pipeline Labels **Type:** Rule **ID:** `gitlab-pipeline-verify-labels` diff --git a/docs/configuration/rules/gitlab/project/abandoned-project.md b/docs/configuration/rules/gitlab/project/abandoned-project.md index 0d02c04a5..822107c1b 100644 --- a/docs/configuration/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/rules/gitlab/project/abandoned-project.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Project Activity +title: Verify Project Activity +--- # Verify Project Activity **Type:** Rule **ID:** `gitlab-project-abandoned-project` diff --git a/docs/configuration/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/rules/gitlab/project/approvals-policy-check.md index a5ea48577..dec31fe55 100644 --- a/docs/configuration/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/rules/gitlab/project/approvals-policy-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Merge approval policy check for GitLab project +title: Merge approval policy check for GitLab project +--- # Merge approval policy check for GitLab project **Type:** Rule **ID:** `gitlab-project-merge-approval` diff --git a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md index 42799c0f4..0d05733b5 100644 --- a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Approvers Per Merge Request +title: Restrict Approvers Per Merge Request +--- # Restrict Approvers Per Merge Request **Type:** Rule **ID:** `gitlab-project-approvers-per-merge-request` diff --git a/docs/configuration/rules/gitlab/project/author-email-regex.md b/docs/configuration/rules/gitlab/project/author-email-regex.md index b51afde13..f392841a9 100644 --- a/docs/configuration/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/rules/gitlab/project/author-email-regex.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Set Author Email Regex in GitLab Project +title: Set Author Email Regex in GitLab Project +--- # Set Author Email Regex in GitLab Project **Type:** Rule **ID:** `gitlab-project-author-email-regex` diff --git a/docs/configuration/rules/gitlab/project/check-cwe.md b/docs/configuration/rules/gitlab/project/check-cwe.md index 7f5675dc6..c455ed1a8 100644 --- a/docs/configuration/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/rules/gitlab/project/check-cwe.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Check CWE Compliance +title: Check CWE Compliance +--- # Check CWE Compliance **Type:** Rule **ID:** `gitlab-project-check-cwe` diff --git a/docs/configuration/rules/gitlab/project/check-signed-commits.md b/docs/configuration/rules/gitlab/project/check-signed-commits.md index adfe9bdf2..7b01ae940 100644 --- a/docs/configuration/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/rules/gitlab/project/check-signed-commits.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Ensure All Commits Are Signed in GitLab Project +title: Ensure All Commits Are Signed in GitLab Project +--- # Ensure All Commits Are Signed in GitLab Project **Type:** Rule **ID:** `gitlab-project-signed-commits` diff --git a/docs/configuration/rules/gitlab/project/co-approval-required.md b/docs/configuration/rules/gitlab/project/co-approval-required.md index cd64db427..883e6660a 100644 --- a/docs/configuration/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/rules/gitlab/project/co-approval-required.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Code Owner Approval in GitLab Project +title: Require Code Owner Approval in GitLab Project +--- # Require Code Owner Approval in GitLab Project **Type:** Rule **ID:** `gitlab-project-code-owner-approval` diff --git a/docs/configuration/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/rules/gitlab/project/commit-author-email-check.md index a5ef63703..6cb9a96db 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-email-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Commit Authors in GitLab Project +title: Restrict Commit Authors in GitLab Project +--- # Restrict Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-authors` diff --git a/docs/configuration/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/rules/gitlab/project/commit-author-name-check.md index 723027cd5..77ddbbee8 100644 --- a/docs/configuration/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/rules/gitlab/project/commit-author-name-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Commit Authors in GitLab Project +title: Allowed Commit Authors in GitLab Project +--- # Allowed Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-author-names` diff --git a/docs/configuration/rules/gitlab/project/commit-committer-check.md b/docs/configuration/rules/gitlab/project/commit-committer-check.md index 09f069ca5..aaee5d375 100644 --- a/docs/configuration/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/rules/gitlab/project/commit-committer-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enable Commit Committer Check in GitLab Project +title: Enable Commit Committer Check in GitLab Project +--- # Enable Commit Committer Check in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-commit_committer_check` diff --git a/docs/configuration/rules/gitlab/project/commit-message-check.md b/docs/configuration/rules/gitlab/project/commit-message-check.md index 56eba70d6..cefdfeaf1 100644 --- a/docs/configuration/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/rules/gitlab/project/commit-message-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Commit Message Format +title: Verify Commit Message Format +--- # Verify Commit Message Format **Type:** Rule **ID:** `gitlab-project-verify-commit_message_check` diff --git a/docs/configuration/rules/gitlab/project/commits-validated.md b/docs/configuration/rules/gitlab/project/commits-validated.md index eca72e964..282e868d4 100644 --- a/docs/configuration/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/rules/gitlab/project/commits-validated.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Validate All Commits in GitLab Project +title: Validate All Commits in GitLab Project +--- # Validate All Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-all-commits-validated` diff --git a/docs/configuration/rules/gitlab/project/committer-email-check.md b/docs/configuration/rules/gitlab/project/committer-email-check.md index 1d1a40e08..f05b04097 100644 --- a/docs/configuration/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/rules/gitlab/project/committer-email-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Committer Emails in GitLab Project +title: Allowed Committer Emails in GitLab Project +--- # Allowed Committer Emails in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-emails` diff --git a/docs/configuration/rules/gitlab/project/committer-name-check.md b/docs/configuration/rules/gitlab/project/committer-name-check.md index 8b3c7c5f2..e79525ed6 100644 --- a/docs/configuration/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/rules/gitlab/project/committer-name-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Committer Names in GitLab Project +title: Allowed Committer Names in GitLab Project +--- # Allowed Committer Names in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-names` diff --git a/docs/configuration/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/rules/gitlab/project/critical-severity-limit.md index 8f827009a..18cb905dd 100644 --- a/docs/configuration/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/critical-severity-limit.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce Critical Severity Limit +title: Enforce Critical Severity Limit +--- # Enforce Critical Severity Limit **Type:** Rule **ID:** `gitlab-project-critical-severity-limit` diff --git a/docs/configuration/rules/gitlab/project/description-substring-check.md b/docs/configuration/rules/gitlab/project/description-substring-check.md index fa496068d..e8ee10843 100644 --- a/docs/configuration/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/rules/gitlab/project/description-substring-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Check Description Substring +title: Check Description Substring +--- # Check Description Substring **Type:** Rule **ID:** `gitlab-project-description-substring-check` diff --git a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md index d8368c618..bd500fe48 100644 --- a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Banned Approvers +title: Disallow Banned Approvers +--- # Disallow Banned Approvers **Type:** Rule **ID:** `gitlab-project-disallowed-banned-approvers` diff --git a/docs/configuration/rules/gitlab/project/force-push-protection.md b/docs/configuration/rules/gitlab/project/force-push-protection.md index 29afc45c0..f0123c3cc 100644 --- a/docs/configuration/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/rules/gitlab/project/force-push-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Force Push in GitLab Project +title: Disallow Force Push in GitLab Project +--- # Disallow Force Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-force-push` diff --git a/docs/configuration/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/rules/gitlab/project/medium-severity-limit.md index bd9d1ba82..5290d13a5 100644 --- a/docs/configuration/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/rules/gitlab/project/medium-severity-limit.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce Medium Severity Limit +title: Enforce Medium Severity Limit +--- # Enforce Medium Severity Limit **Type:** Rule **ID:** `gitlab-project-medium-severity-limit` diff --git a/docs/configuration/rules/gitlab/project/member-check.md b/docs/configuration/rules/gitlab/project/member-check.md index da294c8c3..baf341a35 100644 --- a/docs/configuration/rules/gitlab/project/member-check.md +++ b/docs/configuration/rules/gitlab/project/member-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enable Member Check for GitLab Project +title: Enable Member Check for GitLab Project +--- # Enable Member Check for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-member_check` diff --git a/docs/configuration/rules/gitlab/project/merge-access-level.md b/docs/configuration/rules/gitlab/project/merge-access-level.md index b2537a09d..49dbaa21b 100644 --- a/docs/configuration/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/rules/gitlab/project/merge-access-level.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce Merge Access Level Policy for GitLab Project +title: Enforce Merge Access Level Policy for GitLab Project +--- # Enforce Merge Access Level Policy for GitLab Project **Type:** Rule **ID:** `gitlab-project-merge-access-level` diff --git a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md index 3d12577ea..3168df905 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disable Author Approval for Merge Requests in GitLab +title: Disable Author Approval for Merge Requests in GitLab +--- # Disable Author Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-author-approval` diff --git a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md index fa091dc0e..bd696985b 100644 --- a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disable Committers' Approval for Merge Requests in GitLab +title: Disable Committers' Approval for Merge Requests in GitLab +--- # Disable Committers' Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-disable-committers-approval` diff --git a/docs/configuration/rules/gitlab/project/message-substring-check.md b/docs/configuration/rules/gitlab/project/message-substring-check.md index 64b43ea90..cce5d2382 100644 --- a/docs/configuration/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/rules/gitlab/project/message-substring-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Check Message Substring +title: Check Message Substring +--- # Check Message Substring **Type:** Rule **ID:** `gitlab-project-message-substring-check` diff --git a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md index ff78bcbb5..b16b5f928 100644 --- a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/rules/gitlab/project/prevent-secrets-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enable Secrets Prevention in GitLab Project +title: Enable Secrets Prevention in GitLab Project +--- # Enable Secrets Prevention in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-prevent_secrets` diff --git a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md index 221391cbd..3139d2be5 100644 --- a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/rules/gitlab/project/protect-ci-secrets.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Protect CI Secrets in GitLab Project +title: Protect CI Secrets in GitLab Project +--- # Protect CI Secrets in GitLab Project **Type:** Rule **ID:** `gitlab-project-protect-ci-secrets` diff --git a/docs/configuration/rules/gitlab/project/push-access-level.md b/docs/configuration/rules/gitlab/project/push-access-level.md index a64ab8bb9..b4cdb2eaa 100644 --- a/docs/configuration/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/rules/gitlab/project/push-access-level.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Set Push Access Level in GitLab Project +title: Set Push Access Level in GitLab Project +--- # Set Push Access Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-push-access-level` diff --git a/docs/configuration/rules/gitlab/project/push-rules-set.md b/docs/configuration/rules/gitlab/project/push-rules-set.md index 27d9f0b84..5a065fa2c 100644 --- a/docs/configuration/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/rules/gitlab/project/push-rules-set.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Set Push Rules for GitLab Project +title: Set Push Rules for GitLab Project +--- # Set Push Rules for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-push_rules` diff --git a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md index ba68d448d..d5f75f024 100644 --- a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Reject Unsigned Commits in GitLab Project +title: Reject Unsigned Commits in GitLab Project +--- # Reject Unsigned Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-unsigned-commits` diff --git a/docs/configuration/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/rules/gitlab/project/require-password-to-approve.md index 3e3eff855..d285598d7 100644 --- a/docs/configuration/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/rules/gitlab/project/require-password-to-approve.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Password for Approvals in GitLab Project +title: Require Password for Approvals in GitLab Project +--- # Require Password for Approvals in GitLab Project **Type:** Rule **ID:** `gitlab-project-require-password-to-approve` diff --git a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md index df614a427..5c206fbd2 100644 --- a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/rules/gitlab/project/required-minimal-approvers.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Minimal Approvers in GitLab Project +title: Require Minimal Approvers in GitLab Project +--- # Require Minimal Approvers in GitLab Project **Type:** Rule **ID:** `gitlab-project-required-minimal-approvers` diff --git a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md index 23da81179..42bd29657 100644 --- a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Reset Approvals on Push in GitLab Project +title: Reset Approvals on Push in GitLab Project +--- # Reset Approvals on Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-reset-pprovals-on-push` diff --git a/docs/configuration/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/rules/gitlab/project/sast-scan-pass.md index cd02de6b1..629f5107a 100644 --- a/docs/configuration/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/sast-scan-pass.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Ensure SAST Scanning Passes +title: Ensure SAST Scanning Passes +--- # Ensure SAST Scanning Passes **Type:** Rule **ID:** `gitlab-project-sast-scan-pass` diff --git a/docs/configuration/rules/gitlab/project/sast-scanning.md b/docs/configuration/rules/gitlab/project/sast-scanning.md index d4640948b..5fe1bf89a 100644 --- a/docs/configuration/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/rules/gitlab/project/sast-scanning.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Run SAST Scanning in GitLab Project +title: Run SAST Scanning in GitLab Project +--- # Run SAST Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-sast-scanning` diff --git a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md index 483024787..31246e5eb 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/rules/gitlab/project/secrets-scan-pass.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Ensure Secrets Scanning Passes +title: Ensure Secrets Scanning Passes +--- # Ensure Secrets Scanning Passes **Type:** Rule **ID:** `gitlab-project-secrets-scan-pass` diff --git a/docs/configuration/rules/gitlab/project/secrets-scanning.md b/docs/configuration/rules/gitlab/project/secrets-scanning.md index 284c27fbe..e55f6e3a1 100644 --- a/docs/configuration/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/rules/gitlab/project/secrets-scanning.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Run Secrets Scanning in GitLab Project +title: Run Secrets Scanning in GitLab Project +--- # Run Secrets Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-secrets-scanning` diff --git a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md index f1e1d1cbb..cc7c9c6f0 100644 --- a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Selective Code Owner Removals in GitLab +title: Restrict Selective Code Owner Removals in GitLab +--- # Restrict Selective Code Owner Removals in GitLab **Type:** Rule **ID:** `gitlab-project-selective-code-owner-removals` diff --git a/docs/configuration/rules/gitlab/project/visibility-check.md b/docs/configuration/rules/gitlab/project/visibility-check.md index a500cf78e..d4de049f0 100644 --- a/docs/configuration/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/rules/gitlab/project/visibility-check.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Set Visibility Level in GitLab Project +title: Set Visibility Level in GitLab Project +--- # Set Visibility Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-project-visibility-level` diff --git a/docs/configuration/rules/images/allowed-base-image.md b/docs/configuration/rules/images/allowed-base-image.md index 998d621ec..b08c62910 100644 --- a/docs/configuration/rules/images/allowed-base-image.md +++ b/docs/configuration/rules/images/allowed-base-image.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Base Image +title: Allowed Base Image +--- # Allowed Base Image **Type:** Rule **ID:** `images-allowed-base-image` diff --git a/docs/configuration/rules/images/allowed-image-source.md b/docs/configuration/rules/images/allowed-image-source.md index 476885d59..0e23efdbc 100644 --- a/docs/configuration/rules/images/allowed-image-source.md +++ b/docs/configuration/rules/images/allowed-image-source.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Main Image Source +title: Allowed Main Image Source +--- # Allowed Main Image Source **Type:** Rule **ID:** `images-allowed-image-source` diff --git a/docs/configuration/rules/images/banned-ports.md b/docs/configuration/rules/images/banned-ports.md index 6e1cad449..9c2395483 100644 --- a/docs/configuration/rules/images/banned-ports.md +++ b/docs/configuration/rules/images/banned-ports.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Banned Ports +title: Banned Ports +--- # Banned Ports **Type:** Rule **ID:** `images-banned-ports` diff --git a/docs/configuration/rules/images/banned-users.md b/docs/configuration/rules/images/banned-users.md index 9359114e2..090a21919 100644 --- a/docs/configuration/rules/images/banned-users.md +++ b/docs/configuration/rules/images/banned-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Specific Users in SBOM +title: Disallow Specific Users in SBOM +--- # Disallow Specific Users in SBOM **Type:** Rule **ID:** `sbom-disallowed-users` diff --git a/docs/configuration/rules/images/blocklist-build-scripts.md b/docs/configuration/rules/images/blocklist-build-scripts.md index 67549ea69..9acd673fc 100644 --- a/docs/configuration/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/rules/images/blocklist-build-scripts.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Build Scripts +title: Restrict Build Scripts +--- # Restrict Build Scripts **Type:** Rule **ID:** `images-disallowed-build-script` diff --git a/docs/configuration/rules/images/blocklist-user.md b/docs/configuration/rules/images/blocklist-user.md index 47b9b1a1b..9acd11cac 100644 --- a/docs/configuration/rules/images/blocklist-user.md +++ b/docs/configuration/rules/images/blocklist-user.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Blocklist Container User +title: Blocklist Container User +--- # Blocklist Container User **Type:** Rule **ID:** `images-blocklist-user` diff --git a/docs/configuration/rules/images/enforce-https-registry.md b/docs/configuration/rules/images/enforce-https-registry.md index 72c30d728..27d3fe657 100644 --- a/docs/configuration/rules/images/enforce-https-registry.md +++ b/docs/configuration/rules/images/enforce-https-registry.md @@ -1,3 +1,7 @@ +--- +sidebar_label: 4.2.1 Registry Connection HTTPS +title: 4.2.1 Registry Connection HTTPS +--- # 4.2.1 Registry Connection HTTPS **Type:** Rule **ID:** `images-registry-https-check` diff --git a/docs/configuration/rules/images/forbid-large-images.md b/docs/configuration/rules/images/forbid-large-images.md index 7cc295c4a..affd0ec06 100644 --- a/docs/configuration/rules/images/forbid-large-images.md +++ b/docs/configuration/rules/images/forbid-large-images.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Forbid Large Images +title: Forbid Large Images +--- # Forbid Large Images **Type:** Rule **ID:** `images-project-large-image` diff --git a/docs/configuration/rules/images/fresh-base-image.md b/docs/configuration/rules/images/fresh-base-image.md index a83911f12..9c2e81906 100644 --- a/docs/configuration/rules/images/fresh-base-image.md +++ b/docs/configuration/rules/images/fresh-base-image.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Fresh Base Image +title: Fresh Base Image +--- # Fresh Base Image **Type:** Rule **ID:** `images-fresh-base-image` diff --git a/docs/configuration/rules/images/fresh-image.md b/docs/configuration/rules/images/fresh-image.md index 7f5888689..04c6fb2ad 100644 --- a/docs/configuration/rules/images/fresh-image.md +++ b/docs/configuration/rules/images/fresh-image.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Fresh Image +title: Fresh Image +--- # Fresh Image **Type:** Rule **ID:** `fresh-image` diff --git a/docs/configuration/rules/images/image-signed.md b/docs/configuration/rules/images/image-signed.md index 8299000c9..00ea6470b 100644 --- a/docs/configuration/rules/images/image-signed.md +++ b/docs/configuration/rules/images/image-signed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Signed Container Image +title: Require Signed Container Image +--- # Require Signed Container Image **Type:** Rule **ID:** `images-require-signed-image` diff --git a/docs/configuration/rules/images/require-healthcheck.md b/docs/configuration/rules/images/require-healthcheck.md index 6df4034d3..dd8b6e0c4 100644 --- a/docs/configuration/rules/images/require-healthcheck.md +++ b/docs/configuration/rules/images/require-healthcheck.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Healthcheck +title: Require Healthcheck +--- # Require Healthcheck **Type:** Rule **ID:** `images-require-healthcheck` diff --git a/docs/configuration/rules/images/restrict-shell-entrypoint.md b/docs/configuration/rules/images/restrict-shell-entrypoint.md index 7d6b6f7d2..afc93b91e 100644 --- a/docs/configuration/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/rules/images/restrict-shell-entrypoint.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Container Shell Entrypoint +title: Disallow Container Shell Entrypoint +--- # Disallow Container Shell Entrypoint **Type:** Rule **ID:** `images-disallow-shell-access` diff --git a/docs/configuration/rules/images/verify-labels-exist.md b/docs/configuration/rules/images/verify-labels-exist.md index a5c6524de..0aa302739 100644 --- a/docs/configuration/rules/images/verify-labels-exist.md +++ b/docs/configuration/rules/images/verify-labels-exist.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Image Labels +title: Require Image Labels +--- # Require Image Labels **Type:** Rule **ID:** `required-image-labels` diff --git a/docs/configuration/rules/images/verify-labels.md b/docs/configuration/rules/images/verify-labels.md index bb0ab06cd..93456a6b7 100644 --- a/docs/configuration/rules/images/verify-labels.md +++ b/docs/configuration/rules/images/verify-labels.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Image Labels +title: Verify Image Labels +--- # Verify Image Labels **Type:** Rule **ID:** `image-labels` diff --git a/docs/configuration/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/rules/jenkins/folder/exposed-credentials.md index 8b13a1869..b582394dc 100644 --- a/docs/configuration/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/rules/jenkins/folder/exposed-credentials.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Exposed Credentials +title: Verify Exposed Credentials +--- # Verify Exposed Credentials **Type:** Rule **ID:** `jenkins-exposed-credentials` diff --git a/docs/configuration/rules/jenkins/instance/inactive-users.md b/docs/configuration/rules/jenkins/instance/inactive-users.md index 47cb2d449..6f3bf5c5d 100644 --- a/docs/configuration/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/rules/jenkins/instance/inactive-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Inactive Users +title: Verify Inactive Users +--- # Verify Inactive Users **Type:** Rule **ID:** `jenkins-inactive-users` diff --git a/docs/configuration/rules/jenkins/instance/unused-users.md b/docs/configuration/rules/jenkins/instance/unused-users.md index 14b350f74..5901ab90e 100644 --- a/docs/configuration/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/rules/jenkins/instance/unused-users.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow Unused Users +title: Disallow Unused Users +--- # Disallow Unused Users **Type:** Rule **ID:** `jenkins-unused-users` diff --git a/docs/configuration/rules/k8s/namespace/allowed-images.md b/docs/configuration/rules/k8s/namespace/allowed-images.md index f913cf99c..b0f8b0436 100644 --- a/docs/configuration/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/rules/k8s/namespace/allowed-images.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Container Images +title: Allowed Container Images +--- # Allowed Container Images **Type:** Rule **ID:** `k8s-namespace-blocked-images` diff --git a/docs/configuration/rules/k8s/namespace/allowed-registries.md b/docs/configuration/rules/k8s/namespace/allowed-registries.md index bc57638e5..d78437bd7 100644 --- a/docs/configuration/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/rules/k8s/namespace/allowed-registries.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Namespace Registries +title: Allowed Namespace Registries +--- # Allowed Namespace Registries **Type:** Rule **ID:** `k8s-namespace-allowed-registries` diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md index 8c2573d3d..6850c3c11 100644 --- a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Namespace Runtime Duration +title: Verify Namespace Runtime Duration +--- # Verify Namespace Runtime Duration **Type:** Rule **ID:** `k8s-namespace-verify-namespace-duration` diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md index b94e1c379..ac65b1b8d 100644 --- a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Namespace Termination +title: Verify Namespace Termination +--- # Verify Namespace Termination **Type:** Rule **ID:** `k8s-namespace-verify-namespace-termination` diff --git a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md index 1fde0e5df..cb452f4c7 100644 --- a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Namespaces +title: Allowed Namespaces +--- # Allowed Namespaces **Type:** Rule **ID:** `k8s-namespace-white-listed-namespaces` diff --git a/docs/configuration/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/rules/k8s/namespace/white-listed-pod.md index d9a0a3234..18e9f2c70 100644 --- a/docs/configuration/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/rules/k8s/namespace/white-listed-pod.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Pods in Namespace +title: Allowed Pods in Namespace +--- # Allowed Pods in Namespace **Type:** Rule **ID:** `k8s-namespace-white-listed-pod` diff --git a/docs/configuration/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/rules/k8s/pods/verify-pod-duration.md index 288bcd031..1a2ad25fe 100644 --- a/docs/configuration/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/rules/k8s/pods/verify-pod-duration.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Pod Runtime Duration +title: Verify Pod Runtime Duration +--- # Verify Pod Runtime Duration **Type:** Rule **ID:** `k8s-pods-verify-pod-duration` diff --git a/docs/configuration/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/rules/k8s/pods/verify-pod-termination.md index 8e29e2f01..355a41366 100644 --- a/docs/configuration/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/rules/k8s/pods/verify-pod-termination.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Pod Termination +title: Verify Pod Termination +--- # Verify Pod Termination **Type:** Rule **ID:** `k8s-pods-verify-pod-termination` diff --git a/docs/configuration/rules/k8s/pods/white-listed-pod.md b/docs/configuration/rules/k8s/pods/white-listed-pod.md index 5b2b10c8e..8e305e760 100644 --- a/docs/configuration/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/rules/k8s/pods/white-listed-pod.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Allowed Pods +title: Allowed Pods +--- # Allowed Pods **Type:** Rule **ID:** `k8s-pods-white-listed-pod` diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/rules/multievidence/files_integrity.md index fd1326ebb..0b417298e 100644 --- a/docs/configuration/rules/multievidence/files_integrity.md +++ b/docs/configuration/rules/multievidence/files_integrity.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify File Integrity +title: Verify File Integrity +--- # Verify File Integrity **Type:** Rule **ID:** `file-integrity` diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/rules/sarif/artifact-signed.md index ee5f60483..c7b89cf06 100644 --- a/docs/configuration/rules/sarif/artifact-signed.md +++ b/docs/configuration/rules/sarif/artifact-signed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Artifact Signature in SARIF +title: Verify Artifact Signature in SARIF +--- # Verify Artifact Signature in SARIF **Type:** Rule **ID:** `sarif-artifact-signed` diff --git a/docs/configuration/rules/sarif/evidence-exists.md b/docs/configuration/rules/sarif/evidence-exists.md index 7659c295b..c15cad5be 100644 --- a/docs/configuration/rules/sarif/evidence-exists.md +++ b/docs/configuration/rules/sarif/evidence-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Required Evidence in SARIF +title: Verify Required Evidence in SARIF +--- # Verify Required Evidence in SARIF **Type:** Rule **ID:** `required-sarif-evidence` diff --git a/docs/configuration/rules/sarif/patcheck/updates-needed.md b/docs/configuration/rules/sarif/patcheck/updates-needed.md index 411a9b702..fd980c66e 100644 --- a/docs/configuration/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/rules/sarif/patcheck/updates-needed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: SARIF Update Needed +title: SARIF Update Needed +--- # SARIF Update Needed **Type:** Rule **ID:** `sarif-update-needed` diff --git a/docs/configuration/rules/sarif/report-iac-errors.md b/docs/configuration/rules/sarif/report-iac-errors.md index c1229ff87..ea703dcb7 100644 --- a/docs/configuration/rules/sarif/report-iac-errors.md +++ b/docs/configuration/rules/sarif/report-iac-errors.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify IaC Misconfiguration Threshold in SARIF +title: Verify IaC Misconfiguration Threshold in SARIF +--- # Verify IaC Misconfiguration Threshold in SARIF **Type:** Rule **ID:** `sarif-iac-findings` diff --git a/docs/configuration/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/rules/sarif/trivy/blocklist-cve.md index ca7937ff3..f6dc0e34e 100644 --- a/docs/configuration/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/rules/sarif/trivy/blocklist-cve.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Trivy Blocklist CVE Check +title: Trivy Blocklist CVE Check +--- # Trivy Blocklist CVE Check **Type:** Rule **ID:** `trivy-blocklist-cve` diff --git a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md index 8105482de..b2b1337ca 100644 --- a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify IaC Misconfiguration Threshold in Trivy SARIF +title: Verify IaC Misconfiguration Threshold in Trivy SARIF +--- # Verify IaC Misconfiguration Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-iac-findings` diff --git a/docs/configuration/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/rules/sarif/trivy/verify-cve-severity.md index cbd6e6d41..f82087ca9 100644 --- a/docs/configuration/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/rules/sarif/trivy/verify-cve-severity.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Trivy Vulnerability Findings Check +title: Trivy Vulnerability Findings Check +--- # Trivy Vulnerability Findings Check **Type:** Rule **ID:** `trivy-verify-vulnerability-findings` diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md index 2ac3be67c..a7ded3552 100644 --- a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Attack Vector Threshold in Trivy SARIF +title: Verify Attack Vector Threshold in Trivy SARIF +--- # Verify Attack Vector Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-attack-vectors` diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md index 10197a09c..c43a017df 100644 --- a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/rules/sarif/trivy/verify-trivy-report.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Trivy SARIF Report Compliance +title: Verify Trivy SARIF Report Compliance +--- # Verify Trivy SARIF Report Compliance **Type:** Rule **ID:** `trivy-report` diff --git a/docs/configuration/rules/sarif/verify-attack-vector.md b/docs/configuration/rules/sarif/verify-attack-vector.md index 5276d8c1d..4d847d0da 100644 --- a/docs/configuration/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/rules/sarif/verify-attack-vector.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Attack Vector Exists in SARIF +title: Verify Attack Vector Exists in SARIF +--- # Verify Attack Vector Exists in SARIF **Type:** Rule **ID:** `sarif-attack-vectors` diff --git a/docs/configuration/rules/sarif/verify-sarif.md b/docs/configuration/rules/sarif/verify-sarif.md index 092d00a9f..159347a99 100644 --- a/docs/configuration/rules/sarif/verify-sarif.md +++ b/docs/configuration/rules/sarif/verify-sarif.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Rule Compliance in SARIF +title: Verify Rule Compliance in SARIF +--- # Verify Rule Compliance in SARIF **Type:** Rule **ID:** `sarif-policy` diff --git a/docs/configuration/rules/sarif/verify-semgrep-report.md b/docs/configuration/rules/sarif/verify-semgrep-report.md index a33e9813e..eb2ef9594 100644 --- a/docs/configuration/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/rules/sarif/verify-semgrep-report.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Semgrep Rule in SARIF +title: Verify Semgrep Rule in SARIF +--- # Verify Semgrep Rule in SARIF **Type:** Rule **ID:** `sarif-semgrep-report` diff --git a/docs/configuration/rules/sarif/verify-tool-evidence.md b/docs/configuration/rules/sarif/verify-tool-evidence.md index e76441595..93989eb24 100644 --- a/docs/configuration/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/rules/sarif/verify-tool-evidence.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Tool Evidence in SARIF +title: Verify Tool Evidence in SARIF +--- # Verify Tool Evidence in SARIF **Type:** Rule **ID:** `sarif-tool-evidence` diff --git a/docs/configuration/rules/sbom/NTIA-compliance.md b/docs/configuration/rules/sbom/NTIA-compliance.md index 602ef3c1b..79793158f 100644 --- a/docs/configuration/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/rules/sbom/NTIA-compliance.md @@ -1,3 +1,7 @@ +--- +sidebar_label: NTIA SBOM Compliance Check +title: NTIA SBOM Compliance Check +--- # NTIA SBOM Compliance Check **Type:** Rule **ID:** `NTIA-compliance` diff --git a/docs/configuration/rules/sbom/allowed-components.md b/docs/configuration/rules/sbom/allowed-components.md index 9e715c562..5e89f07cb 100644 --- a/docs/configuration/rules/sbom/allowed-components.md +++ b/docs/configuration/rules/sbom/allowed-components.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce Allowed SBOM Components +title: Enforce Allowed SBOM Components +--- # Enforce Allowed SBOM Components **Type:** Rule **ID:** `sbom-allowed-components` diff --git a/docs/configuration/rules/sbom/artifact-signed.md b/docs/configuration/rules/sbom/artifact-signed.md index fafb1089f..da697bea2 100644 --- a/docs/configuration/rules/sbom/artifact-signed.md +++ b/docs/configuration/rules/sbom/artifact-signed.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require SBOM Signature +title: Require SBOM Signature +--- # Require SBOM Signature **Type:** Rule **ID:** `sbom-signed` diff --git a/docs/configuration/rules/sbom/banned-licenses.md b/docs/configuration/rules/sbom/banned-licenses.md index cc33a26df..9b5515398 100644 --- a/docs/configuration/rules/sbom/banned-licenses.md +++ b/docs/configuration/rules/sbom/banned-licenses.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Disallowed SBOM Licenses +title: Restrict Disallowed SBOM Licenses +--- # Restrict Disallowed SBOM Licenses **Type:** Rule **ID:** `sbom-disallowed-licenses` diff --git a/docs/configuration/rules/sbom/blocklist-packages.md b/docs/configuration/rules/sbom/blocklist-packages.md index f9e447cd9..fb5cbc414 100644 --- a/docs/configuration/rules/sbom/blocklist-packages.md +++ b/docs/configuration/rules/sbom/blocklist-packages.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Restrict Disallowed Dependencies +title: Restrict Disallowed Dependencies +--- # Restrict Disallowed Dependencies **Type:** Rule **ID:** `sbom-disallow-dependencies` diff --git a/docs/configuration/rules/sbom/complete-licenses.md b/docs/configuration/rules/sbom/complete-licenses.md index 7191710de..7fae8eba6 100644 --- a/docs/configuration/rules/sbom/complete-licenses.md +++ b/docs/configuration/rules/sbom/complete-licenses.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce SBOM License Completeness +title: Enforce SBOM License Completeness +--- # Enforce SBOM License Completeness **Type:** Rule **ID:** `sbom-require-complete-license-set` diff --git a/docs/configuration/rules/sbom/fresh-sbom.md b/docs/configuration/rules/sbom/fresh-sbom.md index 26b40d098..a0ce3b564 100644 --- a/docs/configuration/rules/sbom/fresh-sbom.md +++ b/docs/configuration/rules/sbom/fresh-sbom.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce SBOM Freshness +title: Enforce SBOM Freshness +--- # Enforce SBOM Freshness **Type:** Rule **ID:** `fresh-sbom` diff --git a/docs/configuration/rules/sbom/require-sbom.md b/docs/configuration/rules/sbom/require-sbom.md index 49f99c574..c63d4408a 100644 --- a/docs/configuration/rules/sbom/require-sbom.md +++ b/docs/configuration/rules/sbom/require-sbom.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require SBOM Existence +title: Require SBOM Existence +--- # Require SBOM Existence **Type:** Rule **ID:** `require-sbom` diff --git a/docs/configuration/rules/sbom/required-packages.md b/docs/configuration/rules/sbom/required-packages.md index ef95d6b41..7551d1703 100644 --- a/docs/configuration/rules/sbom/required-packages.md +++ b/docs/configuration/rules/sbom/required-packages.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce SBOM Dependencies +title: Enforce SBOM Dependencies +--- # Enforce SBOM Dependencies **Type:** Rule **ID:** `sbom-required-dependencies` diff --git a/docs/configuration/rules/sbom/verify-huggingface-license.md b/docs/configuration/rules/sbom/verify-huggingface-license.md index 99745ca2f..642b8b875 100644 --- a/docs/configuration/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/rules/sbom/verify-huggingface-license.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require Specified SBOM Licenses +title: Require Specified SBOM Licenses +--- # Require Specified SBOM Licenses **Type:** Rule **ID:** `sbom-hf-license` diff --git a/docs/configuration/rules/slsa/banned-builder-deps.md b/docs/configuration/rules/slsa/banned-builder-deps.md index 7fcedbee4..df599a055 100644 --- a/docs/configuration/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/rules/slsa/banned-builder-deps.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Disallow dependencies in SLSA Provenance Document +title: Disallow dependencies in SLSA Provenance Document +--- # Disallow dependencies in SLSA Provenance Document **Type:** Rule **ID:** `slsa-builder-unallowed-dependencies` diff --git a/docs/configuration/rules/slsa/build-time.md b/docs/configuration/rules/slsa/build-time.md index be858ee0a..7fd22ed53 100644 --- a/docs/configuration/rules/slsa/build-time.md +++ b/docs/configuration/rules/slsa/build-time.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify build time +title: Verify build time +--- # Verify build time **Type:** Rule **ID:** `slsa-build-time` diff --git a/docs/configuration/rules/slsa/field-exists.md b/docs/configuration/rules/slsa/field-exists.md index b11601c6c..9a4bfe3a3 100644 --- a/docs/configuration/rules/slsa/field-exists.md +++ b/docs/configuration/rules/slsa/field-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: SLSA Field Exists in Provenance Document +title: SLSA Field Exists in Provenance Document +--- # SLSA Field Exists in Provenance Document **Type:** Rule **ID:** `slsa-field-exists` diff --git a/docs/configuration/rules/slsa/l1-provenance-exists.md b/docs/configuration/rules/slsa/l1-provenance-exists.md index 42864253d..586fddc07 100644 --- a/docs/configuration/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/rules/slsa/l1-provenance-exists.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify Provenance Document Exists +title: Verify Provenance Document Exists +--- # Verify Provenance Document Exists **Type:** Rule **ID:** `SLSA.L1` diff --git a/docs/configuration/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/rules/slsa/l2-provenance-authenticated.md index e94a7fb85..9a6f07f4b 100644 --- a/docs/configuration/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/rules/slsa/l2-provenance-authenticated.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify that provenance is authenticated +title: Verify that provenance is authenticated +--- # Verify that provenance is authenticated **Type:** Rule **ID:** `SLSA.L2` diff --git a/docs/configuration/rules/slsa/verify-builder.md b/docs/configuration/rules/slsa/verify-builder.md index 92ad4f2c1..b64201feb 100644 --- a/docs/configuration/rules/slsa/verify-builder.md +++ b/docs/configuration/rules/slsa/verify-builder.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify that artifact was created by the specified builder +title: Verify that artifact was created by the specified builder +--- # Verify that artifact was created by the specified builder **Type:** Rule **ID:** `slsa-verify-builder` diff --git a/docs/configuration/rules/slsa/verify-byproducts.md b/docs/configuration/rules/slsa/verify-byproducts.md index 0278b2584..53566e0ce 100644 --- a/docs/configuration/rules/slsa/verify-byproducts.md +++ b/docs/configuration/rules/slsa/verify-byproducts.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Verify that artifact has no disallowed builder dependencies +title: Verify that artifact has no disallowed builder dependencies +--- # Verify that artifact has no disallowed builder dependencies **Type:** Rule **ID:** `slsa-verify-byproducts` diff --git a/docs/configuration/rules/ssdf/ps-1-2fa.md b/docs/configuration/rules/ssdf/ps-1-2fa.md index 0b5c35703..4a8065d40 100644 --- a/docs/configuration/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/rules/ssdf/ps-1-2fa.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Enforce 2FA +title: Enforce 2FA +--- # Enforce 2FA **Type:** Rule **ID:** `PS.1.1` diff --git a/docs/configuration/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/rules/ssdf/ps-1-branch-protection.md index b63af02ec..ae7924d33 100644 --- a/docs/configuration/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/rules/ssdf/ps-1-branch-protection.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Branch protected +title: Branch protected +--- # Branch protected **Type:** Rule **ID:** `PS.1.2` diff --git a/docs/configuration/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/rules/ssdf/ps-1-limit-admins.md index 9e2f1dc3b..9ffc7a832 100644 --- a/docs/configuration/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/rules/ssdf/ps-1-limit-admins.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Limit admins +title: Limit admins +--- # Limit admins **Type:** Rule **ID:** `PS.1.3` diff --git a/docs/configuration/rules/ssdf/ps-1-repo-private.md b/docs/configuration/rules/ssdf/ps-1-repo-private.md index 3b79c9911..d952157bd 100644 --- a/docs/configuration/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/rules/ssdf/ps-1-repo-private.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Repo private +title: Repo private +--- # Repo private **Type:** Rule **ID:** `PS.1.4` diff --git a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md index b9ed72cce..15978ae29 100644 --- a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Require signoff on web commits +title: Require signoff on web commits +--- # Require signoff on web commits **Type:** Rule **ID:** `PS.1.5` diff --git a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md index 2687285ed..c5caed1a5 100644 --- a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/rules/ssdf/ps-2-image-verifiable.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Image-verifiable +title: Image-verifiable +--- # Image-verifiable **Type:** Rule **ID:** `PS.2` diff --git a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md index 610ce05f0..f0a11ecaa 100644 --- a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/rules/ssdf/ps-3.1-code-archived.md @@ -1,3 +1,7 @@ +--- +sidebar_label: Code archived +title: Code archived +--- # Code archived **Type:** Rule **ID:** `PS.3.1` diff --git a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md index 3ba9a39e5..23b5dd25f 100644 --- a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md @@ -1,3 +1,7 @@ +--- +sidebar_label: SBOM archived +title: SBOM archived +--- # SBOM archived **Type:** Rule **ID:** `PS.3.2` From d5089f02fbae34c4da8f9ef5c7ced751636a5164 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 12:48:09 +0200 Subject: [PATCH 069/191] tmp gen docs --- docs/configuration/initiatives/_category_.json | 4 ++-- docs/configuration/rules/_category_.json | 4 ++++ docs/configuration/rules/api/_category_.json | 4 ++++ docs/configuration/rules/bitbucket/_category_.json | 4 ++++ docs/configuration/rules/bitbucket/project/_category_.json | 4 ++++ .../rules/bitbucket/repository/_category_.json | 4 ++++ .../configuration/rules/bitbucket/workspace/_category_.json | 4 ++++ docs/configuration/rules/dockerhub/_category_.json | 4 ++++ docs/configuration/rules/generic/_category_.json | 4 ++++ docs/configuration/rules/git/_category_.json | 4 ++++ docs/configuration/rules/github/_category_.json | 4 ++++ docs/configuration/rules/github/api/_category_.json | 4 ++++ docs/configuration/rules/github/org/_category_.json | 4 ++++ docs/configuration/rules/github/repository/_category_.json | 4 ++++ docs/configuration/rules/gitlab/_category_.json | 4 ++++ docs/configuration/rules/gitlab/api/_category_.json | 4 ++++ docs/configuration/rules/gitlab/org/_category_.json | 4 ++++ docs/configuration/rules/gitlab/pipeline/_category_.json | 4 ++++ docs/configuration/rules/gitlab/project/_category_.json | 4 ++++ docs/configuration/rules/images/_category_.json | 4 ++++ docs/configuration/rules/jenkins/_category_.json | 4 ++++ docs/configuration/rules/jenkins/folder/_category_.json | 4 ++++ docs/configuration/rules/jenkins/instance/_category_.json | 4 ++++ docs/configuration/rules/k8s/_category_.json | 4 ++++ docs/configuration/rules/k8s/namespace/_category_.json | 4 ++++ docs/configuration/rules/k8s/pods/_category_.json | 4 ++++ docs/configuration/rules/multievidence/_category_.json | 4 ++++ docs/configuration/rules/sarif/_category_.json | 4 ++++ docs/configuration/rules/sarif/artifact-signed.md | 6 +++--- docs/configuration/rules/sarif/patcheck/_category_.json | 4 ++++ docs/configuration/rules/sarif/trivy/_category_.json | 4 ++++ docs/configuration/rules/sbom/_category_.json | 4 ++++ docs/configuration/rules/slsa/_category_.json | 4 ++++ docs/configuration/rules/ssdf/_category_.json | 4 ++++ 34 files changed, 133 insertions(+), 5 deletions(-) create mode 100644 docs/configuration/rules/_category_.json create mode 100644 docs/configuration/rules/api/_category_.json create mode 100644 docs/configuration/rules/bitbucket/_category_.json create mode 100644 docs/configuration/rules/bitbucket/project/_category_.json create mode 100644 docs/configuration/rules/bitbucket/repository/_category_.json create mode 100644 docs/configuration/rules/bitbucket/workspace/_category_.json create mode 100644 docs/configuration/rules/dockerhub/_category_.json create mode 100644 docs/configuration/rules/generic/_category_.json create mode 100644 docs/configuration/rules/git/_category_.json create mode 100644 docs/configuration/rules/github/_category_.json create mode 100644 docs/configuration/rules/github/api/_category_.json create mode 100644 docs/configuration/rules/github/org/_category_.json create mode 100644 docs/configuration/rules/github/repository/_category_.json create mode 100644 docs/configuration/rules/gitlab/_category_.json create mode 100644 docs/configuration/rules/gitlab/api/_category_.json create mode 100644 docs/configuration/rules/gitlab/org/_category_.json create mode 100644 docs/configuration/rules/gitlab/pipeline/_category_.json create mode 100644 docs/configuration/rules/gitlab/project/_category_.json create mode 100644 docs/configuration/rules/images/_category_.json create mode 100644 docs/configuration/rules/jenkins/_category_.json create mode 100644 docs/configuration/rules/jenkins/folder/_category_.json create mode 100644 docs/configuration/rules/jenkins/instance/_category_.json create mode 100644 docs/configuration/rules/k8s/_category_.json create mode 100644 docs/configuration/rules/k8s/namespace/_category_.json create mode 100644 docs/configuration/rules/k8s/pods/_category_.json create mode 100644 docs/configuration/rules/multievidence/_category_.json create mode 100644 docs/configuration/rules/sarif/_category_.json create mode 100644 docs/configuration/rules/sarif/patcheck/_category_.json create mode 100644 docs/configuration/rules/sarif/trivy/_category_.json create mode 100644 docs/configuration/rules/sbom/_category_.json create mode 100644 docs/configuration/rules/slsa/_category_.json create mode 100644 docs/configuration/rules/ssdf/_category_.json diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index 120d1a7ed..cb94d3950 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { - "label": "Reference: Policies and Configuration Guide", - "position": 1 + "label": "Reference: Policies and Configuration Guide", + "position": 1 } \ No newline at end of file diff --git a/docs/configuration/rules/_category_.json b/docs/configuration/rules/_category_.json new file mode 100644 index 000000000..03176cc52 --- /dev/null +++ b/docs/configuration/rules/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Rule Configuration", + "position": 2 +} \ No newline at end of file diff --git a/docs/configuration/rules/api/_category_.json b/docs/configuration/rules/api/_category_.json new file mode 100644 index 000000000..c9d731c03 --- /dev/null +++ b/docs/configuration/rules/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Api", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/bitbucket/_category_.json b/docs/configuration/rules/bitbucket/_category_.json new file mode 100644 index 000000000..e6515f2ae --- /dev/null +++ b/docs/configuration/rules/bitbucket/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Bitbucket", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/bitbucket/project/_category_.json b/docs/configuration/rules/bitbucket/project/_category_.json new file mode 100644 index 000000000..a88c9e5b1 --- /dev/null +++ b/docs/configuration/rules/bitbucket/project/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Project", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/bitbucket/repository/_category_.json b/docs/configuration/rules/bitbucket/repository/_category_.json new file mode 100644 index 000000000..e93f68442 --- /dev/null +++ b/docs/configuration/rules/bitbucket/repository/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Repository", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/bitbucket/workspace/_category_.json b/docs/configuration/rules/bitbucket/workspace/_category_.json new file mode 100644 index 000000000..ed893c2ea --- /dev/null +++ b/docs/configuration/rules/bitbucket/workspace/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Workspace", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/dockerhub/_category_.json b/docs/configuration/rules/dockerhub/_category_.json new file mode 100644 index 000000000..7c6237a25 --- /dev/null +++ b/docs/configuration/rules/dockerhub/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Dockerhub", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/generic/_category_.json b/docs/configuration/rules/generic/_category_.json new file mode 100644 index 000000000..ab9d35851 --- /dev/null +++ b/docs/configuration/rules/generic/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Generic", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/git/_category_.json b/docs/configuration/rules/git/_category_.json new file mode 100644 index 000000000..2a7a53690 --- /dev/null +++ b/docs/configuration/rules/git/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Git", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/github/_category_.json b/docs/configuration/rules/github/_category_.json new file mode 100644 index 000000000..b0cc1e8af --- /dev/null +++ b/docs/configuration/rules/github/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Github", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/github/api/_category_.json b/docs/configuration/rules/github/api/_category_.json new file mode 100644 index 000000000..c9d731c03 --- /dev/null +++ b/docs/configuration/rules/github/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Api", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/github/org/_category_.json b/docs/configuration/rules/github/org/_category_.json new file mode 100644 index 000000000..1ce17e465 --- /dev/null +++ b/docs/configuration/rules/github/org/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Org", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/github/repository/_category_.json b/docs/configuration/rules/github/repository/_category_.json new file mode 100644 index 000000000..e93f68442 --- /dev/null +++ b/docs/configuration/rules/github/repository/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Repository", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/gitlab/_category_.json b/docs/configuration/rules/gitlab/_category_.json new file mode 100644 index 000000000..d41c80a07 --- /dev/null +++ b/docs/configuration/rules/gitlab/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Gitlab", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/gitlab/api/_category_.json b/docs/configuration/rules/gitlab/api/_category_.json new file mode 100644 index 000000000..c9d731c03 --- /dev/null +++ b/docs/configuration/rules/gitlab/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Api", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/gitlab/org/_category_.json b/docs/configuration/rules/gitlab/org/_category_.json new file mode 100644 index 000000000..1ce17e465 --- /dev/null +++ b/docs/configuration/rules/gitlab/org/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Org", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/gitlab/pipeline/_category_.json b/docs/configuration/rules/gitlab/pipeline/_category_.json new file mode 100644 index 000000000..a57065cbf --- /dev/null +++ b/docs/configuration/rules/gitlab/pipeline/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Pipeline", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/gitlab/project/_category_.json b/docs/configuration/rules/gitlab/project/_category_.json new file mode 100644 index 000000000..a88c9e5b1 --- /dev/null +++ b/docs/configuration/rules/gitlab/project/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Project", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/images/_category_.json b/docs/configuration/rules/images/_category_.json new file mode 100644 index 000000000..fb18a4fc4 --- /dev/null +++ b/docs/configuration/rules/images/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Images", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/jenkins/_category_.json b/docs/configuration/rules/jenkins/_category_.json new file mode 100644 index 000000000..a1e606da6 --- /dev/null +++ b/docs/configuration/rules/jenkins/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Jenkins", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/jenkins/folder/_category_.json b/docs/configuration/rules/jenkins/folder/_category_.json new file mode 100644 index 000000000..5a7c99815 --- /dev/null +++ b/docs/configuration/rules/jenkins/folder/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Folder", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/jenkins/instance/_category_.json b/docs/configuration/rules/jenkins/instance/_category_.json new file mode 100644 index 000000000..194968062 --- /dev/null +++ b/docs/configuration/rules/jenkins/instance/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Instance", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/k8s/_category_.json b/docs/configuration/rules/k8s/_category_.json new file mode 100644 index 000000000..8b1cd3ce2 --- /dev/null +++ b/docs/configuration/rules/k8s/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "K8S", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/k8s/namespace/_category_.json b/docs/configuration/rules/k8s/namespace/_category_.json new file mode 100644 index 000000000..3ea66151d --- /dev/null +++ b/docs/configuration/rules/k8s/namespace/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Namespace", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/k8s/pods/_category_.json b/docs/configuration/rules/k8s/pods/_category_.json new file mode 100644 index 000000000..d22e47cb4 --- /dev/null +++ b/docs/configuration/rules/k8s/pods/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Pods", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/multievidence/_category_.json b/docs/configuration/rules/multievidence/_category_.json new file mode 100644 index 000000000..9696ec52e --- /dev/null +++ b/docs/configuration/rules/multievidence/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Multievidence", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/sarif/_category_.json b/docs/configuration/rules/sarif/_category_.json new file mode 100644 index 000000000..a5d7cee10 --- /dev/null +++ b/docs/configuration/rules/sarif/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Sarif", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/rules/sarif/artifact-signed.md index c7b89cf06..4e45617c3 100644 --- a/docs/configuration/rules/sarif/artifact-signed.md +++ b/docs/configuration/rules/sarif/artifact-signed.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Artifact Signature in SARIF -title: Verify Artifact Signature in SARIF +sidebar_label: Verify Artifact Signature Using SARIF Report +title: Verify Artifact Signature Using SARIF Report --- -# Verify Artifact Signature in SARIF +# Verify Artifact Signature Using SARIF Report **Type:** Rule **ID:** `sarif-artifact-signed` **Uses:** `sarif/artifact-signed@v2/rules` diff --git a/docs/configuration/rules/sarif/patcheck/_category_.json b/docs/configuration/rules/sarif/patcheck/_category_.json new file mode 100644 index 000000000..4a0cbea05 --- /dev/null +++ b/docs/configuration/rules/sarif/patcheck/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Patcheck", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/sarif/trivy/_category_.json b/docs/configuration/rules/sarif/trivy/_category_.json new file mode 100644 index 000000000..54def2fba --- /dev/null +++ b/docs/configuration/rules/sarif/trivy/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Trivy", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/sbom/_category_.json b/docs/configuration/rules/sbom/_category_.json new file mode 100644 index 000000000..b474ce5da --- /dev/null +++ b/docs/configuration/rules/sbom/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Sbom", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/slsa/_category_.json b/docs/configuration/rules/slsa/_category_.json new file mode 100644 index 000000000..36f7a4e44 --- /dev/null +++ b/docs/configuration/rules/slsa/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Slsa", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/rules/ssdf/_category_.json b/docs/configuration/rules/ssdf/_category_.json new file mode 100644 index 000000000..684da0604 --- /dev/null +++ b/docs/configuration/rules/ssdf/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Ssdf", + "position": 1 +} \ No newline at end of file From 75579cf00b7725c58a124a21618a04219216251d Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 12:55:13 +0200 Subject: [PATCH 070/191] tmp gen docs --- docs/configuration/_category_.json | 4 ---- docs/configuration/initiatives/bp1.md | 24 +++++++++---------- .../{ => initiatives}/rules/_category_.json | 0 .../rules/api/_category_.json | 0 .../rules/api/scribe-api-cve-product.md | 0 .../rules/api/scribe-api-cve.md | 0 .../rules/api/scribe-api-published.md | 0 .../{ => initiatives}/rules/api/scribe-api.md | 0 .../rules/bitbucket/_category_.json | 0 .../rules/bitbucket/project/_category_.json | 0 .../rules/bitbucket/project/allow-admins.md | 0 .../rules/bitbucket/project/allow-users.md | 0 .../bitbucket/project/exposed-credentials.md | 0 .../bitbucket/project/long-live-tokens.md | 0 .../bitbucket/repository/_category_.json | 0 .../bitbucket/repository/allow-admins.md | 0 .../rules/bitbucket/repository/allow-users.md | 0 .../bitbucket/repository/branch-protection.md | 0 .../rules/bitbucket/workspace/_category_.json | 0 .../rules/bitbucket/workspace/allow-admins.md | 0 .../rules/bitbucket/workspace/allow-users.md | 0 .../rules/dockerhub/_category_.json | 0 .../rules/dockerhub/token-expiration.md | 0 .../rules/dockerhub/token-not-used.md | 0 .../rules/generic/_category_.json | 0 .../rules/generic/artifact-signed.md | 0 .../rules/generic/evidence-exists.md | 0 .../rules/generic/k8s-jailbreak.md | 0 .../rules/generic/trivy-exists.md | 0 .../rules/git/_category_.json | 0 .../rules/git/artifact-signed.md | 0 .../rules/git/coding-permissions.md | 0 .../rules/git/evidence-exists.md | 0 .../rules/git/no-commit-to-main.md | 0 .../rules/git/no-unsigned-commits.md | 0 .../rules/github/_category_.json | 0 .../rules/github/api/_category_.json | 0 .../rules/github/api/branch-protection.md | 0 .../rules/github/api/signed-commits-list.md | 0 .../rules/github/api/signed-commits-range.md | 0 .../{ => initiatives}/rules/github/org/2fa.md | 0 .../rules/github/org/_category_.json | 0 .../rules/github/org/advanced-security.md | 0 .../rules/github/org/allow-admins.md | 0 .../rules/github/org/allow-users.md | 0 .../rules/github/org/create-private-repos.md | 0 .../rules/github/org/create-repos.md | 0 .../rules/github/org/dependabot-alerts.md | 0 .../org/dependabot-security-updates-sa.md | 0 .../github/org/dependabot-security-updates.md | 0 .../rules/github/org/dependency-graph.md | 0 .../rules/github/org/max-admins.md | 0 .../rules/github/org/old-secrets.md | 0 .../rules/github/org/pp-custom-link.md | 0 .../rules/github/org/push-protection-sa.md | 0 .../rules/github/org/push-protection.md | 0 .../rules/github/org/repo-visibility.md | 0 .../rules/github/org/secret-scanning-sa.md | 0 .../rules/github/org/secret-scanning.md | 0 .../rules/github/org/validity-checks-sa.md | 0 .../rules/github/org/validity-checks.md | 0 .../rules/github/org/web-commit-signoff.md | 0 .../rules/github/repository/_category_.json | 0 .../github/repository/branch-protection.md | 0 .../github/repository/branch-verification.md | 0 .../github/repository/check-signed-commits.md | 0 .../repository/default-branch-protection.md | 0 .../rules/github/repository/dependabot.md | 0 .../repository/ephemeral-runners-only.md | 0 .../rules/github/repository/no-cache-usage.md | 0 .../rules/github/repository/no-org-secrets.md | 0 .../rules/github/repository/old-secrets.md | 0 .../github/repository/push-protection.md | 0 .../rules/github/repository/repo-private.md | 0 .../github/repository/secret-scanning.md | 0 .../rules/github/repository/signed-commits.md | 0 .../github/repository/validity-checks.md | 0 .../rules/github/repository/visibility.md | 0 .../github/repository/web-commit-signoff.md | 0 .../rules/gitlab/_category_.json | 0 .../rules/gitlab/api/_category_.json | 0 .../rules/gitlab/api/push-rules.md | 0 .../rules/gitlab/api/signed-commits-list.md | 0 .../rules/gitlab/api/signed-commits-range.md | 0 .../rules/gitlab/org/_category_.json | 0 .../rules/gitlab/org/allow-admins.md | 0 .../rules/gitlab/org/allow-token-scopes.md | 0 .../rules/gitlab/org/allow-users.md | 0 .../rules/gitlab/org/blocked-users.md | 0 .../rules/gitlab/org/expiring-tokens.md | 0 .../rules/gitlab/org/forbid-token-scopes.md | 0 .../rules/gitlab/org/inactive-projects.md | 0 .../rules/gitlab/org/longlive-tokens.md | 0 .../rules/gitlab/org/max-admins.md | 0 .../rules/gitlab/org/projects-visibility.md | 0 .../rules/gitlab/org/unused-tokens.md | 0 .../rules/gitlab/pipeline/_category_.json | 0 .../gitlab/pipeline/verify-labels-exist.md | 0 .../rules/gitlab/pipeline/verify-labels.md | 0 .../rules/gitlab/project/_category_.json | 0 .../rules/gitlab/project/abandoned-project.md | 0 .../gitlab/project/approvals-policy-check.md | 0 .../project/approvers-per-merge-request.md | 0 .../gitlab/project/author-email-regex.md | 0 .../rules/gitlab/project/check-cwe.md | 0 .../gitlab/project/check-signed-commits.md | 0 .../gitlab/project/co-approval-required.md | 0 .../project/commit-author-email-check.md | 0 .../project/commit-author-name-check.md | 0 .../gitlab/project/commit-committer-check.md | 0 .../gitlab/project/commit-message-check.md | 0 .../rules/gitlab/project/commits-validated.md | 0 .../gitlab/project/committer-email-check.md | 0 .../gitlab/project/committer-name-check.md | 0 .../gitlab/project/critical-severity-limit.md | 0 .../project/description-substring-check.md | 0 .../project/disallowed-banned-approvers.md | 0 .../gitlab/project/force-push-protection.md | 0 .../gitlab/project/medium-severity-limit.md | 0 .../rules/gitlab/project/member-check.md | 0 .../gitlab/project/merge-access-level.md | 0 .../project/merge-requests-author-approval.md | 0 ...ge-requests-disable-committers-approval.md | 0 .../gitlab/project/message-substring-check.md | 0 .../gitlab/project/prevent-secrets-check.md | 0 .../gitlab/project/protect-ci-secrets.md | 0 .../rules/gitlab/project/push-access-level.md | 0 .../rules/gitlab/project/push-rules-set.md | 0 .../gitlab/project/reject-unsigned-commits.md | 0 .../project/require-password-to-approve.md | 0 .../project/required-minimal-approvers.md | 0 .../gitlab/project/reset-pprovals-on-push.md | 0 .../rules/gitlab/project/sast-scan-pass.md | 0 .../rules/gitlab/project/sast-scanning.md | 0 .../rules/gitlab/project/secrets-scan-pass.md | 0 .../rules/gitlab/project/secrets-scanning.md | 0 .../project/selective-code-owner-removals.md | 0 .../rules/gitlab/project/visibility-check.md | 0 .../rules/images/_category_.json | 0 .../rules/images/allowed-base-image.md | 0 .../rules/images/allowed-image-source.md | 0 .../rules/images/banned-ports.md | 0 .../rules/images/banned-users.md | 0 .../rules/images/blocklist-build-scripts.md | 0 .../rules/images/blocklist-user.md | 0 .../rules/images/enforce-https-registry.md | 0 .../rules/images/forbid-large-images.md | 0 .../rules/images/fresh-base-image.md | 0 .../rules/images/fresh-image.md | 0 .../rules/images/image-signed.md | 0 .../rules/images/require-healthcheck.md | 0 .../rules/images/restrict-shell-entrypoint.md | 0 .../rules/images/verify-labels-exist.md | 0 .../rules/images/verify-labels.md | 0 .../rules/jenkins/_category_.json | 0 .../rules/jenkins/folder/_category_.json | 0 .../jenkins/folder/exposed-credentials.md | 0 .../rules/jenkins/instance/_category_.json | 0 .../rules/jenkins/instance/inactive-users.md | 0 .../rules/jenkins/instance/unused-users.md | 0 .../rules/k8s/_category_.json | 0 .../rules/k8s/namespace/_category_.json | 0 .../rules/k8s/namespace/allowed-images.md | 0 .../rules/k8s/namespace/allowed-registries.md | 0 .../namespace/verify-namespace-duration.md | 0 .../namespace/verify-namespace-termination.md | 0 .../k8s/namespace/white-listed-namespaces.md | 0 .../rules/k8s/namespace/white-listed-pod.md | 0 .../rules/k8s/pods/_category_.json | 0 .../rules/k8s/pods/verify-pod-duration.md | 0 .../rules/k8s/pods/verify-pod-termination.md | 0 .../rules/k8s/pods/white-listed-pod.md | 0 .../rules/multievidence/_category_.json | 0 .../rules/multievidence/files_integrity.md | 0 .../rules/sarif/_category_.json | 0 .../rules/sarif/artifact-signed.md | 0 .../rules/sarif/evidence-exists.md | 0 .../rules/sarif/patcheck/_category_.json | 0 .../rules/sarif/patcheck/updates-needed.md | 0 .../rules/sarif/report-iac-errors.md | 0 .../rules/sarif/trivy/_category_.json | 0 .../rules/sarif/trivy/blocklist-cve.md | 0 .../sarif/trivy/report-trivy-iac-errors.md | 0 .../rules/sarif/trivy/verify-cve-severity.md | 0 .../sarif/trivy/verify-trivy-attack-vector.md | 0 .../rules/sarif/trivy/verify-trivy-report.md | 0 .../rules/sarif/verify-attack-vector.md | 0 .../rules/sarif/verify-sarif.md | 0 .../rules/sarif/verify-semgrep-report.md | 0 .../rules/sarif/verify-tool-evidence.md | 0 .../rules/sbom/NTIA-compliance.md | 0 .../rules/sbom/_category_.json | 0 .../rules/sbom/allowed-components.md | 0 .../rules/sbom/artifact-signed.md | 0 .../rules/sbom/banned-licenses.md | 0 .../rules/sbom/blocklist-packages.md | 0 .../rules/sbom/complete-licenses.md | 0 .../rules/sbom/fresh-sbom.md | 0 .../rules/sbom/require-sbom.md | 0 .../rules/sbom/required-packages.md | 0 .../rules/sbom/verify-huggingface-license.md | 0 .../rules/slsa/_category_.json | 0 .../rules/slsa/banned-builder-deps.md | 0 .../rules/slsa/build-time.md | 0 .../rules/slsa/field-exists.md | 0 .../rules/slsa/l1-provenance-exists.md | 0 .../rules/slsa/l2-provenance-authenticated.md | 0 .../rules/slsa/verify-builder.md | 0 .../rules/slsa/verify-byproducts.md | 0 .../rules/ssdf/_category_.json | 0 .../{ => initiatives}/rules/ssdf/ps-1-2fa.md | 0 .../rules/ssdf/ps-1-branch-protection.md | 0 .../rules/ssdf/ps-1-limit-admins.md | 0 .../rules/ssdf/ps-1-repo-private.md | 0 .../rules/ssdf/ps-1-web-commit-signoff.md | 0 .../rules/ssdf/ps-2-image-verifiable.md | 0 .../rules/ssdf/ps-3.1-code-archived.md | 0 .../rules/ssdf/ps-3.2-archived-sbom.md | 0 docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 ++-- docs/configuration/initiatives/sp-800-190.md | 24 +++++++++---------- docs/configuration/initiatives/sp-800-53.md | 12 +++++----- docs/configuration/initiatives/ssdf.md | 16 ++++++------- docs/configuration/rules/sbom/banned-users.md | 24 ------------------- .../rules/sbom/evidence-exists.md | 21 ---------------- 225 files changed, 41 insertions(+), 90 deletions(-) delete mode 100644 docs/configuration/_category_.json rename docs/configuration/{ => initiatives}/rules/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/api/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/api/scribe-api-cve-product.md (100%) rename docs/configuration/{ => initiatives}/rules/api/scribe-api-cve.md (100%) rename docs/configuration/{ => initiatives}/rules/api/scribe-api-published.md (100%) rename docs/configuration/{ => initiatives}/rules/api/scribe-api.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/project/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/project/allow-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/project/allow-users.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/project/exposed-credentials.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/project/long-live-tokens.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/repository/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/repository/allow-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/repository/allow-users.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/repository/branch-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/workspace/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/workspace/allow-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/bitbucket/workspace/allow-users.md (100%) rename docs/configuration/{ => initiatives}/rules/dockerhub/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/dockerhub/token-expiration.md (100%) rename docs/configuration/{ => initiatives}/rules/dockerhub/token-not-used.md (100%) rename docs/configuration/{ => initiatives}/rules/generic/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/generic/artifact-signed.md (100%) rename docs/configuration/{ => initiatives}/rules/generic/evidence-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/generic/k8s-jailbreak.md (100%) rename docs/configuration/{ => initiatives}/rules/generic/trivy-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/git/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/git/artifact-signed.md (100%) rename docs/configuration/{ => initiatives}/rules/git/coding-permissions.md (100%) rename docs/configuration/{ => initiatives}/rules/git/evidence-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/git/no-commit-to-main.md (100%) rename docs/configuration/{ => initiatives}/rules/git/no-unsigned-commits.md (100%) rename docs/configuration/{ => initiatives}/rules/github/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/github/api/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/github/api/branch-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/github/api/signed-commits-list.md (100%) rename docs/configuration/{ => initiatives}/rules/github/api/signed-commits-range.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/2fa.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/github/org/advanced-security.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/allow-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/allow-users.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/create-private-repos.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/create-repos.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/dependabot-alerts.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/dependabot-security-updates-sa.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/dependabot-security-updates.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/dependency-graph.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/max-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/old-secrets.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/pp-custom-link.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/push-protection-sa.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/push-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/repo-visibility.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/secret-scanning-sa.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/secret-scanning.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/validity-checks-sa.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/validity-checks.md (100%) rename docs/configuration/{ => initiatives}/rules/github/org/web-commit-signoff.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/branch-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/branch-verification.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/check-signed-commits.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/default-branch-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/dependabot.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/ephemeral-runners-only.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/no-cache-usage.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/no-org-secrets.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/old-secrets.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/push-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/repo-private.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/secret-scanning.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/signed-commits.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/validity-checks.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/visibility.md (100%) rename docs/configuration/{ => initiatives}/rules/github/repository/web-commit-signoff.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/api/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/api/push-rules.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/api/signed-commits-list.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/api/signed-commits-range.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/allow-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/allow-token-scopes.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/allow-users.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/blocked-users.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/expiring-tokens.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/forbid-token-scopes.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/inactive-projects.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/longlive-tokens.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/max-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/projects-visibility.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/org/unused-tokens.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/pipeline/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/pipeline/verify-labels-exist.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/pipeline/verify-labels.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/abandoned-project.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/approvals-policy-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/approvers-per-merge-request.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/author-email-regex.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/check-cwe.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/check-signed-commits.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/co-approval-required.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/commit-author-email-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/commit-author-name-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/commit-committer-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/commit-message-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/commits-validated.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/committer-email-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/committer-name-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/critical-severity-limit.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/description-substring-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/disallowed-banned-approvers.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/force-push-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/medium-severity-limit.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/member-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/merge-access-level.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/merge-requests-author-approval.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/merge-requests-disable-committers-approval.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/message-substring-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/prevent-secrets-check.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/protect-ci-secrets.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/push-access-level.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/push-rules-set.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/reject-unsigned-commits.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/require-password-to-approve.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/required-minimal-approvers.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/reset-pprovals-on-push.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/sast-scan-pass.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/sast-scanning.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/secrets-scan-pass.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/secrets-scanning.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/selective-code-owner-removals.md (100%) rename docs/configuration/{ => initiatives}/rules/gitlab/project/visibility-check.md (100%) rename docs/configuration/{ => initiatives}/rules/images/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/images/allowed-base-image.md (100%) rename docs/configuration/{ => initiatives}/rules/images/allowed-image-source.md (100%) rename docs/configuration/{ => initiatives}/rules/images/banned-ports.md (100%) rename docs/configuration/{ => initiatives}/rules/images/banned-users.md (100%) rename docs/configuration/{ => initiatives}/rules/images/blocklist-build-scripts.md (100%) rename docs/configuration/{ => initiatives}/rules/images/blocklist-user.md (100%) rename docs/configuration/{ => initiatives}/rules/images/enforce-https-registry.md (100%) rename docs/configuration/{ => initiatives}/rules/images/forbid-large-images.md (100%) rename docs/configuration/{ => initiatives}/rules/images/fresh-base-image.md (100%) rename docs/configuration/{ => initiatives}/rules/images/fresh-image.md (100%) rename docs/configuration/{ => initiatives}/rules/images/image-signed.md (100%) rename docs/configuration/{ => initiatives}/rules/images/require-healthcheck.md (100%) rename docs/configuration/{ => initiatives}/rules/images/restrict-shell-entrypoint.md (100%) rename docs/configuration/{ => initiatives}/rules/images/verify-labels-exist.md (100%) rename docs/configuration/{ => initiatives}/rules/images/verify-labels.md (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/folder/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/folder/exposed-credentials.md (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/instance/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/instance/inactive-users.md (100%) rename docs/configuration/{ => initiatives}/rules/jenkins/instance/unused-users.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/allowed-images.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/allowed-registries.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/verify-namespace-duration.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/verify-namespace-termination.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/white-listed-namespaces.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/namespace/white-listed-pod.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/pods/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/k8s/pods/verify-pod-duration.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/pods/verify-pod-termination.md (100%) rename docs/configuration/{ => initiatives}/rules/k8s/pods/white-listed-pod.md (100%) rename docs/configuration/{ => initiatives}/rules/multievidence/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/multievidence/files_integrity.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/sarif/artifact-signed.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/evidence-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/patcheck/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/sarif/patcheck/updates-needed.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/report-iac-errors.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/blocklist-cve.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/report-trivy-iac-errors.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/verify-cve-severity.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/verify-trivy-attack-vector.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/trivy/verify-trivy-report.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/verify-attack-vector.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/verify-sarif.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/verify-semgrep-report.md (100%) rename docs/configuration/{ => initiatives}/rules/sarif/verify-tool-evidence.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/NTIA-compliance.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/sbom/allowed-components.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/artifact-signed.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/banned-licenses.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/blocklist-packages.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/complete-licenses.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/fresh-sbom.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/require-sbom.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/required-packages.md (100%) rename docs/configuration/{ => initiatives}/rules/sbom/verify-huggingface-license.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/slsa/banned-builder-deps.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/build-time.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/field-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/l1-provenance-exists.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/l2-provenance-authenticated.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/verify-builder.md (100%) rename docs/configuration/{ => initiatives}/rules/slsa/verify-byproducts.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/_category_.json (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-1-2fa.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-1-branch-protection.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-1-limit-admins.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-1-repo-private.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-1-web-commit-signoff.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-2-image-verifiable.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-3.1-code-archived.md (100%) rename docs/configuration/{ => initiatives}/rules/ssdf/ps-3.2-archived-sbom.md (100%) delete mode 100644 docs/configuration/rules/sbom/banned-users.md delete mode 100644 docs/configuration/rules/sbom/evidence-exists.md diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json deleted file mode 100644 index 5a66c74b8..000000000 --- a/docs/configuration/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Configuration", - "position": 30 - } \ No newline at end of file diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 75e2d0507..85d72b377 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -67,7 +67,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](../rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -88,8 +88,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](../rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](../rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -110,7 +110,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](../rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -131,7 +131,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](../rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -156,7 +156,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -198,7 +198,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](../rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -219,7 +219,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -240,7 +240,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](../rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -261,6 +261,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](../rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](../rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](../rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json similarity index 100% rename from docs/configuration/rules/_category_.json rename to docs/configuration/initiatives/rules/_category_.json diff --git a/docs/configuration/rules/api/_category_.json b/docs/configuration/initiatives/rules/api/_category_.json similarity index 100% rename from docs/configuration/rules/api/_category_.json rename to docs/configuration/initiatives/rules/api/_category_.json diff --git a/docs/configuration/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md similarity index 100% rename from docs/configuration/rules/api/scribe-api-cve-product.md rename to docs/configuration/initiatives/rules/api/scribe-api-cve-product.md diff --git a/docs/configuration/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md similarity index 100% rename from docs/configuration/rules/api/scribe-api-cve.md rename to docs/configuration/initiatives/rules/api/scribe-api-cve.md diff --git a/docs/configuration/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md similarity index 100% rename from docs/configuration/rules/api/scribe-api-published.md rename to docs/configuration/initiatives/rules/api/scribe-api-published.md diff --git a/docs/configuration/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md similarity index 100% rename from docs/configuration/rules/api/scribe-api.md rename to docs/configuration/initiatives/rules/api/scribe-api.md diff --git a/docs/configuration/rules/bitbucket/_category_.json b/docs/configuration/initiatives/rules/bitbucket/_category_.json similarity index 100% rename from docs/configuration/rules/bitbucket/_category_.json rename to docs/configuration/initiatives/rules/bitbucket/_category_.json diff --git a/docs/configuration/rules/bitbucket/project/_category_.json b/docs/configuration/initiatives/rules/bitbucket/project/_category_.json similarity index 100% rename from docs/configuration/rules/bitbucket/project/_category_.json rename to docs/configuration/initiatives/rules/bitbucket/project/_category_.json diff --git a/docs/configuration/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md similarity index 100% rename from docs/configuration/rules/bitbucket/project/allow-admins.md rename to docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md diff --git a/docs/configuration/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md similarity index 100% rename from docs/configuration/rules/bitbucket/project/allow-users.md rename to docs/configuration/initiatives/rules/bitbucket/project/allow-users.md diff --git a/docs/configuration/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md similarity index 100% rename from docs/configuration/rules/bitbucket/project/exposed-credentials.md rename to docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md diff --git a/docs/configuration/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md similarity index 100% rename from docs/configuration/rules/bitbucket/project/long-live-tokens.md rename to docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md diff --git a/docs/configuration/rules/bitbucket/repository/_category_.json b/docs/configuration/initiatives/rules/bitbucket/repository/_category_.json similarity index 100% rename from docs/configuration/rules/bitbucket/repository/_category_.json rename to docs/configuration/initiatives/rules/bitbucket/repository/_category_.json diff --git a/docs/configuration/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md similarity index 100% rename from docs/configuration/rules/bitbucket/repository/allow-admins.md rename to docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md diff --git a/docs/configuration/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md similarity index 100% rename from docs/configuration/rules/bitbucket/repository/allow-users.md rename to docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md diff --git a/docs/configuration/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md similarity index 100% rename from docs/configuration/rules/bitbucket/repository/branch-protection.md rename to docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md diff --git a/docs/configuration/rules/bitbucket/workspace/_category_.json b/docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json similarity index 100% rename from docs/configuration/rules/bitbucket/workspace/_category_.json rename to docs/configuration/initiatives/rules/bitbucket/workspace/_category_.json diff --git a/docs/configuration/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md similarity index 100% rename from docs/configuration/rules/bitbucket/workspace/allow-admins.md rename to docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md diff --git a/docs/configuration/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md similarity index 100% rename from docs/configuration/rules/bitbucket/workspace/allow-users.md rename to docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md diff --git a/docs/configuration/rules/dockerhub/_category_.json b/docs/configuration/initiatives/rules/dockerhub/_category_.json similarity index 100% rename from docs/configuration/rules/dockerhub/_category_.json rename to docs/configuration/initiatives/rules/dockerhub/_category_.json diff --git a/docs/configuration/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md similarity index 100% rename from docs/configuration/rules/dockerhub/token-expiration.md rename to docs/configuration/initiatives/rules/dockerhub/token-expiration.md diff --git a/docs/configuration/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md similarity index 100% rename from docs/configuration/rules/dockerhub/token-not-used.md rename to docs/configuration/initiatives/rules/dockerhub/token-not-used.md diff --git a/docs/configuration/rules/generic/_category_.json b/docs/configuration/initiatives/rules/generic/_category_.json similarity index 100% rename from docs/configuration/rules/generic/_category_.json rename to docs/configuration/initiatives/rules/generic/_category_.json diff --git a/docs/configuration/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md similarity index 100% rename from docs/configuration/rules/generic/artifact-signed.md rename to docs/configuration/initiatives/rules/generic/artifact-signed.md diff --git a/docs/configuration/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md similarity index 100% rename from docs/configuration/rules/generic/evidence-exists.md rename to docs/configuration/initiatives/rules/generic/evidence-exists.md diff --git a/docs/configuration/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md similarity index 100% rename from docs/configuration/rules/generic/k8s-jailbreak.md rename to docs/configuration/initiatives/rules/generic/k8s-jailbreak.md diff --git a/docs/configuration/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md similarity index 100% rename from docs/configuration/rules/generic/trivy-exists.md rename to docs/configuration/initiatives/rules/generic/trivy-exists.md diff --git a/docs/configuration/rules/git/_category_.json b/docs/configuration/initiatives/rules/git/_category_.json similarity index 100% rename from docs/configuration/rules/git/_category_.json rename to docs/configuration/initiatives/rules/git/_category_.json diff --git a/docs/configuration/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md similarity index 100% rename from docs/configuration/rules/git/artifact-signed.md rename to docs/configuration/initiatives/rules/git/artifact-signed.md diff --git a/docs/configuration/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md similarity index 100% rename from docs/configuration/rules/git/coding-permissions.md rename to docs/configuration/initiatives/rules/git/coding-permissions.md diff --git a/docs/configuration/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md similarity index 100% rename from docs/configuration/rules/git/evidence-exists.md rename to docs/configuration/initiatives/rules/git/evidence-exists.md diff --git a/docs/configuration/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md similarity index 100% rename from docs/configuration/rules/git/no-commit-to-main.md rename to docs/configuration/initiatives/rules/git/no-commit-to-main.md diff --git a/docs/configuration/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md similarity index 100% rename from docs/configuration/rules/git/no-unsigned-commits.md rename to docs/configuration/initiatives/rules/git/no-unsigned-commits.md diff --git a/docs/configuration/rules/github/_category_.json b/docs/configuration/initiatives/rules/github/_category_.json similarity index 100% rename from docs/configuration/rules/github/_category_.json rename to docs/configuration/initiatives/rules/github/_category_.json diff --git a/docs/configuration/rules/github/api/_category_.json b/docs/configuration/initiatives/rules/github/api/_category_.json similarity index 100% rename from docs/configuration/rules/github/api/_category_.json rename to docs/configuration/initiatives/rules/github/api/_category_.json diff --git a/docs/configuration/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md similarity index 100% rename from docs/configuration/rules/github/api/branch-protection.md rename to docs/configuration/initiatives/rules/github/api/branch-protection.md diff --git a/docs/configuration/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md similarity index 100% rename from docs/configuration/rules/github/api/signed-commits-list.md rename to docs/configuration/initiatives/rules/github/api/signed-commits-list.md diff --git a/docs/configuration/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md similarity index 100% rename from docs/configuration/rules/github/api/signed-commits-range.md rename to docs/configuration/initiatives/rules/github/api/signed-commits-range.md diff --git a/docs/configuration/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md similarity index 100% rename from docs/configuration/rules/github/org/2fa.md rename to docs/configuration/initiatives/rules/github/org/2fa.md diff --git a/docs/configuration/rules/github/org/_category_.json b/docs/configuration/initiatives/rules/github/org/_category_.json similarity index 100% rename from docs/configuration/rules/github/org/_category_.json rename to docs/configuration/initiatives/rules/github/org/_category_.json diff --git a/docs/configuration/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md similarity index 100% rename from docs/configuration/rules/github/org/advanced-security.md rename to docs/configuration/initiatives/rules/github/org/advanced-security.md diff --git a/docs/configuration/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md similarity index 100% rename from docs/configuration/rules/github/org/allow-admins.md rename to docs/configuration/initiatives/rules/github/org/allow-admins.md diff --git a/docs/configuration/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md similarity index 100% rename from docs/configuration/rules/github/org/allow-users.md rename to docs/configuration/initiatives/rules/github/org/allow-users.md diff --git a/docs/configuration/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md similarity index 100% rename from docs/configuration/rules/github/org/create-private-repos.md rename to docs/configuration/initiatives/rules/github/org/create-private-repos.md diff --git a/docs/configuration/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md similarity index 100% rename from docs/configuration/rules/github/org/create-repos.md rename to docs/configuration/initiatives/rules/github/org/create-repos.md diff --git a/docs/configuration/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md similarity index 100% rename from docs/configuration/rules/github/org/dependabot-alerts.md rename to docs/configuration/initiatives/rules/github/org/dependabot-alerts.md diff --git a/docs/configuration/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md similarity index 100% rename from docs/configuration/rules/github/org/dependabot-security-updates-sa.md rename to docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md diff --git a/docs/configuration/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md similarity index 100% rename from docs/configuration/rules/github/org/dependabot-security-updates.md rename to docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md diff --git a/docs/configuration/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md similarity index 100% rename from docs/configuration/rules/github/org/dependency-graph.md rename to docs/configuration/initiatives/rules/github/org/dependency-graph.md diff --git a/docs/configuration/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md similarity index 100% rename from docs/configuration/rules/github/org/max-admins.md rename to docs/configuration/initiatives/rules/github/org/max-admins.md diff --git a/docs/configuration/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md similarity index 100% rename from docs/configuration/rules/github/org/old-secrets.md rename to docs/configuration/initiatives/rules/github/org/old-secrets.md diff --git a/docs/configuration/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md similarity index 100% rename from docs/configuration/rules/github/org/pp-custom-link.md rename to docs/configuration/initiatives/rules/github/org/pp-custom-link.md diff --git a/docs/configuration/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md similarity index 100% rename from docs/configuration/rules/github/org/push-protection-sa.md rename to docs/configuration/initiatives/rules/github/org/push-protection-sa.md diff --git a/docs/configuration/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md similarity index 100% rename from docs/configuration/rules/github/org/push-protection.md rename to docs/configuration/initiatives/rules/github/org/push-protection.md diff --git a/docs/configuration/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md similarity index 100% rename from docs/configuration/rules/github/org/repo-visibility.md rename to docs/configuration/initiatives/rules/github/org/repo-visibility.md diff --git a/docs/configuration/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md similarity index 100% rename from docs/configuration/rules/github/org/secret-scanning-sa.md rename to docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md diff --git a/docs/configuration/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md similarity index 100% rename from docs/configuration/rules/github/org/secret-scanning.md rename to docs/configuration/initiatives/rules/github/org/secret-scanning.md diff --git a/docs/configuration/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md similarity index 100% rename from docs/configuration/rules/github/org/validity-checks-sa.md rename to docs/configuration/initiatives/rules/github/org/validity-checks-sa.md diff --git a/docs/configuration/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md similarity index 100% rename from docs/configuration/rules/github/org/validity-checks.md rename to docs/configuration/initiatives/rules/github/org/validity-checks.md diff --git a/docs/configuration/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md similarity index 100% rename from docs/configuration/rules/github/org/web-commit-signoff.md rename to docs/configuration/initiatives/rules/github/org/web-commit-signoff.md diff --git a/docs/configuration/rules/github/repository/_category_.json b/docs/configuration/initiatives/rules/github/repository/_category_.json similarity index 100% rename from docs/configuration/rules/github/repository/_category_.json rename to docs/configuration/initiatives/rules/github/repository/_category_.json diff --git a/docs/configuration/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md similarity index 100% rename from docs/configuration/rules/github/repository/branch-protection.md rename to docs/configuration/initiatives/rules/github/repository/branch-protection.md diff --git a/docs/configuration/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md similarity index 100% rename from docs/configuration/rules/github/repository/branch-verification.md rename to docs/configuration/initiatives/rules/github/repository/branch-verification.md diff --git a/docs/configuration/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md similarity index 100% rename from docs/configuration/rules/github/repository/check-signed-commits.md rename to docs/configuration/initiatives/rules/github/repository/check-signed-commits.md diff --git a/docs/configuration/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md similarity index 100% rename from docs/configuration/rules/github/repository/default-branch-protection.md rename to docs/configuration/initiatives/rules/github/repository/default-branch-protection.md diff --git a/docs/configuration/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md similarity index 100% rename from docs/configuration/rules/github/repository/dependabot.md rename to docs/configuration/initiatives/rules/github/repository/dependabot.md diff --git a/docs/configuration/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md similarity index 100% rename from docs/configuration/rules/github/repository/ephemeral-runners-only.md rename to docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md diff --git a/docs/configuration/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md similarity index 100% rename from docs/configuration/rules/github/repository/no-cache-usage.md rename to docs/configuration/initiatives/rules/github/repository/no-cache-usage.md diff --git a/docs/configuration/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md similarity index 100% rename from docs/configuration/rules/github/repository/no-org-secrets.md rename to docs/configuration/initiatives/rules/github/repository/no-org-secrets.md diff --git a/docs/configuration/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md similarity index 100% rename from docs/configuration/rules/github/repository/old-secrets.md rename to docs/configuration/initiatives/rules/github/repository/old-secrets.md diff --git a/docs/configuration/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md similarity index 100% rename from docs/configuration/rules/github/repository/push-protection.md rename to docs/configuration/initiatives/rules/github/repository/push-protection.md diff --git a/docs/configuration/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md similarity index 100% rename from docs/configuration/rules/github/repository/repo-private.md rename to docs/configuration/initiatives/rules/github/repository/repo-private.md diff --git a/docs/configuration/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md similarity index 100% rename from docs/configuration/rules/github/repository/secret-scanning.md rename to docs/configuration/initiatives/rules/github/repository/secret-scanning.md diff --git a/docs/configuration/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md similarity index 100% rename from docs/configuration/rules/github/repository/signed-commits.md rename to docs/configuration/initiatives/rules/github/repository/signed-commits.md diff --git a/docs/configuration/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md similarity index 100% rename from docs/configuration/rules/github/repository/validity-checks.md rename to docs/configuration/initiatives/rules/github/repository/validity-checks.md diff --git a/docs/configuration/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md similarity index 100% rename from docs/configuration/rules/github/repository/visibility.md rename to docs/configuration/initiatives/rules/github/repository/visibility.md diff --git a/docs/configuration/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md similarity index 100% rename from docs/configuration/rules/github/repository/web-commit-signoff.md rename to docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md diff --git a/docs/configuration/rules/gitlab/_category_.json b/docs/configuration/initiatives/rules/gitlab/_category_.json similarity index 100% rename from docs/configuration/rules/gitlab/_category_.json rename to docs/configuration/initiatives/rules/gitlab/_category_.json diff --git a/docs/configuration/rules/gitlab/api/_category_.json b/docs/configuration/initiatives/rules/gitlab/api/_category_.json similarity index 100% rename from docs/configuration/rules/gitlab/api/_category_.json rename to docs/configuration/initiatives/rules/gitlab/api/_category_.json diff --git a/docs/configuration/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md similarity index 100% rename from docs/configuration/rules/gitlab/api/push-rules.md rename to docs/configuration/initiatives/rules/gitlab/api/push-rules.md diff --git a/docs/configuration/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md similarity index 100% rename from docs/configuration/rules/gitlab/api/signed-commits-list.md rename to docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md diff --git a/docs/configuration/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md similarity index 100% rename from docs/configuration/rules/gitlab/api/signed-commits-range.md rename to docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md diff --git a/docs/configuration/rules/gitlab/org/_category_.json b/docs/configuration/initiatives/rules/gitlab/org/_category_.json similarity index 100% rename from docs/configuration/rules/gitlab/org/_category_.json rename to docs/configuration/initiatives/rules/gitlab/org/_category_.json diff --git a/docs/configuration/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md similarity index 100% rename from docs/configuration/rules/gitlab/org/allow-admins.md rename to docs/configuration/initiatives/rules/gitlab/org/allow-admins.md diff --git a/docs/configuration/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md similarity index 100% rename from docs/configuration/rules/gitlab/org/allow-token-scopes.md rename to docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md diff --git a/docs/configuration/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md similarity index 100% rename from docs/configuration/rules/gitlab/org/allow-users.md rename to docs/configuration/initiatives/rules/gitlab/org/allow-users.md diff --git a/docs/configuration/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md similarity index 100% rename from docs/configuration/rules/gitlab/org/blocked-users.md rename to docs/configuration/initiatives/rules/gitlab/org/blocked-users.md diff --git a/docs/configuration/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md similarity index 100% rename from docs/configuration/rules/gitlab/org/expiring-tokens.md rename to docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md diff --git a/docs/configuration/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md similarity index 100% rename from docs/configuration/rules/gitlab/org/forbid-token-scopes.md rename to docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md diff --git a/docs/configuration/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md similarity index 100% rename from docs/configuration/rules/gitlab/org/inactive-projects.md rename to docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md diff --git a/docs/configuration/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md similarity index 100% rename from docs/configuration/rules/gitlab/org/longlive-tokens.md rename to docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md diff --git a/docs/configuration/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md similarity index 100% rename from docs/configuration/rules/gitlab/org/max-admins.md rename to docs/configuration/initiatives/rules/gitlab/org/max-admins.md diff --git a/docs/configuration/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md similarity index 100% rename from docs/configuration/rules/gitlab/org/projects-visibility.md rename to docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md diff --git a/docs/configuration/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md similarity index 100% rename from docs/configuration/rules/gitlab/org/unused-tokens.md rename to docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md diff --git a/docs/configuration/rules/gitlab/pipeline/_category_.json b/docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json similarity index 100% rename from docs/configuration/rules/gitlab/pipeline/_category_.json rename to docs/configuration/initiatives/rules/gitlab/pipeline/_category_.json diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md similarity index 100% rename from docs/configuration/rules/gitlab/pipeline/verify-labels-exist.md rename to docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md diff --git a/docs/configuration/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md similarity index 100% rename from docs/configuration/rules/gitlab/pipeline/verify-labels.md rename to docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md diff --git a/docs/configuration/rules/gitlab/project/_category_.json b/docs/configuration/initiatives/rules/gitlab/project/_category_.json similarity index 100% rename from docs/configuration/rules/gitlab/project/_category_.json rename to docs/configuration/initiatives/rules/gitlab/project/_category_.json diff --git a/docs/configuration/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md similarity index 100% rename from docs/configuration/rules/gitlab/project/abandoned-project.md rename to docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md diff --git a/docs/configuration/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/approvals-policy-check.md rename to docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md diff --git a/docs/configuration/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md similarity index 100% rename from docs/configuration/rules/gitlab/project/approvers-per-merge-request.md rename to docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md diff --git a/docs/configuration/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md similarity index 100% rename from docs/configuration/rules/gitlab/project/author-email-regex.md rename to docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md diff --git a/docs/configuration/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md similarity index 100% rename from docs/configuration/rules/gitlab/project/check-cwe.md rename to docs/configuration/initiatives/rules/gitlab/project/check-cwe.md diff --git a/docs/configuration/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md similarity index 100% rename from docs/configuration/rules/gitlab/project/check-signed-commits.md rename to docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md diff --git a/docs/configuration/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md similarity index 100% rename from docs/configuration/rules/gitlab/project/co-approval-required.md rename to docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md diff --git a/docs/configuration/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/commit-author-email-check.md rename to docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md diff --git a/docs/configuration/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/commit-author-name-check.md rename to docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md diff --git a/docs/configuration/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/commit-committer-check.md rename to docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md diff --git a/docs/configuration/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/commit-message-check.md rename to docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md diff --git a/docs/configuration/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md similarity index 100% rename from docs/configuration/rules/gitlab/project/commits-validated.md rename to docs/configuration/initiatives/rules/gitlab/project/commits-validated.md diff --git a/docs/configuration/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/committer-email-check.md rename to docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md diff --git a/docs/configuration/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/committer-name-check.md rename to docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md diff --git a/docs/configuration/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md similarity index 100% rename from docs/configuration/rules/gitlab/project/critical-severity-limit.md rename to docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md diff --git a/docs/configuration/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/description-substring-check.md rename to docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md diff --git a/docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md similarity index 100% rename from docs/configuration/rules/gitlab/project/disallowed-banned-approvers.md rename to docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md diff --git a/docs/configuration/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md similarity index 100% rename from docs/configuration/rules/gitlab/project/force-push-protection.md rename to docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md diff --git a/docs/configuration/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md similarity index 100% rename from docs/configuration/rules/gitlab/project/medium-severity-limit.md rename to docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md diff --git a/docs/configuration/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/member-check.md rename to docs/configuration/initiatives/rules/gitlab/project/member-check.md diff --git a/docs/configuration/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md similarity index 100% rename from docs/configuration/rules/gitlab/project/merge-access-level.md rename to docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md diff --git a/docs/configuration/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md similarity index 100% rename from docs/configuration/rules/gitlab/project/merge-requests-author-approval.md rename to docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md diff --git a/docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md similarity index 100% rename from docs/configuration/rules/gitlab/project/merge-requests-disable-committers-approval.md rename to docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md diff --git a/docs/configuration/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/message-substring-check.md rename to docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md diff --git a/docs/configuration/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/prevent-secrets-check.md rename to docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md diff --git a/docs/configuration/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md similarity index 100% rename from docs/configuration/rules/gitlab/project/protect-ci-secrets.md rename to docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md diff --git a/docs/configuration/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md similarity index 100% rename from docs/configuration/rules/gitlab/project/push-access-level.md rename to docs/configuration/initiatives/rules/gitlab/project/push-access-level.md diff --git a/docs/configuration/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md similarity index 100% rename from docs/configuration/rules/gitlab/project/push-rules-set.md rename to docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md diff --git a/docs/configuration/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md similarity index 100% rename from docs/configuration/rules/gitlab/project/reject-unsigned-commits.md rename to docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md diff --git a/docs/configuration/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md similarity index 100% rename from docs/configuration/rules/gitlab/project/require-password-to-approve.md rename to docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md diff --git a/docs/configuration/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md similarity index 100% rename from docs/configuration/rules/gitlab/project/required-minimal-approvers.md rename to docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md diff --git a/docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md similarity index 100% rename from docs/configuration/rules/gitlab/project/reset-pprovals-on-push.md rename to docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md diff --git a/docs/configuration/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md similarity index 100% rename from docs/configuration/rules/gitlab/project/sast-scan-pass.md rename to docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md diff --git a/docs/configuration/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md similarity index 100% rename from docs/configuration/rules/gitlab/project/sast-scanning.md rename to docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md diff --git a/docs/configuration/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md similarity index 100% rename from docs/configuration/rules/gitlab/project/secrets-scan-pass.md rename to docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md diff --git a/docs/configuration/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md similarity index 100% rename from docs/configuration/rules/gitlab/project/secrets-scanning.md rename to docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md diff --git a/docs/configuration/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md similarity index 100% rename from docs/configuration/rules/gitlab/project/selective-code-owner-removals.md rename to docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md diff --git a/docs/configuration/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md similarity index 100% rename from docs/configuration/rules/gitlab/project/visibility-check.md rename to docs/configuration/initiatives/rules/gitlab/project/visibility-check.md diff --git a/docs/configuration/rules/images/_category_.json b/docs/configuration/initiatives/rules/images/_category_.json similarity index 100% rename from docs/configuration/rules/images/_category_.json rename to docs/configuration/initiatives/rules/images/_category_.json diff --git a/docs/configuration/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md similarity index 100% rename from docs/configuration/rules/images/allowed-base-image.md rename to docs/configuration/initiatives/rules/images/allowed-base-image.md diff --git a/docs/configuration/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md similarity index 100% rename from docs/configuration/rules/images/allowed-image-source.md rename to docs/configuration/initiatives/rules/images/allowed-image-source.md diff --git a/docs/configuration/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md similarity index 100% rename from docs/configuration/rules/images/banned-ports.md rename to docs/configuration/initiatives/rules/images/banned-ports.md diff --git a/docs/configuration/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md similarity index 100% rename from docs/configuration/rules/images/banned-users.md rename to docs/configuration/initiatives/rules/images/banned-users.md diff --git a/docs/configuration/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md similarity index 100% rename from docs/configuration/rules/images/blocklist-build-scripts.md rename to docs/configuration/initiatives/rules/images/blocklist-build-scripts.md diff --git a/docs/configuration/rules/images/blocklist-user.md b/docs/configuration/initiatives/rules/images/blocklist-user.md similarity index 100% rename from docs/configuration/rules/images/blocklist-user.md rename to docs/configuration/initiatives/rules/images/blocklist-user.md diff --git a/docs/configuration/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md similarity index 100% rename from docs/configuration/rules/images/enforce-https-registry.md rename to docs/configuration/initiatives/rules/images/enforce-https-registry.md diff --git a/docs/configuration/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md similarity index 100% rename from docs/configuration/rules/images/forbid-large-images.md rename to docs/configuration/initiatives/rules/images/forbid-large-images.md diff --git a/docs/configuration/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md similarity index 100% rename from docs/configuration/rules/images/fresh-base-image.md rename to docs/configuration/initiatives/rules/images/fresh-base-image.md diff --git a/docs/configuration/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md similarity index 100% rename from docs/configuration/rules/images/fresh-image.md rename to docs/configuration/initiatives/rules/images/fresh-image.md diff --git a/docs/configuration/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md similarity index 100% rename from docs/configuration/rules/images/image-signed.md rename to docs/configuration/initiatives/rules/images/image-signed.md diff --git a/docs/configuration/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md similarity index 100% rename from docs/configuration/rules/images/require-healthcheck.md rename to docs/configuration/initiatives/rules/images/require-healthcheck.md diff --git a/docs/configuration/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md similarity index 100% rename from docs/configuration/rules/images/restrict-shell-entrypoint.md rename to docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md diff --git a/docs/configuration/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md similarity index 100% rename from docs/configuration/rules/images/verify-labels-exist.md rename to docs/configuration/initiatives/rules/images/verify-labels-exist.md diff --git a/docs/configuration/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md similarity index 100% rename from docs/configuration/rules/images/verify-labels.md rename to docs/configuration/initiatives/rules/images/verify-labels.md diff --git a/docs/configuration/rules/jenkins/_category_.json b/docs/configuration/initiatives/rules/jenkins/_category_.json similarity index 100% rename from docs/configuration/rules/jenkins/_category_.json rename to docs/configuration/initiatives/rules/jenkins/_category_.json diff --git a/docs/configuration/rules/jenkins/folder/_category_.json b/docs/configuration/initiatives/rules/jenkins/folder/_category_.json similarity index 100% rename from docs/configuration/rules/jenkins/folder/_category_.json rename to docs/configuration/initiatives/rules/jenkins/folder/_category_.json diff --git a/docs/configuration/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md similarity index 100% rename from docs/configuration/rules/jenkins/folder/exposed-credentials.md rename to docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md diff --git a/docs/configuration/rules/jenkins/instance/_category_.json b/docs/configuration/initiatives/rules/jenkins/instance/_category_.json similarity index 100% rename from docs/configuration/rules/jenkins/instance/_category_.json rename to docs/configuration/initiatives/rules/jenkins/instance/_category_.json diff --git a/docs/configuration/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md similarity index 100% rename from docs/configuration/rules/jenkins/instance/inactive-users.md rename to docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md diff --git a/docs/configuration/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md similarity index 100% rename from docs/configuration/rules/jenkins/instance/unused-users.md rename to docs/configuration/initiatives/rules/jenkins/instance/unused-users.md diff --git a/docs/configuration/rules/k8s/_category_.json b/docs/configuration/initiatives/rules/k8s/_category_.json similarity index 100% rename from docs/configuration/rules/k8s/_category_.json rename to docs/configuration/initiatives/rules/k8s/_category_.json diff --git a/docs/configuration/rules/k8s/namespace/_category_.json b/docs/configuration/initiatives/rules/k8s/namespace/_category_.json similarity index 100% rename from docs/configuration/rules/k8s/namespace/_category_.json rename to docs/configuration/initiatives/rules/k8s/namespace/_category_.json diff --git a/docs/configuration/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/allowed-images.md rename to docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md diff --git a/docs/configuration/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/allowed-registries.md rename to docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/verify-namespace-duration.md rename to docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md diff --git a/docs/configuration/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/verify-namespace-termination.md rename to docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md diff --git a/docs/configuration/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/white-listed-namespaces.md rename to docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md diff --git a/docs/configuration/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md similarity index 100% rename from docs/configuration/rules/k8s/namespace/white-listed-pod.md rename to docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md diff --git a/docs/configuration/rules/k8s/pods/_category_.json b/docs/configuration/initiatives/rules/k8s/pods/_category_.json similarity index 100% rename from docs/configuration/rules/k8s/pods/_category_.json rename to docs/configuration/initiatives/rules/k8s/pods/_category_.json diff --git a/docs/configuration/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md similarity index 100% rename from docs/configuration/rules/k8s/pods/verify-pod-duration.md rename to docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md diff --git a/docs/configuration/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md similarity index 100% rename from docs/configuration/rules/k8s/pods/verify-pod-termination.md rename to docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md diff --git a/docs/configuration/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md similarity index 100% rename from docs/configuration/rules/k8s/pods/white-listed-pod.md rename to docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md diff --git a/docs/configuration/rules/multievidence/_category_.json b/docs/configuration/initiatives/rules/multievidence/_category_.json similarity index 100% rename from docs/configuration/rules/multievidence/_category_.json rename to docs/configuration/initiatives/rules/multievidence/_category_.json diff --git a/docs/configuration/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md similarity index 100% rename from docs/configuration/rules/multievidence/files_integrity.md rename to docs/configuration/initiatives/rules/multievidence/files_integrity.md diff --git a/docs/configuration/rules/sarif/_category_.json b/docs/configuration/initiatives/rules/sarif/_category_.json similarity index 100% rename from docs/configuration/rules/sarif/_category_.json rename to docs/configuration/initiatives/rules/sarif/_category_.json diff --git a/docs/configuration/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md similarity index 100% rename from docs/configuration/rules/sarif/artifact-signed.md rename to docs/configuration/initiatives/rules/sarif/artifact-signed.md diff --git a/docs/configuration/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md similarity index 100% rename from docs/configuration/rules/sarif/evidence-exists.md rename to docs/configuration/initiatives/rules/sarif/evidence-exists.md diff --git a/docs/configuration/rules/sarif/patcheck/_category_.json b/docs/configuration/initiatives/rules/sarif/patcheck/_category_.json similarity index 100% rename from docs/configuration/rules/sarif/patcheck/_category_.json rename to docs/configuration/initiatives/rules/sarif/patcheck/_category_.json diff --git a/docs/configuration/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md similarity index 100% rename from docs/configuration/rules/sarif/patcheck/updates-needed.md rename to docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md diff --git a/docs/configuration/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md similarity index 100% rename from docs/configuration/rules/sarif/report-iac-errors.md rename to docs/configuration/initiatives/rules/sarif/report-iac-errors.md diff --git a/docs/configuration/rules/sarif/trivy/_category_.json b/docs/configuration/initiatives/rules/sarif/trivy/_category_.json similarity index 100% rename from docs/configuration/rules/sarif/trivy/_category_.json rename to docs/configuration/initiatives/rules/sarif/trivy/_category_.json diff --git a/docs/configuration/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md similarity index 100% rename from docs/configuration/rules/sarif/trivy/blocklist-cve.md rename to docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md diff --git a/docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md similarity index 100% rename from docs/configuration/rules/sarif/trivy/report-trivy-iac-errors.md rename to docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md diff --git a/docs/configuration/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md similarity index 100% rename from docs/configuration/rules/sarif/trivy/verify-cve-severity.md rename to docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md similarity index 100% rename from docs/configuration/rules/sarif/trivy/verify-trivy-attack-vector.md rename to docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md diff --git a/docs/configuration/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md similarity index 100% rename from docs/configuration/rules/sarif/trivy/verify-trivy-report.md rename to docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md diff --git a/docs/configuration/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md similarity index 100% rename from docs/configuration/rules/sarif/verify-attack-vector.md rename to docs/configuration/initiatives/rules/sarif/verify-attack-vector.md diff --git a/docs/configuration/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md similarity index 100% rename from docs/configuration/rules/sarif/verify-sarif.md rename to docs/configuration/initiatives/rules/sarif/verify-sarif.md diff --git a/docs/configuration/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md similarity index 100% rename from docs/configuration/rules/sarif/verify-semgrep-report.md rename to docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md diff --git a/docs/configuration/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md similarity index 100% rename from docs/configuration/rules/sarif/verify-tool-evidence.md rename to docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md diff --git a/docs/configuration/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md similarity index 100% rename from docs/configuration/rules/sbom/NTIA-compliance.md rename to docs/configuration/initiatives/rules/sbom/NTIA-compliance.md diff --git a/docs/configuration/rules/sbom/_category_.json b/docs/configuration/initiatives/rules/sbom/_category_.json similarity index 100% rename from docs/configuration/rules/sbom/_category_.json rename to docs/configuration/initiatives/rules/sbom/_category_.json diff --git a/docs/configuration/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md similarity index 100% rename from docs/configuration/rules/sbom/allowed-components.md rename to docs/configuration/initiatives/rules/sbom/allowed-components.md diff --git a/docs/configuration/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md similarity index 100% rename from docs/configuration/rules/sbom/artifact-signed.md rename to docs/configuration/initiatives/rules/sbom/artifact-signed.md diff --git a/docs/configuration/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md similarity index 100% rename from docs/configuration/rules/sbom/banned-licenses.md rename to docs/configuration/initiatives/rules/sbom/banned-licenses.md diff --git a/docs/configuration/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md similarity index 100% rename from docs/configuration/rules/sbom/blocklist-packages.md rename to docs/configuration/initiatives/rules/sbom/blocklist-packages.md diff --git a/docs/configuration/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md similarity index 100% rename from docs/configuration/rules/sbom/complete-licenses.md rename to docs/configuration/initiatives/rules/sbom/complete-licenses.md diff --git a/docs/configuration/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md similarity index 100% rename from docs/configuration/rules/sbom/fresh-sbom.md rename to docs/configuration/initiatives/rules/sbom/fresh-sbom.md diff --git a/docs/configuration/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md similarity index 100% rename from docs/configuration/rules/sbom/require-sbom.md rename to docs/configuration/initiatives/rules/sbom/require-sbom.md diff --git a/docs/configuration/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md similarity index 100% rename from docs/configuration/rules/sbom/required-packages.md rename to docs/configuration/initiatives/rules/sbom/required-packages.md diff --git a/docs/configuration/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md similarity index 100% rename from docs/configuration/rules/sbom/verify-huggingface-license.md rename to docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md diff --git a/docs/configuration/rules/slsa/_category_.json b/docs/configuration/initiatives/rules/slsa/_category_.json similarity index 100% rename from docs/configuration/rules/slsa/_category_.json rename to docs/configuration/initiatives/rules/slsa/_category_.json diff --git a/docs/configuration/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md similarity index 100% rename from docs/configuration/rules/slsa/banned-builder-deps.md rename to docs/configuration/initiatives/rules/slsa/banned-builder-deps.md diff --git a/docs/configuration/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md similarity index 100% rename from docs/configuration/rules/slsa/build-time.md rename to docs/configuration/initiatives/rules/slsa/build-time.md diff --git a/docs/configuration/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md similarity index 100% rename from docs/configuration/rules/slsa/field-exists.md rename to docs/configuration/initiatives/rules/slsa/field-exists.md diff --git a/docs/configuration/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md similarity index 100% rename from docs/configuration/rules/slsa/l1-provenance-exists.md rename to docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md diff --git a/docs/configuration/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md similarity index 100% rename from docs/configuration/rules/slsa/l2-provenance-authenticated.md rename to docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md diff --git a/docs/configuration/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md similarity index 100% rename from docs/configuration/rules/slsa/verify-builder.md rename to docs/configuration/initiatives/rules/slsa/verify-builder.md diff --git a/docs/configuration/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md similarity index 100% rename from docs/configuration/rules/slsa/verify-byproducts.md rename to docs/configuration/initiatives/rules/slsa/verify-byproducts.md diff --git a/docs/configuration/rules/ssdf/_category_.json b/docs/configuration/initiatives/rules/ssdf/_category_.json similarity index 100% rename from docs/configuration/rules/ssdf/_category_.json rename to docs/configuration/initiatives/rules/ssdf/_category_.json diff --git a/docs/configuration/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-1-2fa.md rename to docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md diff --git a/docs/configuration/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-1-branch-protection.md rename to docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md diff --git a/docs/configuration/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-1-limit-admins.md rename to docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md diff --git a/docs/configuration/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-1-repo-private.md rename to docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md diff --git a/docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-1-web-commit-signoff.md rename to docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md diff --git a/docs/configuration/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-2-image-verifiable.md rename to docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md diff --git a/docs/configuration/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-3.1-code-archived.md rename to docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md diff --git a/docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md similarity index 100% rename from docs/configuration/rules/ssdf/ps-3.2-archived-sbom.md rename to docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 559f15f01..985c77fa8 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -46,4 +46,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](../rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 2ef4131ff..e4e0daa1b 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -46,5 +46,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](../rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](../rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 3745ccac7..164e14c5b 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -50,23 +50,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](../rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](../rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](../rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](../rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](../rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](../rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](../rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](../rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/image-signed.md) | [4.1.5 Signed Images](../rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -83,9 +83,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](../rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](../rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](../rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 2f598fcfa..b35a3aefe 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -53,10 +53,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Require SBOM](../rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [Verify Supply Chain Labels](../rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](../rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -72,7 +72,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Require Provenance](../rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -87,5 +87,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](../rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](../rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 1b8804c30..f717c4773 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -52,8 +52,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](../rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](../rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## [] SSDF-ORG @@ -68,9 +68,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](../rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](../rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](../rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## [] SSDF-REPO @@ -85,8 +85,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](../rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](../rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-repo-private.md) | [Repo private](../rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-repo-private.md) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | diff --git a/docs/configuration/rules/sbom/banned-users.md b/docs/configuration/rules/sbom/banned-users.md deleted file mode 100644 index 3da488306..000000000 --- a/docs/configuration/rules/sbom/banned-users.md +++ /dev/null @@ -1,24 +0,0 @@ -# Disallow Specific Users in SBOM -**Type:** Rule -**ID:** `sbom-disallowed-users` -**Uses:** `sbom/banned-users@v2/rules` -**Source:** [v2/rules/sbom/banned-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-users.yaml) -**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-users.rego) -**Labels:** SBOM, Image - -Verify specific users are not allowed in an SBOM. - -> Rule Result will be set as 'open' if evidence is missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| users | ['root'] | diff --git a/docs/configuration/rules/sbom/evidence-exists.md b/docs/configuration/rules/sbom/evidence-exists.md deleted file mode 100644 index 5860a11f0..000000000 --- a/docs/configuration/rules/sbom/evidence-exists.md +++ /dev/null @@ -1,21 +0,0 @@ -# Require SBOM Existence -**Type:** Rule -**ID:** `require-sbom` -**Uses:** `sbom/evidence-exists@v2/rules` -**Source:** [v2/rules/sbom/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/evidence-exists.rego) -**Labels:** SBOM, Blueprint - -Verify the SBOM exists as evidence. - -> Evidence **IS** required for this rule and will fail if missing. -> Signed Evidence for this rule **IS NOT** required by default but is recommended. -> This rule scoped by product and target. - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| content_body_type | cyclonedx-json | -| signed | False | - From 7c7c3a67e24f58dbd57d8e84d70453d6a5c6136d Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 12:57:08 +0200 Subject: [PATCH 071/191] tmp gen docs --- docs/configuration/initiatives/bp1.md | 5 +++-- docs/configuration/initiatives/slsa.l1.md | 5 +++-- docs/configuration/initiatives/slsa.l2.md | 5 +++-- docs/configuration/initiatives/sp-800-190.md | 5 +++-- docs/configuration/initiatives/sp-800-53.md | 5 +++-- docs/configuration/initiatives/ssdf.md | 5 +++-- 6 files changed, 18 insertions(+), 12 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 85d72b377..7a3b2f1d7 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -16,8 +16,9 @@ A comprehensive framework to secure the software supply chain by integrating rob By enforcing layered security controls across all phases of the software development lifecycle, this initiative significantly reduces the risk of supply chain compromises and ensures that only verified and trustworthy software components are deployed. **Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline -> Evidence for this initiative **IS** required by default.** - +:::tip +Evidence for this initiative **IS** required by default.** +::: ## **Description** This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 985c77fa8..69010130c 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -12,8 +12,9 @@ title: "SLSA L1 Framework\u201D" Evaluate SLSA Level 1 **Help:** https://slsa.dev/ -> Evidence for this initiative **IS NOT** required by default but is recommended. - +:::tip +Evidence for this initiative **IS NOT** required by default but is recommended. +::: ## **Description** This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index e4e0daa1b..dcf9054d8 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -12,8 +12,9 @@ title: "SLSA L2 Framework\u201D" Evaluate SLSA Level 2 **Help:** https://slsa.dev/ -> Evidence for this initiative **IS NOT** required by default but is recommended. - +:::tip +Evidence for this initiative **IS NOT** required by default but is recommended. +::: ## **Description** Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 164e14c5b..035c06be0 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -13,8 +13,9 @@ This initiative enforces container security controls as outlined in NIST SP 800 **Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final -> Evidence for this initiative **IS NOT** required by default but is recommended. - +:::tip +Evidence for this initiative **IS NOT** required by default but is recommended. +::: ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index b35a3aefe..d5e1fade6 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -17,8 +17,9 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m **Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final -> Evidence for this initiative **IS NOT** required by default but is recommended. - +:::tip +Evidence for this initiative **IS NOT** required by default but is recommended. +::: ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index f717c4773..b1e22ffae 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -12,8 +12,9 @@ title: SSDF Client Initiative Evaluate PS rules from the SSDF initiative **Help:** https://csrc.nist.gov/pubs/sp/800/218/final -> Evidence for this initiative **IS NOT** required by default but is recommended. - +:::tip +Evidence for this initiative **IS NOT** required by default but is recommended. +::: ## **Description** This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. From ab380a83eb56d8fd53d4a1f74c5cecaf3482b433 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:17:54 +0200 Subject: [PATCH 072/191] tmp gen docs --- docs/configuration/initiatives/rules/_category_.json | 2 +- docs/configuration/initiatives/rules/gitlab/api/_category_.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json index 03176cc52..45eb2b74f 100644 --- a/docs/configuration/initiatives/rules/_category_.json +++ b/docs/configuration/initiatives/rules/_category_.json @@ -1,4 +1,4 @@ { "label": "Rule Configuration", - "position": 2 + "position": 10 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/gitlab/api/_category_.json b/docs/configuration/initiatives/rules/gitlab/api/_category_.json index c9d731c03..1cd6c97e0 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/_category_.json +++ b/docs/configuration/initiatives/rules/gitlab/api/_category_.json @@ -1,4 +1,4 @@ { - "label": "Api", + "label": "Gitlab API", "position": 1 } \ No newline at end of file From 249cea30dfde4167f21aa4a1713e2a9cb3766162 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:26:33 +0200 Subject: [PATCH 073/191] tmp gen docs --- docs/configuration/initiatives/slsa.l1.md | 6 +++--- docs/configuration/initiatives/slsa.l2.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 69010130c..992698232 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -1,8 +1,8 @@ --- -sidebar_label: "SLSA L1 Framework\u201D" -title: "SLSA L1 Framework\u201D" +sidebar_label: SLSA L1 Framework +title: SLSA L1 Framework --- -# SLSA L1 Framework” +# SLSA L1 Framework **Type:** Initiative **ID:** `SLSA.L1` **Version:** `1.0.0` diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index dcf9054d8..32e6251de 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -1,8 +1,8 @@ --- -sidebar_label: "SLSA L2 Framework\u201D" -title: "SLSA L2 Framework\u201D" +sidebar_label: SLSA L2 Framework2 +title: SLSA L2 Framework2 --- -# SLSA L2 Framework” +# SLSA L2 Framework2 **Type:** Initiative **ID:** `SLSA.L2` **Version:** `1.0.0` From 5f0d91427126b6398b0a154f0901b4233809169a Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:27:20 +0200 Subject: [PATCH 074/191] tmp gen docs --- docs/configuration/initiatives/slsa.l2.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 32e6251de..019e17ba1 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -1,8 +1,8 @@ --- -sidebar_label: SLSA L2 Framework2 -title: SLSA L2 Framework2 +sidebar_label: SLSA L2 Framework +title: SLSA L2 Framework --- -# SLSA L2 Framework2 +# SLSA L2 Framework **Type:** Initiative **ID:** `SLSA.L2` **Version:** `1.0.0` From 0ee3aa3179d20d429da9e2b96397213aa604cf23 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:28:13 +0200 Subject: [PATCH 075/191] tmp gen docs --- docs/configuration/_category_.json | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 docs/configuration/_category_.json diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json new file mode 100644 index 000000000..edc80b142 --- /dev/null +++ b/docs/configuration/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Configuration", + "position": 1 +} \ No newline at end of file From af8e9df5c370b452c02c5780596dd21d59c85e8e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:34:12 +0200 Subject: [PATCH 076/191] tmp gen docs --- .../initiatives/rules/images/restrict-shell-entrypoint.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index afc93b91e..d2e1d14d4 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -28,8 +28,7 @@ his rule requires evaluation with a target; without one, the rule will be **disa ::: ## Description -This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). -**Evidence Requirements:** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". +This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash').
test ### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". ## Evidence Requirements From 3af3cc916e08d02dcb483e35d81b7d30e5159f4f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:41:55 +0200 Subject: [PATCH 077/191] tmp gen docs --- docs/configuration/initiatives/rules/github/org/2fa.md | 2 +- .../initiatives/rules/images/forbid-large-images.md | 2 +- docs/configuration/initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/verify-labels-exist.md | 2 +- docs/configuration/initiatives/rules/images/verify-labels.md | 2 +- docs/configuration/initiatives/rules/sarif/artifact-signed.md | 2 +- docs/configuration/initiatives/rules/sarif/report-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 2 +- .../initiatives/rules/sarif/trivy/report-trivy-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/verify-cve-severity.md | 2 +- .../initiatives/rules/sarif/trivy/verify-trivy-report.md | 2 +- .../initiatives/rules/sarif/verify-attack-vector.md | 2 +- docs/configuration/initiatives/rules/sarif/verify-sarif.md | 2 +- .../initiatives/rules/sarif/verify-semgrep-report.md | 2 +- .../initiatives/rules/sarif/verify-tool-evidence.md | 2 +- docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md | 2 +- 16 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 7dbecb536..63bae84fb 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -36,7 +36,7 @@ The rule iterates over the organization data in the evidence, and if the `two_fa the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional layer of security against unauthorized access. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. - The data should come from a trusted source (e.g., a GitHub organization scan). - The evidence must clearly indicate whether 2FA is enabled. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index affd0ec06..22c4d5181 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -36,7 +36,7 @@ The extracted size is then converted to a numeric value and compared against the - If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable. - If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0". diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 04c6fb2ad..ce218dabe 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -37,7 +37,7 @@ within the image's metadata (specifically under `metadata.component.properties`) The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum, the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 0aa302739..396e6cd50 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -37,7 +37,7 @@ This rule checks the CycloneDX SBOM evidence for the container image to verify t where the property value matches the expected value. 4. If such a property is not found, a violation is recorded with the missing label and expected value details. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM should include a `metadata.component.properties` array that contains label information. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 93456a6b7..4d97c9fd1 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -37,7 +37,7 @@ required label (as defined in the `with.labels` parameter) exists with the corre where the property value matches the expected value. 4. If such a property is not found, a violation is recorded with the missing label and expected value details. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM should include a `metadata.component.properties` array that contains label information. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 4e45617c3..f68599ea1 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -33,7 +33,7 @@ It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to c The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation. Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format conforming to SARIF 2.1.0. - The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true). - The signer's identity should match one of the specified common names or emails in the configuration. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index ea703dcb7..101f27450 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -34,7 +34,7 @@ the corresponding rule definitions, and checking if the rule IDs contain any of If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. -**Evidence Requirements:** +### **Evidence Requirements** Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index f6dc0e34e..8ab3c47f5 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -39,7 +39,7 @@ ruleId contains any of the CVE identifiers provided in the `with.rule_ids` confi findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. - The SARIF report should be generated by the "Trivy Vulnerability Scanner". diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index b2b1337ca..e40da645b 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -35,7 +35,7 @@ the corresponding rule definitions, and checking if the rule IDs contain any of If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. -**Evidence Requirements:** +### **Evidence Requirements** Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index f82087ca9..25e242345 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -40,7 +40,7 @@ rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. - The SARIF report should be generated by the "Trivy Vulnerability Scanner". diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index c43a017df..4f63dd320 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -38,7 +38,7 @@ rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. - The SARIF report should be generated by the "Trivy Vulnerability Scanner". diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 4d847d0da..5f9b4d06c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -40,7 +40,7 @@ associated with specific attack vectors are properly identified. The rule works (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the associated description. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. - The SARIF report should be generated by a tool like the Vulnerability Scanner. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 159347a99..6dc519ba3 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -39,7 +39,7 @@ It does so by using helper functions from the `data.sarif` module to: If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier, severity, and the corresponding location in the artifact. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema. - The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index eb2ef9594..353dbf168 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -37,7 +37,7 @@ The rule checks whether the result’s ruleId contains any of the identifiers sp If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded. Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema. - The SARIF report should be generated by Semgrep. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 93989eb24..fe16f552d 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -33,7 +33,7 @@ This rule checks the `tool` field in the SARIF evidence to verify that it matche the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool. A mismatch indicates that the report may not be reliable. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must adhere to the SARIF 2.1.0 schema. - The report must include a valid `tool` field. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 4a8065d40..23dfd93de 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -35,7 +35,7 @@ The rule iterates over the organization data in the evidence, and if the `two_fa the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional layer of security against unauthorized access. -**Evidence Requirements:** +### **Evidence Requirements** - Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. - The data should come from a trusted source (e.g., a GitHub organization scan). - The evidence must clearly indicate whether 2FA is enabled. From f664f223f580473a9177ed38a20f6556872387c9 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 13:45:56 +0200 Subject: [PATCH 078/191] tmp gen docs --- docs/configuration/initiatives/bp1.md | 1 + .../initiatives/rules/images/restrict-shell-entrypoint.md | 8 +++++++- docs/configuration/initiatives/slsa.l1.md | 1 + docs/configuration/initiatives/slsa.l2.md | 1 + docs/configuration/initiatives/ssdf.md | 1 + 5 files changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 7a3b2f1d7..4455e2330 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -22,6 +22,7 @@ Evidence for this initiative **IS** required by default.** ## **Description** This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. + ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index d2e1d14d4..4269861d5 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -28,7 +28,13 @@ his rule requires evaluation with a target; without one, the rule will be **disa ::: ## Description -This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash').
test ### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". +This rule ensures that container images do not allow shell access by verifying their configured entrypoint. +Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. +This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). + +### **Evidence Requirements** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". ## Evidence Requirements diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 992698232..d26732e4e 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -19,6 +19,7 @@ Evidence for this initiative **IS NOT** required by default but is recommended. This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. + ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 019e17ba1..f14d2a958 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -19,6 +19,7 @@ Evidence for this initiative **IS NOT** required by default but is recommended. Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." + ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index b1e22ffae..c07ce4631 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -19,6 +19,7 @@ Evidence for this initiative **IS NOT** required by default but is recommended. This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. + ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | From 6e9f68719114b4eedbae5ba3845447be9a6a722e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:10:22 +0200 Subject: [PATCH 079/191] tmp gen docs --- .../rules/images/allowed-base-image.md | 19 +++++++++++++++ .../rules/images/allowed-image-source.md | 19 +++++++++++++++ .../initiatives/rules/images/banned-ports.md | 23 ++++++++++++++++++- .../initiatives/rules/images/banned-users.md | 19 +++++++++++++++ .../rules/images/enforce-https-registry.md | 16 ++++++++++--- .../rules/images/fresh-base-image.md | 18 ++++++++++++++- .../initiatives/rules/images/image-signed.md | 20 ++++++++++++++-- .../rules/images/require-healthcheck.md | 17 +++++++++++++- 8 files changed, 143 insertions(+), 8 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index b08c62910..af60f6497 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -16,6 +16,11 @@ This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. + +## Mitigation +Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. + + :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -29,6 +34,20 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images. +A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true". +For each detected base image, the rule verifies that its name matches one of the approved source patterns defined in the configuration +(via `with.approved_sources`). If a base image does not match any of the approved patterns, it is flagged as invalid. If no base image data +is found, a violation is recorded indicating that the necessary base image information is missing. + +**Evidence Requirements:** + +- The SBOM evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array containing properties that identify base images. +- The approved source patterns must be specified in the `with.approved_sources` parameter. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 0e23efdbc..e5c18f9b6 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -13,6 +13,11 @@ title: Allowed Main Image Source Ensures the main container image referenced in the SBOM is from an approved source. + +## Mitigation +Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. + + :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -26,6 +31,20 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source. +It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`). +The matching is performed using a case-insensitive, anchored regex. + +- If one or more approved source patterns are provided and the image name matches at least one pattern, the image is considered compliant. +- If the image name does not match any approved source, or if no approved source patterns are provided, a violation is recorded. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields. +- The approved source patterns must be specified in `with.approved_sources`. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 9c2395483..d32d6459d 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -15,6 +15,11 @@ The rule examines properties in the SBOM metadata and checks each value (expecte It fails if any banned port is exposed or if no banned ports list is provided. + +## Mitigation +Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. + + :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -28,6 +33,22 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed. +It performs the following steps: + +1. Retrieves all properties from the SBOM's `metadata.component.properties` whose names start with "imageExposedPorts_". +2. Expects each property value to be formatted as "port/protocol" (e.g., "3000/tcp") and splits the value into its components. +3. Compares each exposed port against the list of banned ports provided in the configuration (`with.banned_ports`). + - If a banned port (and, if specified, protocol) is detected, the rule flags it as a violation. +4. If no banned ports list is provided, the rule also fails. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component.properties` array with entries for exposed ports. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -38,4 +59,4 @@ This rule scoped by target and product. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| banned_ports | ["`{'port': '3000', 'protocol': 'tcp'}`"] | +| banned_ports | [] | diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 090a21919..93f40197a 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -12,6 +12,11 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. + +## Mitigation +Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. + + :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -25,6 +30,20 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured +to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property +with the name "user". The value of this property is then compared against a list of disallowed users specified in +the configuration (via `with.users`). If the image is found to be running as a banned user (for example, "root"), +a violation is recorded. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user". +- The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 27d3fe657..0ded1cb22 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -10,9 +10,7 @@ title: 4.2.1 Registry Connection HTTPS **Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/enforce-https-registry.rego) **Labels:** Registry, Images -Checks if the container's registry scheme is HTTPS by looking for a -property named 'registry_scheme' with value 'https'. If none found, -the rule fails, indicating a non-HTTPS registry. +Checks if the container's registry scheme is HTTPS :::tip @@ -28,6 +26,18 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by product and target. ::: +## Description +This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection +is secure. It does so by scanning the `metadata.component.properties` array for a property named +'registry_scheme'. If the value of this property is exactly 'https', the rule passes; otherwise, it fails, +indicating that the image may have been pulled from an insecure registry. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 9c2e81906..6fe031459 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -10,7 +10,12 @@ title: Fresh Base Image **Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-base-image.rego) **Labels:** SBOM, Images -Verifies that each base image is not older than the specified threshold (max_days) from its creation date. The rule fails if no base image is found or if any base image exceeds the allowed age. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. +Verifies that each base image is not older than the specified threshold (max_days) from its creation date. + + + +## Mitigation +Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. :::tip @@ -26,6 +31,17 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. +It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". +The rule then extracts the "created" timestamp from these components and calculates the image’s age against the allowed threshold specified in `with.max_days`. +If any base image is older than the allowed age, or if no base image data is found, the rule records a violation. + +**Evidence Requirements:** +- Evidence must be provided in CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 00ea6470b..a8e5308ca 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -11,8 +11,11 @@ title: Require Signed Container Image **Labels:** Images, Blueprint Enforces that container images (target_type=container) are cryptographically signed. -Allows you to skip checks for certain images matching skip_regex, and optionally -ensures that the signer's identity matches specified emails or common-names. + + + +## Mitigation +Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. :::tip @@ -28,6 +31,19 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by product and target. ::: +## Description +This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the +environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the +image name matches any pattern specified in `with.skip_image_regex`, the signature check is skipped, allowing flexibility +for images that do not require a signature. Otherwise, if the evidence does not indicate a valid signature, the rule fails. + +**Evidence Requirements:** + +- Evidence must be provided in CycloneDX JSON format with a `content_body_type` of "cyclonedx-json". +- The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json"). +- The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index dd8b6e0c4..2c8f1d291 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -11,7 +11,11 @@ title: Require Healthcheck **Labels:** SBOM, Images Checks that the container image includes at least one healthcheck property. -otherwise, it fails with a violation. + + + +## Mitigation +Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. :::tip @@ -27,6 +31,17 @@ his rule requires evaluation with a target; without one, the rule will be **disa This rule scoped by target and product. ::: +## Description +This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined. +It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, +starts with "imagehealthcheck_". If at least one such property is found, the image is considered compliant; +otherwise, a violation is recorded indicating a missing healthcheck. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions. + + ## Evidence Requirements | Field | Value | |-------|-------| From 0f0bcb9955d7588b15792b8c4ea80c3c9ff308ce Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:38:23 +0200 Subject: [PATCH 080/191] tmp gen docs --- docs/configuration/initiatives/rules/api/_category_.json | 2 +- docs/configuration/initiatives/rules/github/api/_category_.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/_category_.json b/docs/configuration/initiatives/rules/api/_category_.json index c9d731c03..01fdec181 100644 --- a/docs/configuration/initiatives/rules/api/_category_.json +++ b/docs/configuration/initiatives/rules/api/_category_.json @@ -1,4 +1,4 @@ { - "label": "Api", + "label": "Scribe API", "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/github/api/_category_.json b/docs/configuration/initiatives/rules/github/api/_category_.json index c9d731c03..60c66511c 100644 --- a/docs/configuration/initiatives/rules/github/api/_category_.json +++ b/docs/configuration/initiatives/rules/github/api/_category_.json @@ -1,4 +1,4 @@ { - "label": "Api", + "label": "Github API", "position": 1 } \ No newline at end of file From 82d7d039a356292b5deaaa243e7d79c44aecafbb Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:43:49 +0200 Subject: [PATCH 081/191] tmp gen docsush --- .../initiatives/rules/api/scribe-api-cve-product.md | 2 +- docs/configuration/initiatives/rules/api/scribe-api-cve.md | 4 ++-- .../initiatives/rules/api/scribe-api-published.md | 2 +- docs/configuration/initiatives/rules/api/scribe-api.md | 2 +- .../initiatives/rules/bitbucket/project/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/project/allow-users.md | 2 +- .../rules/bitbucket/project/exposed-credentials.md | 2 +- .../initiatives/rules/bitbucket/project/long-live-tokens.md | 2 +- .../initiatives/rules/bitbucket/repository/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/repository/allow-users.md | 2 +- .../rules/bitbucket/repository/branch-protection.md | 2 +- .../initiatives/rules/bitbucket/workspace/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/workspace/allow-users.md | 2 +- .../initiatives/rules/dockerhub/token-expiration.md | 2 +- .../initiatives/rules/dockerhub/token-not-used.md | 2 +- .../initiatives/rules/generic/artifact-signed.md | 2 +- .../initiatives/rules/generic/evidence-exists.md | 2 +- docs/configuration/initiatives/rules/generic/k8s-jailbreak.md | 2 +- docs/configuration/initiatives/rules/generic/trivy-exists.md | 2 +- docs/configuration/initiatives/rules/git/artifact-signed.md | 4 ++-- .../configuration/initiatives/rules/git/coding-permissions.md | 4 ++-- docs/configuration/initiatives/rules/git/evidence-exists.md | 4 ++-- docs/configuration/initiatives/rules/git/no-commit-to-main.md | 4 ++-- .../initiatives/rules/git/no-unsigned-commits.md | 4 ++-- .../initiatives/rules/github/api/branch-protection.md | 2 +- .../initiatives/rules/github/api/signed-commits-list.md | 2 +- .../initiatives/rules/github/api/signed-commits-range.md | 2 +- docs/configuration/initiatives/rules/github/org/2fa.md | 2 +- .../initiatives/rules/github/org/advanced-security.md | 2 +- .../initiatives/rules/github/org/allow-admins.md | 2 +- .../configuration/initiatives/rules/github/org/allow-users.md | 2 +- .../initiatives/rules/github/org/create-private-repos.md | 2 +- .../initiatives/rules/github/org/create-repos.md | 2 +- .../initiatives/rules/github/org/dependabot-alerts.md | 2 +- .../rules/github/org/dependabot-security-updates-sa.md | 2 +- .../rules/github/org/dependabot-security-updates.md | 2 +- .../initiatives/rules/github/org/dependency-graph.md | 2 +- docs/configuration/initiatives/rules/github/org/max-admins.md | 2 +- .../configuration/initiatives/rules/github/org/old-secrets.md | 2 +- .../initiatives/rules/github/org/pp-custom-link.md | 2 +- .../initiatives/rules/github/org/push-protection-sa.md | 2 +- .../initiatives/rules/github/org/push-protection.md | 2 +- .../initiatives/rules/github/org/repo-visibility.md | 2 +- .../initiatives/rules/github/org/secret-scanning-sa.md | 2 +- .../initiatives/rules/github/org/secret-scanning.md | 2 +- .../initiatives/rules/github/org/validity-checks-sa.md | 2 +- .../initiatives/rules/github/org/validity-checks.md | 2 +- .../initiatives/rules/github/org/web-commit-signoff.md | 2 +- .../initiatives/rules/github/repository/branch-protection.md | 2 +- .../rules/github/repository/branch-verification.md | 2 +- .../rules/github/repository/check-signed-commits.md | 2 +- .../rules/github/repository/default-branch-protection.md | 2 +- .../initiatives/rules/github/repository/dependabot.md | 2 +- .../rules/github/repository/ephemeral-runners-only.md | 2 +- .../initiatives/rules/github/repository/no-cache-usage.md | 2 +- .../initiatives/rules/github/repository/no-org-secrets.md | 2 +- .../initiatives/rules/github/repository/old-secrets.md | 2 +- .../initiatives/rules/github/repository/push-protection.md | 2 +- .../initiatives/rules/github/repository/repo-private.md | 2 +- .../initiatives/rules/github/repository/secret-scanning.md | 2 +- .../initiatives/rules/github/repository/signed-commits.md | 2 +- .../initiatives/rules/github/repository/validity-checks.md | 2 +- .../initiatives/rules/github/repository/visibility.md | 2 +- .../initiatives/rules/github/repository/web-commit-signoff.md | 2 +- docs/configuration/initiatives/rules/gitlab/api/push-rules.md | 2 +- .../initiatives/rules/gitlab/api/signed-commits-list.md | 2 +- .../initiatives/rules/gitlab/api/signed-commits-range.md | 2 +- .../initiatives/rules/gitlab/org/allow-admins.md | 2 +- .../initiatives/rules/gitlab/org/allow-token-scopes.md | 2 +- .../configuration/initiatives/rules/gitlab/org/allow-users.md | 2 +- .../initiatives/rules/gitlab/org/blocked-users.md | 2 +- .../initiatives/rules/gitlab/org/expiring-tokens.md | 2 +- .../initiatives/rules/gitlab/org/forbid-token-scopes.md | 2 +- .../initiatives/rules/gitlab/org/inactive-projects.md | 2 +- .../initiatives/rules/gitlab/org/longlive-tokens.md | 2 +- docs/configuration/initiatives/rules/gitlab/org/max-admins.md | 2 +- .../initiatives/rules/gitlab/org/projects-visibility.md | 2 +- .../initiatives/rules/gitlab/org/unused-tokens.md | 2 +- .../initiatives/rules/gitlab/pipeline/verify-labels-exist.md | 2 +- .../initiatives/rules/gitlab/pipeline/verify-labels.md | 2 +- .../initiatives/rules/gitlab/project/abandoned-project.md | 2 +- .../rules/gitlab/project/approvals-policy-check.md | 2 +- .../rules/gitlab/project/approvers-per-merge-request.md | 2 +- .../initiatives/rules/gitlab/project/author-email-regex.md | 2 +- .../initiatives/rules/gitlab/project/check-cwe.md | 2 +- .../initiatives/rules/gitlab/project/check-signed-commits.md | 2 +- .../initiatives/rules/gitlab/project/co-approval-required.md | 2 +- .../rules/gitlab/project/commit-author-email-check.md | 2 +- .../rules/gitlab/project/commit-author-name-check.md | 2 +- .../rules/gitlab/project/commit-committer-check.md | 2 +- .../initiatives/rules/gitlab/project/commit-message-check.md | 2 +- .../initiatives/rules/gitlab/project/commits-validated.md | 2 +- .../initiatives/rules/gitlab/project/committer-email-check.md | 2 +- .../initiatives/rules/gitlab/project/committer-name-check.md | 2 +- .../rules/gitlab/project/critical-severity-limit.md | 2 +- .../rules/gitlab/project/description-substring-check.md | 2 +- .../rules/gitlab/project/disallowed-banned-approvers.md | 2 +- .../initiatives/rules/gitlab/project/force-push-protection.md | 2 +- .../initiatives/rules/gitlab/project/medium-severity-limit.md | 2 +- .../initiatives/rules/gitlab/project/member-check.md | 2 +- .../initiatives/rules/gitlab/project/merge-access-level.md | 2 +- .../rules/gitlab/project/merge-requests-author-approval.md | 2 +- .../project/merge-requests-disable-committers-approval.md | 2 +- .../rules/gitlab/project/message-substring-check.md | 2 +- .../initiatives/rules/gitlab/project/prevent-secrets-check.md | 2 +- .../initiatives/rules/gitlab/project/protect-ci-secrets.md | 2 +- .../initiatives/rules/gitlab/project/push-access-level.md | 2 +- .../initiatives/rules/gitlab/project/push-rules-set.md | 2 +- .../rules/gitlab/project/reject-unsigned-commits.md | 2 +- .../rules/gitlab/project/require-password-to-approve.md | 2 +- .../rules/gitlab/project/required-minimal-approvers.md | 2 +- .../rules/gitlab/project/reset-pprovals-on-push.md | 2 +- .../initiatives/rules/gitlab/project/sast-scan-pass.md | 2 +- .../initiatives/rules/gitlab/project/sast-scanning.md | 2 +- .../initiatives/rules/gitlab/project/secrets-scan-pass.md | 2 +- .../initiatives/rules/gitlab/project/secrets-scanning.md | 2 +- .../rules/gitlab/project/selective-code-owner-removals.md | 2 +- .../initiatives/rules/gitlab/project/visibility-check.md | 2 +- .../initiatives/rules/images/allowed-base-image.md | 4 ++-- .../initiatives/rules/images/allowed-image-source.md | 4 ++-- docs/configuration/initiatives/rules/images/banned-ports.md | 4 ++-- docs/configuration/initiatives/rules/images/banned-users.md | 4 ++-- .../initiatives/rules/images/blocklist-build-scripts.md | 2 +- .../initiatives/rules/images/enforce-https-registry.md | 4 ++-- .../initiatives/rules/images/forbid-large-images.md | 2 +- .../initiatives/rules/images/fresh-base-image.md | 4 ++-- docs/configuration/initiatives/rules/images/fresh-image.md | 4 ++-- docs/configuration/initiatives/rules/images/image-signed.md | 4 ++-- .../initiatives/rules/images/require-healthcheck.md | 4 ++-- .../initiatives/rules/images/restrict-shell-entrypoint.md | 2 +- .../initiatives/rules/images/verify-labels-exist.md | 2 +- docs/configuration/initiatives/rules/images/verify-labels.md | 2 +- .../initiatives/rules/jenkins/folder/exposed-credentials.md | 2 +- .../initiatives/rules/jenkins/instance/inactive-users.md | 2 +- .../initiatives/rules/jenkins/instance/unused-users.md | 2 +- .../initiatives/rules/k8s/namespace/allowed-images.md | 2 +- .../initiatives/rules/k8s/namespace/allowed-registries.md | 2 +- .../rules/k8s/namespace/verify-namespace-duration.md | 2 +- .../rules/k8s/namespace/verify-namespace-termination.md | 2 +- .../rules/k8s/namespace/white-listed-namespaces.md | 2 +- .../initiatives/rules/k8s/namespace/white-listed-pod.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-duration.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-termination.md | 2 +- .../initiatives/rules/k8s/pods/white-listed-pod.md | 2 +- .../initiatives/rules/multievidence/files_integrity.md | 2 +- docs/configuration/initiatives/rules/sarif/artifact-signed.md | 2 +- docs/configuration/initiatives/rules/sarif/evidence-exists.md | 2 +- .../initiatives/rules/sarif/patcheck/updates-needed.md | 2 +- .../initiatives/rules/sarif/report-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 2 +- .../initiatives/rules/sarif/trivy/report-trivy-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/verify-cve-severity.md | 2 +- .../rules/sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../initiatives/rules/sarif/trivy/verify-trivy-report.md | 2 +- .../initiatives/rules/sarif/verify-attack-vector.md | 2 +- docs/configuration/initiatives/rules/sarif/verify-sarif.md | 2 +- .../initiatives/rules/sarif/verify-semgrep-report.md | 2 +- .../initiatives/rules/sarif/verify-tool-evidence.md | 2 +- docs/configuration/initiatives/rules/sbom/NTIA-compliance.md | 4 ++-- .../initiatives/rules/sbom/allowed-components.md | 4 ++-- docs/configuration/initiatives/rules/sbom/artifact-signed.md | 4 ++-- docs/configuration/initiatives/rules/sbom/banned-licenses.md | 4 ++-- .../initiatives/rules/sbom/blocklist-packages.md | 4 ++-- .../configuration/initiatives/rules/sbom/complete-licenses.md | 4 ++-- docs/configuration/initiatives/rules/sbom/fresh-sbom.md | 4 ++-- docs/configuration/initiatives/rules/sbom/require-sbom.md | 4 ++-- .../configuration/initiatives/rules/sbom/required-packages.md | 4 ++-- .../initiatives/rules/sbom/verify-huggingface-license.md | 4 ++-- .../initiatives/rules/slsa/banned-builder-deps.md | 2 +- docs/configuration/initiatives/rules/slsa/build-time.md | 2 +- docs/configuration/initiatives/rules/slsa/field-exists.md | 2 +- .../initiatives/rules/slsa/l1-provenance-exists.md | 4 ++-- .../initiatives/rules/slsa/l2-provenance-authenticated.md | 4 ++-- docs/configuration/initiatives/rules/slsa/verify-builder.md | 2 +- .../configuration/initiatives/rules/slsa/verify-byproducts.md | 2 +- docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../initiatives/rules/ssdf/ps-1-branch-protection.md | 2 +- .../configuration/initiatives/rules/ssdf/ps-1-limit-admins.md | 2 +- .../configuration/initiatives/rules/ssdf/ps-1-repo-private.md | 2 +- .../initiatives/rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 2 +- .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 2 +- .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 2 +- 183 files changed, 210 insertions(+), 210 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index 4d1d06ce8..eebc6c9e1 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -22,7 +22,7 @@ Rule Result will be set as 'open' if evidence is missing. Rule requires the Scribe API to be enabled. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 1efc5d96b..55b323127 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -22,10 +22,10 @@ Rule requires the Scribe API to be enabled. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index 5b19ca170..79d7062e0 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -22,7 +22,7 @@ Rule requires the Scribe API to be enabled. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index c8727eb73..4eb34f4e3 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -21,7 +21,7 @@ Rule requires the Scribe API to be enabled. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 9e78ad462..ac91cd967 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -18,7 +18,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 7b2a1de9b..06c88e399 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -18,7 +18,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index ca00c12fe..a5ed81413 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 750c0cdd2..221007cda 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index dd4ec2b5b..9dbd2265a 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 69a15ab68..4056f3dda 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 4a7576d62..1091c002b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 14f85fa24..ef01edb80 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index efcdf7244..d1aed7d6d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 88ff53833..c861bd080 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 191cff830..47530397d 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 26b64c134..67b31da30 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -19,7 +19,7 @@ Verify required evidence is signed. Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index ac9aa8213..b5f2a8b58 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -19,7 +19,7 @@ Verify required evidence exists. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 74459a677..2198f534b 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 1c4dac501..ae74090dd 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -18,7 +18,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 71c941f49..f26ea213e 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -19,10 +19,10 @@ Verify the Git artifact is signed. Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 00d74c606..6f6521318 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 703890204..09a5b5b89 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -19,10 +19,10 @@ Verify required Git evidence exists. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 202ebd53e..c0c5b5993 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index 309d777da..edb69dc3d 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 9969cca39..36ffc05ff 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 16ba36cbb..d56048c52 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index cc93972f4..95ca64838 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 63bae84fb..7aeffd5c6 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 91d4943ae..04d8eeba7 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 9bcb0a995..5c1d3d968 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 663458467..d04650c4d 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 653cea7c1..c7f77e94d 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 4e1cd182e..b804385a7 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 79bbfa454..2f03b2649 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index f50bc9aac..2e7485a84 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index f9e81d19c..0ec90b8dd 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index e354e7ffe..cc1924d0d 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index ad5f39b55..9a77f2d3e 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index d966083c7..eedf811c0 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index abd94f896..24f192c5c 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index b1c92961c..1e0eb3e3d 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 8ecc027e1..1b22fc6ca 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -20,7 +20,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 634d98458..bdcc9acc2 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 46e9edec2..ed2089467 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index f7e6d6872..88c6dac44 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index be5c4b82e..557e6bdc1 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 5c73e82ce..5a4664cd1 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index a626c7778..4bc6c197a 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index b151c2bcd..1f5718590 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index cda89258e..5d8e5273f 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 1b917f3c3..12884d17c 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index e01292a21..7edd0e174 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index ae031f906..e490f2ffa 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 7daf18335..4312d6d23 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index f28922dbd..5b471b94a 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 702b93aff..acb11bbf0 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 093961ca6..c8d197531 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 0d435df0d..0b61dde46 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 858975e77..3a857adaf 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 9f26fbfce..16f7ea536 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 7d376281d..882ca4fa1 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 0f98d6d78..543e8e6f7 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index c5e33ee36..617fda770 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index fd4f84ee4..5e97f5f5e 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 4568619b6..0bab5c820 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 0351a67e9..cfe461507 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index c3fa9cf89..7ac9227e8 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -19,7 +19,7 @@ Evidence **IS NOT** required for this rule. Rule Result will be set as 'open' if evidence is missing. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 9203cf6cb..2015ad1a4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index ba6b7e095..1ff63639a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 2dd5f7cbd..0f1653075 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index e4927d179..0a2464ce2 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index ff5a7a012..c70a54c93 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index c8c818534..e9d7ab339 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index bfb0d83ab..50ac3d40f 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 2f1aa2027..b6a86260e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index b7d2a23c9..d9de70602 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 7535adcb1..70bcada9d 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index e18a2f912..23e573eeb 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 87d2cff4e..dfe268db7 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index d1e9a38b5..ce81e5036 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 822107c1b..602a8594c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index dec31fe55..5dc96a6b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 0d05733b5..41d1e2e69 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index f392841a9..83d285e82 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index c455ed1a8..82cd62ad7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 7b01ae940..5afd98dd4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 883e6660a..bbd5a6fd1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 6cb9a96db..adac60a01 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 77ddbbee8..177ff7d4a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index aaee5d375..79046042b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index cefdfeaf1..e44254bf2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 282e868d4..7b2e9507c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index f05b04097..1a34f7a74 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index e79525ed6..48cbf8623 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 18cb905dd..e83e99b6f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index e8ee10843..b35e5b97b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index bd500fe48..b4c149bfe 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index f0123c3cc..9ec567797 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 5290d13a5..5ade237dd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index baf341a35..22c463dba 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 49dbaa21b..82a1e71c9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 3168df905..ce502147b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index bd696985b..80c91c225 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index cce5d2382..653955840 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index b16b5f928..a182d87b5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 3139d2be5..7b4a6ba32 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index b4cdb2eaa..c92d1f35c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 5a065fa2c..cfae7e096 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index d5f75f024..b81ea4ae0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index d285598d7..0ea0c3b9b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 5c206fbd2..70a955069 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 42bd29657..23d7277df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 629f5107a..4586990e9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 5fe1bf89a..e3c5eb98d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 31246e5eb..d20639659 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index e55f6e3a1..3d38e1aba 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index cc7c9c6f0..8d1fd60a6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index d4de049f0..66950b0ac 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index af60f6497..91a053f10 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -28,10 +28,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index e5c18f9b6..f616a520b 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -25,10 +25,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index d32d6459d..397e817a8 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -27,10 +27,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 93f40197a..6ba8a73be 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -24,10 +24,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 9acd673fc..c291c323f 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 0ded1cb22..afeaf17f7 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -20,10 +20,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 22c4d5181..da40a0d3b 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 6fe031459..de37a6e09 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -25,10 +25,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index ce218dabe..061a8c0ec 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -24,10 +24,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index a8e5308ca..e8bac88db 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -25,10 +25,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 2c8f1d291..7f8a678e0 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -25,10 +25,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by target and product. +Rule is scoped by target and product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 4269861d5..a031eff95 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 396e6cd50..df665a89f 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 4d97c9fd1..c545ad0fc 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index b582394dc..fa522891e 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 6f3bf5c5d..f1571eea0 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 5901ab90e..16274249e 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index b0f8b0436..7baca8aa5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index d78437bd7..1513003b0 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 6850c3c11..a0a351fdb 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index ac65b1b8d..ab2fd2aa8 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index cb452f4c7..9f0a56135 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 18e9f2c70..af0376911 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 1a2ad25fe..590d5f2a6 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 355a41366..a4afffc97 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 8e305e760..a35f1e033 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 0b417298e..52368b937 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index f68599ea1..e31f40583 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -24,7 +24,7 @@ Ensures that the referenced artifact has a valid digital signature, confirming i Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index c15cad5be..69ea2dfa1 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -24,7 +24,7 @@ By confirming that all required evidence exists, this rule guarantees that the o Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index fd980c66e..1c8b4c3a8 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 101f27450..f5c37b197 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 8ab3c47f5..780d53ad9 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -25,7 +25,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by product. +Rule is scoped by product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index e40da645b..9a3c73495 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -25,7 +25,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by product. +Rule is scoped by product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 25e242345..0e13a7660 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -27,7 +27,7 @@ Ensures that the SARIF report generated by Trivy meets the predefined security c Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by product. +Rule is scoped by product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index a7ded3552..46321799d 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by product. +Rule is scoped by product. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 4f63dd320..36abb5bc1 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -25,7 +25,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by product. +Rule is scoped by product. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 5f9b4d06c..21e308258 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 6dc519ba3..505a199f0 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 353dbf168..c8e8cfb8a 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -24,7 +24,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index fe16f552d..1d638ddf9 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -24,7 +24,7 @@ Confirms the SARIF report originates from the correct scanning tool, ensuring th Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 79793158f..d06fba037 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -25,10 +25,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 5e89f07cb..8ce6359c1 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index da697bea2..956b77178 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -19,10 +19,10 @@ Verify the SBOM is signed. Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 9b5515398..8ee2d8a44 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index fb5cbc414..abb69f720 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 7fae8eba6..5c0eb808a 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index a0ce3b564..d4706fb46 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index c63d4408a..2d85ed86e 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -19,10 +19,10 @@ Verify the SBOM exists as evidence. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 7551d1703..c2e35582c 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 642b8b875..950ccd48b 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -19,10 +19,10 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index df599a055..053a02b02 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 7fd22ed53..c8e357d88 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 9a4bfe3a3..333ee1a31 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 586fddc07..42ef3a000 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -24,10 +24,10 @@ Recording comprehensive provenance metadata allows organizations to verify the i Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 9a6f07f4b..e551c8002 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -25,10 +25,10 @@ Cryptographic authentication prevents tampering with provenance data, ensuring t Signed Evidence for this rule **IS** required by default. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: :::info -This rule scoped by product and target. +Rule is scoped by product and target. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index b64201feb..cb5eb157c 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info -This rule scoped by pipeline and product. +Rule is scoped by pipeline and product. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 53566e0ce..509243165 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -19,7 +19,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 23dfd93de..e90ec24ac 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Description diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index ae7924d33..86f667925 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 9ffc7a832..91eb43325 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index d952157bd..c39a2ef98 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 15978ae29..4f8a82fcd 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index c5caed1a5..6d3a48126 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -23,7 +23,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index f0a11ecaa..72e5dc571 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -25,7 +25,7 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: ## Rule Parameters (`with`) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 23b5dd25f..46074fc10 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -23,6 +23,6 @@ Rule Result will be set as 'open' if evidence is missing. Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: From 00d08c86cfe0bc9d48ad3b2cd33e389c8d5a8267 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:49:08 +0200 Subject: [PATCH 082/191] tmp gen docsush --- docs/configuration/initiatives/_category_.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index cb94d3950..8d1130ff7 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 1 + "position": 30 } \ No newline at end of file From 24adb9e05efea5ebc24b87dd7b16dc9fcb41c469 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:52:08 +0200 Subject: [PATCH 083/191] tmp gen docsush --- .../configuration/initiatives/_category_.json | 2 +- docs/configuration/initiatives/bp1.md | 24 +++++++++---------- .../initiatives/rules/_category_.json | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 ++-- docs/configuration/initiatives/sp-800-190.md | 24 +++++++++---------- docs/configuration/initiatives/sp-800-53.md | 12 +++++----- docs/configuration/initiatives/ssdf.md | 16 ++++++------- 8 files changed, 43 insertions(+), 43 deletions(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index 8d1130ff7..cb94d3950 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 30 + "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 4455e2330..8a438762b 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -69,7 +69,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -90,8 +90,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -112,7 +112,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -133,7 +133,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -158,7 +158,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -200,7 +200,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -221,7 +221,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -242,7 +242,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -263,6 +263,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json index 45eb2b74f..03176cc52 100644 --- a/docs/configuration/initiatives/rules/_category_.json +++ b/docs/configuration/initiatives/rules/_category_.json @@ -1,4 +1,4 @@ { "label": "Rule Configuration", - "position": 10 + "position": 2 } \ No newline at end of file diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index d26732e4e..1b0f42f23 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -48,4 +48,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index f14d2a958..39b76dd23 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -48,5 +48,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 035c06be0..29f9a46fe 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -51,23 +51,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -84,9 +84,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index d5e1fade6..64b8e92ed 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -54,10 +54,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -73,7 +73,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -88,5 +88,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index c07ce4631..036caaec2 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -54,8 +54,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## [] SSDF-ORG @@ -70,9 +70,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## [] SSDF-REPO @@ -87,8 +87,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/guides/policy-reference/rules/ssdf/ps-1-repo-private.md) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 4e07826c0b450e674af4e47afdbfe75ffb32e8ec Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:54:35 +0200 Subject: [PATCH 084/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 2 +- docs/configuration/initiatives/sp-800-190.md | 2 +- docs/configuration/initiatives/sp-800-53.md | 2 +- docs/configuration/initiatives/ssdf.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 8a438762b..6482ddb49 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -8,6 +8,7 @@ title: Venafi Blueprint **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/bp1.yaml) +**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline A comprehensive framework to secure the software supply chain by integrating robust security controls throughout the development lifecycle. @@ -15,7 +16,6 @@ A comprehensive framework to secure the software supply chain by integrating rob ## Mitigation By enforcing layered security controls across all phases of the software development lifecycle, this initiative significantly reduces the risk of supply chain compromises and ensures that only verified and trustworthy software components are deployed. -**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline :::tip Evidence for this initiative **IS** required by default.** ::: diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 1b0f42f23..bcf90a28a 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -8,10 +8,10 @@ title: SLSA L1 Framework **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l1.yaml) +**Help:** https://slsa.dev/ Evaluate SLSA Level 1 -**Help:** https://slsa.dev/ :::tip Evidence for this initiative **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 39b76dd23..20d0ecf5d 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -8,10 +8,10 @@ title: SLSA L2 Framework **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l2.yaml) +**Help:** https://slsa.dev/ Evaluate SLSA Level 2 -**Help:** https://slsa.dev/ :::tip Evidence for this initiative **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 29f9a46fe..47a5f1346 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -8,11 +8,11 @@ title: NIST Application Container Security Initiative **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-190.yaml) +**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. -**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final :::tip Evidence for this initiative **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 64b8e92ed..46090c0ba 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -8,6 +8,7 @@ title: SP-800-53 Supply Chain Integrity Initiative **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-53.yaml) +**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, @@ -16,7 +17,6 @@ This initiative enforces key supply chain requirements from NIST SP 800-53. It m Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. -**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final :::tip Evidence for this initiative **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 036caaec2..53f18493d 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -8,10 +8,10 @@ title: SSDF Client Initiative **Version:** `1.0.0` **Bundle-Version:** `v2` **Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/ssdf.yaml) +**Help:** https://csrc.nist.gov/pubs/sp/800/218/final Evaluate PS rules from the SSDF initiative -**Help:** https://csrc.nist.gov/pubs/sp/800/218/final :::tip Evidence for this initiative **IS NOT** required by default but is recommended. ::: From 2327077d04eb0b4ecbd2fd711668f146fa50a3c7 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 14:57:14 +0200 Subject: [PATCH 085/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 24 ++++++++++---------- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 ++-- docs/configuration/initiatives/sp-800-190.md | 24 ++++++++++---------- docs/configuration/initiatives/sp-800-53.md | 12 +++++----- docs/configuration/initiatives/ssdf.md | 16 ++++++------- 6 files changed, 41 insertions(+), 41 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 6482ddb49..94ed4e5d4 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -69,7 +69,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -90,8 +90,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -112,7 +112,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -133,7 +133,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -158,7 +158,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -200,7 +200,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -221,7 +221,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -242,7 +242,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -263,6 +263,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index bcf90a28a..4557aac35 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -48,4 +48,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 20d0ecf5d..ce550fd4b 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -48,5 +48,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 47a5f1346..45f982008 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -51,23 +51,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -84,9 +84,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 46090c0ba..dcae88458 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -54,10 +54,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -73,7 +73,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -88,5 +88,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 53f18493d..c891c38ed 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -54,8 +54,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## [] SSDF-ORG @@ -70,9 +70,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## [] SSDF-REPO @@ -87,8 +87,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 9c67092330a529a2990cc7c2afef6ce722ba8a3b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 15:10:10 +0200 Subject: [PATCH 086/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 3 --- docs/configuration/initiatives/slsa.l1.md | 3 --- docs/configuration/initiatives/slsa.l2.md | 3 --- docs/configuration/initiatives/sp-800-190.md | 3 --- docs/configuration/initiatives/sp-800-53.md | 3 --- docs/configuration/initiatives/ssdf.md | 3 --- 6 files changed, 18 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 94ed4e5d4..afdecaedc 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -16,9 +16,6 @@ A comprehensive framework to secure the software supply chain by integrating rob ## Mitigation By enforcing layered security controls across all phases of the software development lifecycle, this initiative significantly reduces the risk of supply chain compromises and ensures that only verified and trustworthy software components are deployed. -:::tip -Evidence for this initiative **IS** required by default.** -::: ## **Description** This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 4557aac35..160946b93 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -12,9 +12,6 @@ title: SLSA L1 Framework Evaluate SLSA Level 1 -:::tip -Evidence for this initiative **IS NOT** required by default but is recommended. -::: ## **Description** This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index ce550fd4b..83e79790f 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -12,9 +12,6 @@ title: SLSA L2 Framework Evaluate SLSA Level 2 -:::tip -Evidence for this initiative **IS NOT** required by default but is recommended. -::: ## **Description** Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 45f982008..ec94a0467 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -13,9 +13,6 @@ title: NIST Application Container Security Initiative This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. -:::tip -Evidence for this initiative **IS NOT** required by default but is recommended. -::: ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index dcae88458..00baafcfe 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -17,9 +17,6 @@ This initiative enforces key supply chain requirements from NIST SP 800-53. It m Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. -:::tip -Evidence for this initiative **IS NOT** required by default but is recommended. -::: ## Controls Overview | Control ID | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index c891c38ed..2eddb69c9 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -12,9 +12,6 @@ title: SSDF Client Initiative Evaluate PS rules from the SSDF initiative -:::tip -Evidence for this initiative **IS NOT** required by default but is recommended. -::: ## **Description** This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. From dd6e3bdb23106e286729516af3df977e7e7321d2 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 15:11:14 +0200 Subject: [PATCH 087/191] tmp gen docsush --- docs/configuration/initiatives/sp-800-53.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 00baafcfe..38bf749a0 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -1,8 +1,8 @@ --- -sidebar_label: SP-800-53 Supply Chain Integrity Initiative -title: SP-800-53 Supply Chain Integrity Initiative +sidebar_label: NIST Supply Chain Integrity Initiative +title: NIST Supply Chain Integrity Initiative --- -# SP-800-53 Supply Chain Integrity Initiative +# NIST Supply Chain Integrity Initiative **Type:** Initiative **ID:** `SP-800-53` **Version:** `1.0.0` From 92be1c98d97d507ebc30d6452f537fbc78b30f8a Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 15:13:31 +0200 Subject: [PATCH 088/191] tmp gen docsush --- docs/configuration/initiatives/_category_.json | 2 +- docs/configuration/initiatives/rules/_category_.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index cb94d3950..2511edf79 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 1 + "position": 10 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json index 03176cc52..80ee2892a 100644 --- a/docs/configuration/initiatives/rules/_category_.json +++ b/docs/configuration/initiatives/rules/_category_.json @@ -1,4 +1,4 @@ { "label": "Rule Configuration", - "position": 2 + "position": 100 } \ No newline at end of file From 3ed1750f4585f9e6a176f7a4797c426d96437764 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:02:37 +0200 Subject: [PATCH 089/191] tmp gen docsush --- docs/configuration/initiatives/_category_.json | 2 +- docs/configuration/initiatives/bp1.md | 8 ++++---- docs/configuration/initiatives/rules/_category_.json | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index 2511edf79..cb94d3950 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 10 + "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index afdecaedc..f6733b57c 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -1,8 +1,8 @@ --- -sidebar_label: Venafi Blueprint -title: Venafi Blueprint +sidebar_label: Blueprint for Secure Pipelines +title: Blueprint for Secure Pipelines --- -# Venafi Blueprint +# Blueprint for Secure Pipelines **Type:** Initiative **ID:** `blueprint-securesoftwarepipeline` **Version:** `1.0.0` @@ -10,7 +10,7 @@ title: Venafi Blueprint **Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/bp1.yaml) **Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline -A comprehensive framework to secure the software supply chain by integrating robust security controls throughout the development lifecycle. +Blueprint for secure pipelines - Gitlab ## Mitigation diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json index 80ee2892a..03176cc52 100644 --- a/docs/configuration/initiatives/rules/_category_.json +++ b/docs/configuration/initiatives/rules/_category_.json @@ -1,4 +1,4 @@ { "label": "Rule Configuration", - "position": 100 + "position": 2 } \ No newline at end of file From 4c45f171435795823795866819d03072f8f44702 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:06:50 +0200 Subject: [PATCH 090/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index f6733b57c..c3374da99 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -12,10 +12,6 @@ title: Blueprint for Secure Pipelines Blueprint for secure pipelines - Gitlab - -## Mitigation -By enforcing layered security controls across all phases of the software development lifecycle, this initiative significantly reduces the risk of supply chain compromises and ensures that only verified and trustworthy software components are deployed. - ## **Description** This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. @@ -25,7 +21,7 @@ This initiative defines a set of best practices and technical guidelines designe | Control ID | Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| | [CT-1](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | Only accept commits signed with a developer GPG key | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | | [CT-3](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | | [CT-4](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | | [CT-6](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | @@ -70,7 +66,7 @@ Both host and application-layer access to CI/CD tools should be protected with m ## [CT-2] Only accept commits signed with a developer GPG key -Only accept commits signed with a developer GPG key +The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab ### Mitigation From 3f94670f6f3818192dfaa7698e01030b320caf81 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:28:01 +0200 Subject: [PATCH 091/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 2 ++ .../rules/gitlab/org/forbid-token-scopes.md | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index c3374da99..859cdf397 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -119,6 +119,8 @@ Restrict automation accounts to read-only access, following the principle of lea CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. +> :bulb: Tokens explicitly approved via the `approved_tokens` parameter are skipped from this check, allowing trusted tokens to bypass the blocklist. + > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index e9d7ab339..965d7a7b7 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -12,6 +12,11 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. + +## Mitigation +Prevents the use of tokens with insecure or excessive scopes within the organization. This check reduces the risk of unauthorized actions by ensuring that only tokens with allowed scopes are used, while permitting trusted tokens via the approved tokens list. + + :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -22,6 +27,18 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Description +This rule examines evidence from a GitLab organization scan to ensure that tokens do not contain any disallowed scopes. +It iterates over each token in the evidence (under `input.evidence.predicate.content[*].token`), filtering for tokens +that are active and not revoked. For each token, it checks whether any of its scopes match the forbidden list specified +in `with.project_scopes`. If a token's scope matches a forbidden value and the token is not listed in `with.approved_tokens`, +a violation is recorded with details including the token name and the disallowed scope. + +**Evidence Requirements:** +- Evidence must be provided in a generic format. +- The evidence should include token data with fields such as `result_object.revoked`, `result_object.active`, and `result_object.scopes`. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -35,3 +52,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | project_scopes | ['write_api', 'write_repository'] | +| approved_tokens | [] | From b3c02c2fd903e3a02078cb8998032a949cbc8b85 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:45:10 +0200 Subject: [PATCH 092/191] tmp gen docsush --- docs/configuration/initiatives/ssdf.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 2eddb69c9..c1e991443 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -21,11 +21,11 @@ This initiative enforces key controls from the Secure Software Development Frame | Control ID | Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. +| [SSDF-IMAGE](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. | -| [](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. +| [SSDF-ORG](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. | -| [](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. +| [SSDF-REPO](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. | ## Evidence Defaults @@ -38,7 +38,7 @@ This initiative enforces key controls from the Secure Software Development Frame # Detailed Controls -## [] SSDF-IMAGE +## SSDF-IMAGE Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. @@ -54,7 +54,7 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | | [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | -## [] SSDF-ORG +## SSDF-ORG Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. @@ -71,7 +71,7 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | | [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | -## [] SSDF-REPO +## SSDF-REPO Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. From f76c0893108c145adb2a706dc89332b84eb8a691 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:51:30 +0200 Subject: [PATCH 093/191] tmp gen docsush --- docs/configuration/initiatives/bp1.md | 4 +--- .../rules/api/scribe-api-cve-product.md | 4 ++-- .../initiatives/rules/api/scribe-api-cve.md | 4 ++-- .../rules/api/scribe-api-published.md | 4 ++-- .../initiatives/rules/api/scribe-api.md | 2 +- .../rules/bitbucket/project/allow-admins.md | 4 ++-- .../rules/bitbucket/project/allow-users.md | 4 ++-- .../bitbucket/project/exposed-credentials.md | 4 ++-- .../bitbucket/project/long-live-tokens.md | 4 ++-- .../bitbucket/repository/allow-admins.md | 4 ++-- .../rules/bitbucket/repository/allow-users.md | 4 ++-- .../bitbucket/repository/branch-protection.md | 4 ++-- .../rules/bitbucket/workspace/allow-admins.md | 4 ++-- .../rules/bitbucket/workspace/allow-users.md | 4 ++-- .../rules/dockerhub/token-expiration.md | 4 ++-- .../rules/dockerhub/token-not-used.md | 4 ++-- .../rules/generic/artifact-signed.md | 4 ++-- .../rules/generic/evidence-exists.md | 4 ++-- .../rules/generic/k8s-jailbreak.md | 4 ++-- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 4 ++-- .../rules/git/coding-permissions.md | 4 ++-- .../initiatives/rules/git/evidence-exists.md | 4 ++-- .../rules/git/no-commit-to-main.md | 4 ++-- .../rules/git/no-unsigned-commits.md | 4 ++-- .../rules/github/api/branch-protection.md | 4 ++-- .../rules/github/api/signed-commits-list.md | 4 ++-- .../rules/github/api/signed-commits-range.md | 4 ++-- .../initiatives/rules/github/org/2fa.md | 4 ++-- .../rules/github/org/advanced-security.md | 4 ++-- .../rules/github/org/allow-admins.md | 4 ++-- .../rules/github/org/allow-users.md | 4 ++-- .../rules/github/org/create-private-repos.md | 4 ++-- .../rules/github/org/create-repos.md | 4 ++-- .../rules/github/org/dependabot-alerts.md | 4 ++-- .../org/dependabot-security-updates-sa.md | 4 ++-- .../github/org/dependabot-security-updates.md | 4 ++-- .../rules/github/org/dependency-graph.md | 4 ++-- .../rules/github/org/max-admins.md | 4 ++-- .../rules/github/org/old-secrets.md | 4 ++-- .../rules/github/org/pp-custom-link.md | 4 ++-- .../rules/github/org/push-protection-sa.md | 4 ++-- .../rules/github/org/push-protection.md | 4 ++-- .../rules/github/org/repo-visibility.md | 4 ++-- .../rules/github/org/secret-scanning-sa.md | 4 ++-- .../rules/github/org/secret-scanning.md | 4 ++-- .../rules/github/org/validity-checks-sa.md | 4 ++-- .../rules/github/org/validity-checks.md | 4 ++-- .../rules/github/org/web-commit-signoff.md | 4 ++-- .../github/repository/branch-protection.md | 4 ++-- .../github/repository/branch-verification.md | 4 ++-- .../github/repository/check-signed-commits.md | 4 ++-- .../repository/default-branch-protection.md | 4 ++-- .../rules/github/repository/dependabot.md | 4 ++-- .../repository/ephemeral-runners-only.md | 4 ++-- .../rules/github/repository/no-cache-usage.md | 4 ++-- .../rules/github/repository/no-org-secrets.md | 4 ++-- .../rules/github/repository/old-secrets.md | 4 ++-- .../github/repository/push-protection.md | 4 ++-- .../rules/github/repository/repo-private.md | 4 ++-- .../github/repository/secret-scanning.md | 4 ++-- .../rules/github/repository/signed-commits.md | 4 ++-- .../github/repository/validity-checks.md | 4 ++-- .../rules/github/repository/visibility.md | 4 ++-- .../github/repository/web-commit-signoff.md | 4 ++-- .../rules/gitlab/api/push-rules.md | 4 ++-- .../rules/gitlab/api/signed-commits-list.md | 4 ++-- .../rules/gitlab/api/signed-commits-range.md | 4 ++-- .../rules/gitlab/org/allow-admins.md | 4 ++-- .../rules/gitlab/org/allow-token-scopes.md | 4 ++-- .../rules/gitlab/org/allow-users.md | 4 ++-- .../rules/gitlab/org/blocked-users.md | 4 ++-- .../rules/gitlab/org/expiring-tokens.md | 4 ++-- .../rules/gitlab/org/forbid-token-scopes.md | 22 ++----------------- .../rules/gitlab/org/inactive-projects.md | 4 ++-- .../rules/gitlab/org/longlive-tokens.md | 4 ++-- .../rules/gitlab/org/max-admins.md | 4 ++-- .../rules/gitlab/org/projects-visibility.md | 4 ++-- .../rules/gitlab/org/unused-tokens.md | 4 ++-- .../gitlab/pipeline/verify-labels-exist.md | 4 ++-- .../rules/gitlab/pipeline/verify-labels.md | 4 ++-- .../rules/gitlab/project/abandoned-project.md | 4 ++-- .../gitlab/project/approvals-policy-check.md | 4 ++-- .../project/approvers-per-merge-request.md | 4 ++-- .../gitlab/project/author-email-regex.md | 4 ++-- .../rules/gitlab/project/check-cwe.md | 4 ++-- .../gitlab/project/check-signed-commits.md | 4 ++-- .../gitlab/project/co-approval-required.md | 4 ++-- .../project/commit-author-email-check.md | 4 ++-- .../project/commit-author-name-check.md | 4 ++-- .../gitlab/project/commit-committer-check.md | 4 ++-- .../gitlab/project/commit-message-check.md | 4 ++-- .../rules/gitlab/project/commits-validated.md | 4 ++-- .../gitlab/project/committer-email-check.md | 4 ++-- .../gitlab/project/committer-name-check.md | 4 ++-- .../gitlab/project/critical-severity-limit.md | 4 ++-- .../project/description-substring-check.md | 4 ++-- .../project/disallowed-banned-approvers.md | 4 ++-- .../gitlab/project/force-push-protection.md | 4 ++-- .../gitlab/project/medium-severity-limit.md | 4 ++-- .../rules/gitlab/project/member-check.md | 4 ++-- .../gitlab/project/merge-access-level.md | 4 ++-- .../project/merge-requests-author-approval.md | 4 ++-- ...ge-requests-disable-committers-approval.md | 4 ++-- .../gitlab/project/message-substring-check.md | 4 ++-- .../gitlab/project/prevent-secrets-check.md | 4 ++-- .../gitlab/project/protect-ci-secrets.md | 4 ++-- .../rules/gitlab/project/push-access-level.md | 4 ++-- .../rules/gitlab/project/push-rules-set.md | 4 ++-- .../gitlab/project/reject-unsigned-commits.md | 4 ++-- .../project/require-password-to-approve.md | 4 ++-- .../project/required-minimal-approvers.md | 4 ++-- .../gitlab/project/reset-pprovals-on-push.md | 4 ++-- .../rules/gitlab/project/sast-scan-pass.md | 4 ++-- .../rules/gitlab/project/sast-scanning.md | 4 ++-- .../rules/gitlab/project/secrets-scan-pass.md | 4 ++-- .../rules/gitlab/project/secrets-scanning.md | 4 ++-- .../project/selective-code-owner-removals.md | 4 ++-- .../rules/gitlab/project/visibility-check.md | 4 ++-- .../rules/images/allowed-base-image.md | 4 ++-- .../rules/images/allowed-image-source.md | 4 ++-- .../initiatives/rules/images/banned-ports.md | 4 ++-- .../initiatives/rules/images/banned-users.md | 4 ++-- .../rules/images/blocklist-build-scripts.md | 4 ++-- .../rules/images/enforce-https-registry.md | 4 ++-- .../rules/images/forbid-large-images.md | 4 ++-- .../rules/images/fresh-base-image.md | 4 ++-- .../initiatives/rules/images/fresh-image.md | 4 ++-- .../initiatives/rules/images/image-signed.md | 4 ++-- .../rules/images/require-healthcheck.md | 4 ++-- .../rules/images/restrict-shell-entrypoint.md | 4 ++-- .../rules/images/verify-labels-exist.md | 4 ++-- .../initiatives/rules/images/verify-labels.md | 4 ++-- .../jenkins/folder/exposed-credentials.md | 4 ++-- .../rules/jenkins/instance/inactive-users.md | 4 ++-- .../rules/jenkins/instance/unused-users.md | 4 ++-- .../rules/k8s/namespace/allowed-images.md | 4 ++-- .../rules/k8s/namespace/allowed-registries.md | 4 ++-- .../namespace/verify-namespace-duration.md | 4 ++-- .../namespace/verify-namespace-termination.md | 4 ++-- .../k8s/namespace/white-listed-namespaces.md | 4 ++-- .../rules/k8s/namespace/white-listed-pod.md | 4 ++-- .../rules/k8s/pods/verify-pod-duration.md | 4 ++-- .../rules/k8s/pods/verify-pod-termination.md | 4 ++-- .../rules/k8s/pods/white-listed-pod.md | 4 ++-- .../rules/multievidence/files_integrity.md | 4 ++-- .../rules/sarif/artifact-signed.md | 4 ++-- .../rules/sarif/evidence-exists.md | 4 ++-- .../rules/sarif/patcheck/updates-needed.md | 4 ++-- .../rules/sarif/report-iac-errors.md | 4 ++-- .../rules/sarif/trivy/blocklist-cve.md | 4 ++-- .../sarif/trivy/report-trivy-iac-errors.md | 4 ++-- .../rules/sarif/trivy/verify-cve-severity.md | 4 ++-- .../sarif/trivy/verify-trivy-attack-vector.md | 4 ++-- .../rules/sarif/trivy/verify-trivy-report.md | 4 ++-- .../rules/sarif/verify-attack-vector.md | 4 ++-- .../initiatives/rules/sarif/verify-sarif.md | 4 ++-- .../rules/sarif/verify-semgrep-report.md | 4 ++-- .../rules/sarif/verify-tool-evidence.md | 4 ++-- .../initiatives/rules/sbom/NTIA-compliance.md | 4 ++-- .../rules/sbom/allowed-components.md | 4 ++-- .../initiatives/rules/sbom/artifact-signed.md | 4 ++-- .../initiatives/rules/sbom/banned-licenses.md | 4 ++-- .../rules/sbom/blocklist-packages.md | 4 ++-- .../rules/sbom/complete-licenses.md | 4 ++-- .../initiatives/rules/sbom/fresh-sbom.md | 4 ++-- .../initiatives/rules/sbom/require-sbom.md | 4 ++-- .../rules/sbom/required-packages.md | 4 ++-- .../rules/sbom/verify-huggingface-license.md | 4 ++-- .../rules/slsa/banned-builder-deps.md | 4 ++-- .../initiatives/rules/slsa/build-time.md | 4 ++-- .../initiatives/rules/slsa/field-exists.md | 4 ++-- .../rules/slsa/l1-provenance-exists.md | 4 ++-- .../rules/slsa/l2-provenance-authenticated.md | 4 ++-- .../initiatives/rules/slsa/verify-builder.md | 4 ++-- .../rules/slsa/verify-byproducts.md | 4 ++-- .../initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 2 +- docs/configuration/initiatives/sp-800-190.md | 2 +- docs/configuration/initiatives/sp-800-53.md | 2 +- docs/configuration/initiatives/ssdf.md | 2 +- 189 files changed, 362 insertions(+), 382 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 859cdf397..14356dc18 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -7,7 +7,7 @@ title: Blueprint for Secure Pipelines **ID:** `blueprint-securesoftwarepipeline` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/bp1.yaml) +**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/bp1.yaml) **Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline Blueprint for secure pipelines - Gitlab @@ -119,8 +119,6 @@ Restrict automation accounts to read-only access, following the principle of lea CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. -> :bulb: Tokens explicitly approved via the `approved_tokens` parameter are skipped from this check, allowing trusted tokens to bypass the blocklist. - > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index eebc6c9e1..ba2d5be0a 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -6,8 +6,8 @@ title: Verify No Critical or High Vulnerabilities in Product **Type:** Rule **ID:** `scribe-cve-product` **Uses:** `api/scribe-api-cve-product@v2/rules` -**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-cve-product.yaml) -**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.rego) +**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 55b323127..f122d429a 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -6,8 +6,8 @@ title: Verify No Critical or High Vulnerabilities **Type:** Rule **ID:** `scribe-cve` **Uses:** `api/scribe-api-cve@v2/rules` -**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-cve.yaml) -**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.rego) +**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index 79d7062e0..615cc3ba6 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -6,8 +6,8 @@ title: Scribe Published Policy **Type:** Rule **ID:** `scribe-published-policy` **Uses:** `api/scribe-api-published@v2/rules` -**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-published.yaml) -**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api-published.rego) +**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml) +**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego) **Labels:** Scribe Verify image Scribe Publish flag is set for container image. diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index 4eb34f4e3..42012a693 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -6,7 +6,7 @@ title: Apply Scribe Template Policy **Type:** Rule **ID:** `scribe-template` **Uses:** `api/scribe-api@v2/rules` -**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/v2/rules/api/scribe-api.yaml) +**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) **Labels:** Scribe Verify XX using the Scribe API template rule. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index ac91cd967..bd24f9763 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -6,8 +6,8 @@ title: Allowed Project Admins **Type:** Rule **ID:** `bb-project-allowed-project-admins` **Uses:** `bitbucket/project/allow-admins@v2/rules` -**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-admins.rego) +**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego) Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 06c88e399..5f725d6f5 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -6,8 +6,8 @@ title: Allowed Project Users **Type:** Rule **ID:** `bb-project-allowed-project-users` **Uses:** `bitbucket/project/allow-users@v2/rules` -**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/allow-users.rego) +**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego) Verify only users specified in the Allowed List have user access to the Bitbucket project. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index a5ed81413..9d51faf2a 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -6,8 +6,8 @@ title: Prevent Credential Exposure **Type:** Rule **ID:** `bb-project-exposed-credentials` **Uses:** `bitbucket/project/exposed-credentials@v2/rules` -**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/exposed-credentials.yaml) -**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/exposed-credentials.rego) +**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego) **Labels:** Bitbucket, Project Verify access to the Bitbucket project is blocked if exposed credentials are detected. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 221007cda..5ecef8388 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -6,8 +6,8 @@ title: Prevent Long-Lived Tokens **Type:** Rule **ID:** `bb-project-long-live-tokens` **Uses:** `bitbucket/project/long-live-tokens@v2/rules` -**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/long-live-tokens.yaml) -**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/project/long-live-tokens.rego) +**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml) +**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego) **Labels:** Bitbucket, Project Verify Bitbucket API tokens expire before the maximum time to live. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 9dbd2265a..07fd69e58 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -6,8 +6,8 @@ title: Allowed Repository Admins **Type:** Rule **ID:** `bb-repo-allowed-repository-admins` **Uses:** `bitbucket/repository/allow-admins@v2/rules` -**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-admins.rego) +**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego) **Labels:** Bitbucket, Repository Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 4056f3dda..e155d3605 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -6,8 +6,8 @@ title: Allowed Repository Users **Type:** Rule **ID:** `bb-repo-allowed-repository-users` **Uses:** `bitbucket/repository/allow-users@v2/rules` -**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/allow-users.rego) +**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego) **Labels:** Bitbucket, Repository Verify only users specified in the Allowed List have user access to the Bitbucket repository. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 1091c002b..aa55fa4ed 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -6,8 +6,8 @@ title: Verify Default Branch Protection Setting Is Configured **Type:** Rule **ID:** `bb-repo-branch-protection` **Uses:** `bitbucket/repository/branch-protection@v2/rules` -**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/repository/branch-protection.rego) +**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego) **Labels:** Bitbucket, Repository Verify the default branch protection is enabled in the Bitbucket repository. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index ef01edb80..edeed5585 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -6,8 +6,8 @@ title: Allowed Workspace Admins **Type:** Rule **ID:** `bb-workspace-allowed-workspace-admins` **Uses:** `bitbucket/workspace/allow-admins@v2/rules` -**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-admins.rego) +**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego) **Labels:** Bitbucket, Workspace Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index d1aed7d6d..487bcfe6d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -6,8 +6,8 @@ title: Allowed Workspace Users **Type:** Rule **ID:** `bb-workspace-allowed-workspace-users` **Uses:** `bitbucket/workspace/allow-users@v2/rules` -**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/bitbucket/workspace/allow-users.rego) +**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego) **Labels:** Bitbucket, Workspace Verify only users specified in the Allowed List have user access to the Bitbucket workspace. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index c861bd080..7ce6b43dc 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -6,8 +6,8 @@ title: Verify DockerHub Tokens are Active **Type:** Rule **ID:** `dockerhub-token-expiration` **Uses:** `dockerhub/token-expiration@v2/rules` -**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-expiration.yaml) -**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-expiration.rego) +**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml) +**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego) **Labels:** Dockerhub Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 47530397d..74a443849 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -6,8 +6,8 @@ title: Verify no unused Dockerhub **Type:** Rule **ID:** `dockerhub-token-not-used` **Uses:** `dockerhub/token-not-used@v2/rules` -**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-not-used.yaml) -**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/v2/rules/dockerhub/token-not-used.rego) +**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml) +**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego) **Labels:** Dockerhub Verify that there are no unused Dockerhub. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 67b31da30..3e5d53eb9 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -6,8 +6,8 @@ title: Generic Artifact Signed **Type:** Rule **ID:** `generic-artifact-signed` **Uses:** `generic/artifact-signed@v2/rules` -**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/artifact-signed.rego) +**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego) **Labels:** 3rd-party Verify required evidence is signed. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index b5f2a8b58..047ad1fe7 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -6,8 +6,8 @@ title: Required Generic Evidence Exists **Type:** Rule **ID:** `generic-required-evidence` **Uses:** `generic/evidence-exists@v2/rules` -**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/evidence-exists.rego) +**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego) **Labels:** 3rd-party Verify required evidence exists. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 2198f534b..41bbb70d3 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -6,8 +6,8 @@ title: K8s Jailbreak **Type:** Rule **ID:** `k8s-jailbreak` **Uses:** `generic/k8s-jailbreak@v2/rules` -**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/k8s-jailbreak.yaml) -**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/v2/rules/generic/k8s-jailbreak.rego) +**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml) +**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego) **Labels:** K8s Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index ae74090dd..ab244dc4c 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -6,7 +6,7 @@ title: Required Trivy Evidence Exists **Type:** Rule **ID:** `required-trivy-evidence` **Uses:** `generic/trivy-exists@v2/rules` -**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/generic/trivy-exists.yaml) +**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml) **Labels:** 3rd-party Verify required Trivy evidence exists diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index f26ea213e..965493558 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -6,8 +6,8 @@ title: Git Artifact Signed **Type:** Rule **ID:** `git-artifact-signed` **Uses:** `git/artifact-signed@v2/rules` -**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/artifact-signed.rego) +**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) **Labels:** Git Verify the Git artifact is signed. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 6f6521318..b3cea170b 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -6,8 +6,8 @@ title: Restrict Coding Permissions **Type:** Rule **ID:** `git-coding-permissions` **Uses:** `git/coding-permissions@v2/rules` -**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/coding-permissions.yaml) -**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/coding-permissions.rego) +**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) +**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) **Labels:** Git Verify only allowed users committed to the repository. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 09a5b5b89..fa1b43b50 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -6,8 +6,8 @@ title: Required Git Evidence Exists **Type:** Rule **ID:** `required-git-evidence` **Uses:** `git/evidence-exists@v2/rules` -**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/evidence-exists.rego) +**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) **Labels:** Git Verify required Git evidence exists. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index c0c5b5993..1c772d72c 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -6,8 +6,8 @@ title: Disallow Commits to Main Branch **Type:** Rule **ID:** `git-disallow-commits-to-main` **Uses:** `git/no-commit-to-main@v2/rules` -**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/no-commit-to-main.yaml) -**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/no-commit-to-main.rego) +**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) +**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) **Labels:** Git Verify commits made directly to the main branch are disallowed. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index edb69dc3d..b1524d90b 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -6,8 +6,8 @@ title: Disallow Unsigned Commits **Type:** Rule **ID:** `git-disallow-unsigned-commits` **Uses:** `git/no-unsigned-commits@v2/rules` -**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/git/no-unsigned-commits.yaml) -**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/git/no-unsigned-commits.rego) +**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml) +**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego) **Labels:** Git Verify all commits are signed. diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 36ffc05ff..08c9a5a5b 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -6,8 +6,8 @@ title: Branch protection enabled in GitHub repository **Type:** Rule **ID:** `github-api-branch-protection` **Uses:** `github/api/branch-protection@v2/rules` -**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/branch-protection.rego) +**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego) **Labels:** GitHub Verify GitHub branch protection rules diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index d56048c52..60bae2a0a 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -6,8 +6,8 @@ title: Verify Selected Commits Are Signed API **Type:** Rule **ID:** `github-api-signed-commits-list` **Uses:** `github/api/signed-commits-list@v2/rules` -**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-list.yaml) -**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-list.rego) +**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego) **Labels:** GitHub, API Verify selected commits are signed in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index 95ca64838..f61997182 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -6,8 +6,8 @@ title: Disallow Unsigned Commits In Time Range **Type:** Rule **ID:** `signed-commits-range` **Uses:** `github/api/signed-commits-range@v2/rules` -**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-range.yaml) -**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/api/signed-commits-range.rego) +**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego) **Labels:** GitHub Verify commits in the specified time range are signed. diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 7aeffd5c6..cd6fe373a 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -6,8 +6,8 @@ title: Verify two_factor_requirement_enabled setting **Type:** Rule **ID:** `github-org-2fa` **Uses:** `github/org/2fa@v2/rules` -**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/2fa.yaml) -**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/2fa.rego) +**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) +**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) **Labels:** GitHub, Organization Verify `two_factor_requirement` is enabled in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 04d8eeba7..7f993b735 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -6,8 +6,8 @@ title: Verify advanced security setting is enabled **Type:** Rule **ID:** `github-org-advanced-security` **Uses:** `github/org/advanced-security@v2/rules` -**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/advanced-security.yaml) -**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/advanced-security.rego) +**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) +**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) **Labels:** GitHub, Organization Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 5c1d3d968..02d1cc6c6 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -6,8 +6,8 @@ title: Allowed GitHub Organization Admins **Type:** Rule **ID:** `github-orgallowed-admins` **Uses:** `github/org/allow-admins@v2/rules` -**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-admins.rego) +**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) **Labels:** GitHub, Organization Verify only users in the Allowed List have admin privileges in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index d04650c4d..64f273427 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -6,8 +6,8 @@ title: Allowed GitHub Organization Users **Type:** Rule **ID:** `github-org-allowed-users` **Uses:** `github/org/allow-users@v2/rules` -**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/allow-users.rego) +**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego) **Labels:** GitHub, Organization Verify only users in the Allowed List have user access to the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index c7f77e94d..69158d1ea 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -6,8 +6,8 @@ title: Verify members_can_create_private_repositories setting **Type:** Rule **ID:** `github-org-create-private-repos` **Uses:** `github/org/create-private-repos@v2/rules` -**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-private-repos.yaml) -**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-private-repos.rego) +**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) +**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index b804385a7..78f855909 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -6,8 +6,8 @@ title: Verify members_can_create_repositories setting **Type:** Rule **ID:** `github-org-create-repos` **Uses:** `github/org/create-repos@v2/rules` -**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-repos.yaml) -**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/create-repos.rego) +**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) +**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 2f03b2649..a33b02393 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -6,8 +6,8 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-alerts` **Uses:** `github/org/dependabot-alerts@v2/rules` -**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-alerts.yaml) -**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-alerts.rego) +**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml) +**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego) **Labels:** GitHub, Organization Verify Dependabot alerts for new repositories are enabled in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 2e7485a84..052010885 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -6,8 +6,8 @@ title: Verify dependabot_security_updates setting in security_and_analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` **Uses:** `github/org/dependabot-security-updates-sa@v2/rules` -**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates-sa.yaml) -**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates-sa.rego) +**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) +**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego) **Labels:** GitHub, Organization Verify Dependabot security updates are configured in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 0ec90b8dd..bf57d1b78 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -6,8 +6,8 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` **Uses:** `github/org/dependabot-security-updates@v2/rules` -**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates.yaml) -**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependabot-security-updates.rego) +**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) +**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego) **Labels:** GitHub, Organization Verify Dependabot security updates for new repositories are configured in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index cc1924d0d..fa110abd0 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -6,8 +6,8 @@ title: Verify dependency_graph_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependency-graph` **Uses:** `github/org/dependency-graph@v2/rules` -**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependency-graph.yaml) -**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/dependency-graph.rego) +**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) +**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization Verify `dependency_graph` is enabled for new repositories in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 9a77f2d3e..7a69e2bbc 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -6,8 +6,8 @@ title: Limit Admin Number in GitHub Organization **Type:** Rule **ID:** `github-org-max-admins` **Uses:** `github/org/max-admins@v2/rules` -**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/max-admins.yaml) -**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/max-admins.rego) +**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) **Labels:** Blueprint, GitHub, Organization Verify the maximum number of GitHub organization admins is restricted. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index eedf811c0..20145ddad 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -6,8 +6,8 @@ title: Verify GitHub Organization Secrets Are Not Too Old **Type:** Rule **ID:** `github-org-old-secrets` **Uses:** `github/org/old-secrets@v2/rules` -**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/old-secrets.yaml) -**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/old-secrets.rego) +**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego) **Labels:** GitHub, Organization Verify secrets in the GitHub organization are not older than the specified threshold. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 24f192c5c..4782f0d16 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -6,8 +6,8 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting **Type:** Rule **ID:** `github-org-pp-custom-link` **Uses:** `github/org/pp-custom-link@v2/rules` -**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/pp-custom-link.yaml) -**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/pp-custom-link.rego) +**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) +**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) **Labels:** GitHub, Organization Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 1e0eb3e3d..9a12f10c9 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -6,8 +6,8 @@ title: Verify Secret_Scanning_Push_Protection Setting **Type:** Rule **ID:** `github-org-push-protection-sa` **Uses:** `github/org/push-protection-sa@v2/rules` -**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection-sa.yaml) -**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection-sa.rego) +**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) +**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization Verify `secret_scanning_push_protection` is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 1b22fc6ca..0d4bbdf2c 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -7,8 +7,8 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti **Type:** Rule **ID:** `github-org-push-protection` **Uses:** `github/org/push-protection@v2/rules` -**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection.yaml) -**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/push-protection.rego) +**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) **Labels:** GitHub, Organization Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index bdcc9acc2..ffc4f4713 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -6,8 +6,8 @@ title: Verify Repo Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` **Uses:** `github/org/repo-visibility@v2/rules` -**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/repo-visibility.yaml) -**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/repo-visibility.rego) +**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) +**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) **Labels:** GitHub, Organization Verify only repositories in the Allowed List are public in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index ed2089467..3f5eb3502 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -6,8 +6,8 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-secret-scanning-sa` **Uses:** `github/org/secret-scanning-sa@v2/rules` -**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning-sa.yaml) -**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning-sa.rego) +**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) +**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization Verify `secret_scanning` is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 88c6dac44..444b00459 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -6,8 +6,8 @@ title: Verify secret_scanning_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-secret-scanning` **Uses:** `github/org/secret-scanning@v2/rules` -**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning.yaml) -**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/secret-scanning.rego) +**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization Verify `secret_scanning` is enabled for new repositories in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 557e6bdc1..e5753f71b 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -6,8 +6,8 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-validity-checks-sa` **Uses:** `github/org/validity-checks-sa@v2/rules` -**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks-sa.yaml) -**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks-sa.rego) +**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) +**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization Verify `secret_scanning_validity_checks` is configured in the GitHub organization. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 5a4664cd1..6bc76b144 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -6,8 +6,8 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting **Type:** Rule **ID:** `github-org-validity-checks` **Uses:** `github/org/validity-checks@v2/rules` -**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks.yaml) -**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/validity-checks.rego) +**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization Verify `secret_scanning_validity_checks` is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 4bc6c197a..1fcf3d305 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -6,8 +6,8 @@ title: Verify GitHub Organization Requires Signoff on Web Commits **Type:** Rule **ID:** `github-org-web-commit-signoff` **Uses:** `github/org/web-commit-signoff@v2/rules` -**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/org/web-commit-signoff.yaml) -**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/org/web-commit-signoff.rego) +**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) **Labels:** GitHub, Organization Verify contributors sign commits through the GitHub web interface. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 1f5718590..63eee0235 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -6,8 +6,8 @@ title: Verify Branch Protection Setting **Type:** Rule **ID:** `github-repo-branch-protection` **Uses:** `github/repository/branch-protection@v2/rules` -**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-protection.rego) +**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego) **Labels:** GitHub, Repository Verify branch protection is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 5d8e5273f..ec01637a1 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -6,8 +6,8 @@ title: Verify Branch Verification Setting **Type:** Rule **ID:** `github-repo-branch-verification` **Uses:** `github/repository/branch-verification@v2/rules` -**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-verification.yaml) -**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/branch-verification.rego) +**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml) +**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego) **Labels:** GitHub, Repository Verify branch verification in the GitHub repository matches the value defined in the configuration file. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 12884d17c..81fbd1958 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -6,8 +6,8 @@ title: Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` **Uses:** `github/repository/check-signed-commits@v2/rules` -**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/check-signed-commits.yaml) -**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/check-signed-commits.rego) +**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego) **Labels:** GitHub, Repository Verify all commits in the GitHub repository are signed. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 7edd0e174..b1d4c2385 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -6,8 +6,8 @@ title: Verify Default Branch Protection **Type:** Rule **ID:** `github-repo-default-branch-protection` **Uses:** `github/repository/default-branch-protection@v2/rules` -**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/default-branch-protection.yaml) -**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/default-branch-protection.rego) +**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml) +**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego) **Labels:** GitHub, Repository Verify the default branch protection is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index e490f2ffa..ba02412fd 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -6,8 +6,8 @@ title: Verify Dependabot security updates setting **Type:** Rule **ID:** `github-repo-dependabot` **Uses:** `github/repository/dependabot@v2/rules` -**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/dependabot.yaml) -**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/dependabot.rego) +**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) +**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego) **Labels:** GitHub, Repository Verify Dependabot security updates are configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 4312d6d23..e64a03e7c 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -6,8 +6,8 @@ title: Verify Only Ephemeral Runners Exist in Repository **Type:** Rule **ID:** `github-repo-ephemeral-runners-only` **Uses:** `github/repository/ephemeral-runners-only@v2/rules` -**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/ephemeral-runners-only.yaml) -**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/ephemeral-runners-only.rego) +**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml) +**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego) **Labels:** GitHub, Repository Verify self-hosted runners are disallowed in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 5b471b94a..fdbb7cbb2 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -6,8 +6,8 @@ title: Verify No Cache Usage Exists in Repository **Type:** Rule **ID:** `github-repo-no-cache-usage` **Uses:** `github/repository/no-cache-usage@v2/rules` -**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-cache-usage.yaml) -**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-cache-usage.rego) +**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml) +**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego) **Labels:** GitHub, Repository Verify the GitHub repository has no cache usage. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index acb11bbf0..32c0eb9e3 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -6,8 +6,8 @@ title: Verify No Organization Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-no-org-secrets` **Uses:** `github/repository/no-org-secrets@v2/rules` -**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-org-secrets.yaml) -**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/no-org-secrets.rego) +**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml) +**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego) **Labels:** GitHub, Repository Verify no organization secrets exist in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index c8d197531..5720e91b4 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -6,8 +6,8 @@ title: Verify No Old Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-old-secrets` **Uses:** `github/repository/old-secrets@v2/rules` -**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/old-secrets.yaml) -**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/old-secrets.rego) +**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego) **Labels:** GitHub, Repository Verify secrets in the GitHub repository are not older than the specified threshold. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 0b61dde46..389c5366e 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -6,8 +6,8 @@ title: Verify Push Protection Setting **Type:** Rule **ID:** `github-repo-push-protection` **Uses:** `github/repository/push-protection@v2/rules` -**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/push-protection.yaml) -**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/push-protection.rego) +**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) **Labels:** GitHub, Repository Verify `secret_scanning_push_protection` is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 3a857adaf..1e8678b4a 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -6,8 +6,8 @@ title: Verify Repository Is Private **Type:** Rule **ID:** `github-repo-private` **Uses:** `github/repository/repo-private@v2/rules` -**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/repo-private.yaml) -**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/repo-private.rego) +**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml) +**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego) **Labels:** GitHub, Repository Verify the GitHub repository is private. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 16f7ea536..04e02fde6 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -6,8 +6,8 @@ title: Verify secret_scanning setting **Type:** Rule **ID:** `github-repo-secret-scanning` **Uses:** `github/repository/secret-scanning@v2/rules` -**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/secret-scanning.yaml) -**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/secret-scanning.rego) +**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) **Labels:** GitHub, Repository Verify `secret_scanning` is configured in the GitHub repository. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 882ca4fa1..4ce151ab5 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -6,8 +6,8 @@ title: Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` **Uses:** `github/repository/signed-commits@v2/rules` -**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/signed-commits.yaml) -**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/signed-commits.rego) +**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml) +**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego) **Labels:** GitHub, Repository Verify all commits are signed in a repository attestation. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 543e8e6f7..43321fd1f 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -6,8 +6,8 @@ title: Verify secret scanning. **Type:** Rule **ID:** `github-repo-validity-checks` **Uses:** `github/repository/validity-checks@v2/rules` -**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/validity-checks.yaml) -**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/validity-checks.rego) +**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) **Labels:** GitHub, Repository Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 617fda770..f81396c45 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -6,8 +6,8 @@ title: Allowed Public Repositories **Type:** Rule **ID:** `github-repo-visibility` **Uses:** `github/repository/visibility@v2/rules` -**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/visibility.yaml) -**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/visibility.rego) +**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml) +**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego) **Labels:** GitHub, Repository Verify only GitHub repositories in the Allowed List are public. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 5e97f5f5e..c37fc1e93 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -6,8 +6,8 @@ title: Verify Repository Requires Commit Signoff **Type:** Rule **ID:** `github-repo-web-commit-signoff` **Uses:** `github/repository/web-commit-signoff@v2/rules` -**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/web-commit-signoff.yaml) -**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/v2/rules/github/repository/web-commit-signoff.rego) +**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego) **Labels:** GitHub, Repository Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 0bab5c820..749afe489 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -6,8 +6,8 @@ title: Set Push Rules in GitLab **Type:** Rule **ID:** `gitlab-api-push-rules` **Uses:** `gitlab/api/push-rules@v2/rules` -**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/push-rules.yaml) -**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/push-rules.rego) +**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml) +**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego) **Labels:** Gitlab, API Verify GitLab push rules are configured via the API. diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index cfe461507..c8f622c2b 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -6,8 +6,8 @@ title: Sign Selected Commits in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-list` **Uses:** `gitlab/api/signed-commits-list@v2/rules` -**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-list.yaml) -**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-list.rego) +**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego) **Labels:** Gitlab, API Verify the selected commits are signed in the GitLab organization. diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 7ac9227e8..2fc63a580 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -6,8 +6,8 @@ title: Sign Selected Commit Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` **Uses:** `gitlab/api/signed-commits-range@v2/rules` -**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-range.yaml) -**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/api/signed-commits-range.rego) +**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) **Labels:** Gitlab, API Verify the selected range of commits is signed via the GitLab API. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 2015ad1a4..eb4ad033b 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -6,8 +6,8 @@ title: Allowed Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-admins` **Uses:** `gitlab/org/allow-admins@v2/rules` -**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-admins.rego) +**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego) **Labels:** Gitlab, Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 1ff63639a..b65b35b43 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -6,8 +6,8 @@ title: Restrict Token Scopes in GitLab **Type:** Rule **ID:** `gitlab-org-allowed-token-scope` **Uses:** `gitlab/org/allow-token-scopes@v2/rules` -**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-token-scopes.yaml) -**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-token-scopes.rego) +**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml) +**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego) **Labels:** Gitlab, Organization Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 0f1653075..b059c9995 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -6,8 +6,8 @@ title: Allowed Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-users` **Uses:** `gitlab/org/allow-users@v2/rules` -**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/allow-users.rego) +**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego) **Labels:** Gitlab, Organization Verify only users in the Allowed List have access to the GitLab organization. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 0a2464ce2..b064d228c 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -6,8 +6,8 @@ title: Block Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-blocked-users` **Uses:** `gitlab/org/blocked-users@v2/rules` -**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/blocked-users.yaml) -**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/blocked-users.rego) +**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml) +**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego) **Labels:** Gitlab, Organization Verify no users in the GitLab organization are on the block list. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index c70a54c93..ce7b7e46a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -6,8 +6,8 @@ title: Prevent Token Expiration in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-about-to-expire` **Uses:** `gitlab/org/expiring-tokens@v2/rules` -**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/expiring-tokens.yaml) -**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/expiring-tokens.rego) +**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml) +**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego) **Labels:** Gitlab, Organization Verify no GitLab organization tokens are about to expire. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 965d7a7b7..c5f5ee169 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -6,17 +6,12 @@ title: Forbid Token Scopes in GitLab Organization **Type:** Rule **ID:** `gitlab-org-disallowed-token-scope` **Uses:** `gitlab/org/forbid-token-scopes@v2/rules` -**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/forbid-token-scopes.yaml) -**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/forbid-token-scopes.rego) +**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml) +**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego) **Labels:** Blueprint, Gitlab, Organization Verify no GitLab organization tokens have disallowed scopes. - -## Mitigation -Prevents the use of tokens with insecure or excessive scopes within the organization. This check reduces the risk of unauthorized actions by ensuring that only tokens with allowed scopes are used, while permitting trusted tokens via the approved tokens list. - - :::tip Rule Result will be set as 'open' if evidence is missing. ::: @@ -27,18 +22,6 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Description -This rule examines evidence from a GitLab organization scan to ensure that tokens do not contain any disallowed scopes. -It iterates over each token in the evidence (under `input.evidence.predicate.content[*].token`), filtering for tokens -that are active and not revoked. For each token, it checks whether any of its scopes match the forbidden list specified -in `with.project_scopes`. If a token's scope matches a forbidden value and the token is not listed in `with.approved_tokens`, -a violation is recorded with details including the token name and the disallowed scope. - -**Evidence Requirements:** -- Evidence must be provided in a generic format. -- The evidence should include token data with fields such as `result_object.revoked`, `result_object.active`, and `result_object.scopes`. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -52,4 +35,3 @@ a violation is recorded with details including the token name and the disallowed | Parameter | Default | |-----------|---------| | project_scopes | ['write_api', 'write_repository'] | -| approved_tokens | [] | diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 50ac3d40f..8c4a5b1c5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -6,8 +6,8 @@ title: Ensure Active Projects in GitLab Organization **Type:** Rule **ID:** `gitlab-org-inactive-projects` **Uses:** `gitlab/org/inactive-projects@v2/rules` -**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/inactive-projects.yaml) -**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/inactive-projects.rego) +**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml) +**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego) **Labels:** Gitlab, Organization Verify no GitLab organization projects are inactive. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index b6a86260e..c62837dc1 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -6,8 +6,8 @@ title: Forbid Long-Lived Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-excessive-lifespan` **Uses:** `gitlab/org/longlive-tokens@v2/rules` -**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/longlive-tokens.yaml) -**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/longlive-tokens.rego) +**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml) +**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego) **Labels:** Blueprint, Gitlab, Organization Verify no GitLab organization tokens have an excessively long lifespan. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index d9de70602..f1524da1b 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -6,8 +6,8 @@ title: Limit Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-max-admins` **Uses:** `gitlab/org/max-admins@v2/rules` -**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/max-admins.yaml) -**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/max-admins.rego) +**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego) **Labels:** Blueprint, GitLab, Organization Verify the maximum number of admins for the GitLab project is restricted. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 70bcada9d..507183995 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -6,8 +6,8 @@ title: Restrict Public Visibility in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-visible-projects` **Uses:** `gitlab/org/projects-visibility@v2/rules` -**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/projects-visibility.yaml) -**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/projects-visibility.rego) +**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml) +**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego) **Labels:** Gitlab, Organization Verify only allowed projects in the GitLab organization have public visibility. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 23e573eeb..f1933e4b9 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -6,8 +6,8 @@ title: Forbid Unused Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-unused-tokens` **Uses:** `gitlab/org/unused-tokens@v2/rules` -**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/unused-tokens.yaml) -**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/org/unused-tokens.rego) +**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml) +**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego) **Labels:** Gitlab, Organization Verify there are no unused GitLab organization tokens. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index dfe268db7..0e5ff4e45 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -6,8 +6,8 @@ title: GitLab pipeline verify labels exist **Type:** Rule **ID:** `gitlab-pipeline-verify-labels-exist` **Uses:** `gitlab/pipeline/verify-labels-exist@v2/rules` -**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) -**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels-exist.rego) +**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego) **Labels:** Gitlab, Pipeline Verify the pipeline has all required label keys and values. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index ce81e5036..ee5c506a6 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -6,8 +6,8 @@ title: Verify GitLab Pipeline Labels **Type:** Rule **ID:** `gitlab-pipeline-verify-labels` **Uses:** `gitlab/pipeline/verify-labels@v2/rules` -**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels.yaml) -**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/pipeline/verify-labels.rego) +**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego) **Labels:** Gitlab, Pipeline Verify the pipeline includes all required label keys and values. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 602a8594c..e180f349a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -6,8 +6,8 @@ title: Verify Project Activity **Type:** Rule **ID:** `gitlab-project-abandoned-project` **Uses:** `gitlab/project/abandoned-project@v2/rules` -**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/abandoned-project.yaml) -**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/abandoned-project.rego) +**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml) +**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego) **Labels:** Gitlab, Project Verify the GitLab project is active for a specified duration. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 5dc96a6b6..220fffdc8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -6,8 +6,8 @@ title: Merge approval policy check for GitLab project **Type:** Rule **ID:** `gitlab-project-merge-approval` **Uses:** `gitlab/project/approvals-policy-check@v2/rules` -**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvals-policy-check.yaml) -**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvals-policy-check.rego) +**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml) +**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego) **Labels:** Blueprint, Gitlab, Project Verify the project's merge approval policy complies with requirements. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 41d1e2e69..e19d55801 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -6,8 +6,8 @@ title: Restrict Approvers Per Merge Request **Type:** Rule **ID:** `gitlab-project-approvers-per-merge-request` **Uses:** `gitlab/project/approvers-per-merge-request@v2/rules` -**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvers-per-merge-request.yaml) -**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/approvers-per-merge-request.rego) +**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml) +**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) **Labels:** Gitlab, Project Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index 83d285e82..45db114d1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -6,8 +6,8 @@ title: Set Author Email Regex in GitLab Project **Type:** Rule **ID:** `gitlab-project-author-email-regex` **Uses:** `gitlab/project/author-email-regex@v2/rules` -**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/author-email-regex.yaml) -**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/author-email-regex.rego) +**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml) +**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego) **Labels:** Gitlab, Project Verify the `author_email_regex` for the GitLab project is set to the specified value. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 82cd62ad7..9ad8f9feb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -6,8 +6,8 @@ title: Check CWE Compliance **Type:** Rule **ID:** `gitlab-project-check-cwe` **Uses:** `gitlab/project/check-cwe@v2/rules` -**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-cwe.yaml) -**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-cwe.rego) +**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml) +**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego) **Labels:** Gitlab, Project Verify that specified CWEs were not detected in the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 5afd98dd4..a6a9fb97e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -6,8 +6,8 @@ title: Ensure All Commits Are Signed in GitLab Project **Type:** Rule **ID:** `gitlab-project-signed-commits` **Uses:** `gitlab/project/check-signed-commits@v2/rules` -**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-signed-commits.yaml) -**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/check-signed-commits.rego) +**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego) **Labels:** Gitlab, Project Verify all commits in the GitLab project are signed. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index bbd5a6fd1..cc901a22e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -6,8 +6,8 @@ title: Require Code Owner Approval in GitLab Project **Type:** Rule **ID:** `gitlab-project-code-owner-approval` **Uses:** `gitlab/project/co-approval-required@v2/rules` -**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/co-approval-required.yaml) -**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/co-approval-required.rego) +**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml) +**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego) **Labels:** Gitlab, Project Verify code owner approval is required for specific branches in the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index adac60a01..f9b40e60e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -6,8 +6,8 @@ title: Restrict Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-authors` **Uses:** `gitlab/project/commit-author-email-check@v2/rules` -**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-email-check.yaml) -**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-email-check.rego) +**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml) +**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego) **Labels:** Gitlab, Project Verify only GitLab project users in the Allowed List have commit author permissions. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 177ff7d4a..370e4d07f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -6,8 +6,8 @@ title: Allowed Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-author-names` **Uses:** `gitlab/project/commit-author-name-check@v2/rules` -**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-name-check.yaml) -**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-author-name-check.rego) +**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml) +**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego) **Labels:** Gitlab, Project Verify only users in the Allowed List author commits in the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 79046042b..62e15ce57 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -6,8 +6,8 @@ title: Enable Commit Committer Check in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-commit_committer_check` **Uses:** `gitlab/project/commit-committer-check@v2/rules` -**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-committer-check.yaml) -**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-committer-check.rego) +**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml) +**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego) **Labels:** Gitlab, Project Verify `commit_committer_check` is enabled for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index e44254bf2..10bae785c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -6,8 +6,8 @@ title: Verify Commit Message Format **Type:** Rule **ID:** `gitlab-project-verify-commit_message_check` **Uses:** `gitlab/project/commit-message-check@v2/rules` -**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-message-check.yaml) -**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commit-message-check.rego) +**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml) +**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego) **Labels:** Gitlab, Project Verify that commit messages in the GitLab project adhere to the specified format template. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 7b2e9507c..55bfa996e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -6,8 +6,8 @@ title: Validate All Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-all-commits-validated` **Uses:** `gitlab/project/commits-validated@v2/rules` -**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commits-validated.yaml) -**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/commits-validated.rego) +**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml) +**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego) **Labels:** Gitlab, Project Verify all commits in the GitLab project are validated. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 1a34f7a74..07c71a50e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -6,8 +6,8 @@ title: Allowed Committer Emails in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-emails` **Uses:** `gitlab/project/committer-email-check@v2/rules` -**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-email-check.yaml) -**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-email-check.rego) +**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml) +**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego) **Labels:** Gitlab, Project Verify only users in the Allowed List use committer email addresses in the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 48cbf8623..dbcd45dba 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -6,8 +6,8 @@ title: Allowed Committer Names in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-names` **Uses:** `gitlab/project/committer-name-check@v2/rules` -**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-name-check.yaml) -**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/committer-name-check.rego) +**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml) +**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego) **Labels:** Gitlab, Project Verify only users in the Allowed List commit by name in the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index e83e99b6f..ac21268ad 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -6,8 +6,8 @@ title: Enforce Critical Severity Limit **Type:** Rule **ID:** `gitlab-project-critical-severity-limit` **Uses:** `gitlab/project/critical-severity-limit@v2/rules` -**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/critical-severity-limit.yaml) -**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/critical-severity-limit.rego) +**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml) +**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego) **Labels:** Gitlab, Project Verify the maximum allowed critical severity alerts for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index b35e5b97b..aaf9f0891 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -6,8 +6,8 @@ title: Check Description Substring **Type:** Rule **ID:** `gitlab-project-description-substring-check` **Uses:** `gitlab/project/description-substring-check@v2/rules` -**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/description-substring-check.yaml) -**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/description-substring-check.rego) +**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml) +**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego) **Labels:** Gitlab, Project Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index b4c149bfe..6c7276eca 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -6,8 +6,8 @@ title: Disallow Banned Approvers **Type:** Rule **ID:** `gitlab-project-disallowed-banned-approvers` **Uses:** `gitlab/project/disallowed-banned-approvers@v2/rules` -**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) -**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/disallowed-banned-approvers.rego) +**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) +**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego) **Labels:** Gitlab, Project Verify approvers in the GitLab project are not on the banned list. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 9ec567797..42df2d6a3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -6,8 +6,8 @@ title: Disallow Force Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-force-push` **Uses:** `gitlab/project/force-push-protection@v2/rules` -**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/force-push-protection.yaml) -**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/force-push-protection.rego) +**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml) +**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego) **Labels:** Gitlab, Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 5ade237dd..1830ce178 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -6,8 +6,8 @@ title: Enforce Medium Severity Limit **Type:** Rule **ID:** `gitlab-project-medium-severity-limit` **Uses:** `gitlab/project/medium-severity-limit@v2/rules` -**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/medium-severity-limit.yaml) -**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/medium-severity-limit.rego) +**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml) +**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego) **Labels:** Gitlab, Project Verify the maximum allowed medium severity alerts for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 22c463dba..e1f9fc822 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -6,8 +6,8 @@ title: Enable Member Check for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-member_check` **Uses:** `gitlab/project/member-check@v2/rules` -**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/member-check.yaml) -**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/member-check.rego) +**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml) +**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego) **Labels:** Gitlab, Project Verify `member_check` is enabled for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 82a1e71c9..3340df0df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -6,8 +6,8 @@ title: Enforce Merge Access Level Policy for GitLab Project **Type:** Rule **ID:** `gitlab-project-merge-access-level` **Uses:** `gitlab/project/merge-access-level@v2/rules` -**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-access-level.yaml) -**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-access-level.rego) +**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml) +**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego) **Labels:** Gitlab, Project Verify the GitLab project's merge access level complies with requirements. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index ce502147b..2fc963379 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -6,8 +6,8 @@ title: Disable Author Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-author-approval` **Uses:** `gitlab/project/merge-requests-author-approval@v2/rules` -**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-author-approval.yaml) -**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-author-approval.rego) +**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml) +**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) **Labels:** Gitlab, Project Verify the binary field `merge_requests_author_approval` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 80c91c225..651e5e1de 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -6,8 +6,8 @@ title: Disable Committers' Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-disable-committers-approval` **Uses:** `gitlab/project/merge-requests-disable-committers-approval@v2/rules` -**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) -**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) +**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) +**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) **Labels:** Gitlab, Project Verify `merge_requests_disable_committers_approval` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 653955840..067e513df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -6,8 +6,8 @@ title: Check Message Substring **Type:** Rule **ID:** `gitlab-project-message-substring-check` **Uses:** `gitlab/project/message-substring-check@v2/rules` -**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/message-substring-check.yaml) -**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/message-substring-check.rego) +**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml) +**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego) **Labels:** Gitlab, Project Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index a182d87b5..31e3805b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -6,8 +6,8 @@ title: Enable Secrets Prevention in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-prevent_secrets` **Uses:** `gitlab/project/prevent-secrets-check@v2/rules` -**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/prevent-secrets-check.yaml) -**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/prevent-secrets-check.rego) +**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml) +**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego) **Labels:** Gitlab, Project Verify `prevent_secrets` is enabled for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 7b4a6ba32..3ebaaccfb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -6,8 +6,8 @@ title: Protect CI Secrets in GitLab Project **Type:** Rule **ID:** `gitlab-project-protect-ci-secrets` **Uses:** `gitlab/project/protect-ci-secrets@v2/rules` -**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/protect-ci-secrets.yaml) -**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/protect-ci-secrets.rego) +**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml) +**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego) **Labels:** Gitlab, Project Verify secrets in the GitLab project are not shared. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index c92d1f35c..2a217d06f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -6,8 +6,8 @@ title: Set Push Access Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-push-access-level` **Uses:** `gitlab/project/push-access-level@v2/rules` -**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-access-level.yaml) -**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-access-level.rego) +**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml) +**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego) **Labels:** Gitlab, Project Verify the GitLab project's push access level policy complies with requirements. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index cfae7e096..7b96e8eec 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -6,8 +6,8 @@ title: Set Push Rules for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-push_rules` **Uses:** `gitlab/project/push-rules-set@v2/rules` -**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-rules-set.yaml) -**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/push-rules-set.rego) +**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml) +**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego) **Labels:** Gitlab, Project Verify push rules are set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index b81ea4ae0..3f1160032 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -6,8 +6,8 @@ title: Reject Unsigned Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-unsigned-commits` **Uses:** `gitlab/project/reject-unsigned-commits@v2/rules` -**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reject-unsigned-commits.yaml) -**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reject-unsigned-commits.rego) +**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml) +**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego) **Labels:** Blueprint, Gitlab, Project Verify `reject_unsigned_commits` is enabled for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 0ea0c3b9b..e8f7f05a2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -6,8 +6,8 @@ title: Require Password for Approvals in GitLab Project **Type:** Rule **ID:** `gitlab-project-require-password-to-approve` **Uses:** `gitlab/project/require-password-to-approve@v2/rules` -**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/require-password-to-approve.yaml) -**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/require-password-to-approve.rego) +**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml) +**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego) **Labels:** Gitlab, Project Verify the binary field `require_password_to_approve` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 70a955069..3cfa4bcce 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -6,8 +6,8 @@ title: Require Minimal Approvers in GitLab Project **Type:** Rule **ID:** `gitlab-project-required-minimal-approvers` **Uses:** `gitlab/project/required-minimal-approvers@v2/rules` -**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/required-minimal-approvers.yaml) -**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/required-minimal-approvers.rego) +**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml) +**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego) **Labels:** Gitlab, Project Verify the required number of approvers for the GitLab project is met. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 23d7277df..d58e839a9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -6,8 +6,8 @@ title: Reset Approvals on Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-reset-pprovals-on-push` **Uses:** `gitlab/project/reset-pprovals-on-push@v2/rules` -**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) -**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/reset-pprovals-on-push.rego) +**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) +**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego) **Labels:** Gitlab, Project Verify `reset_approvals_on_push` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 4586990e9..f1f9deebe 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -6,8 +6,8 @@ title: Ensure SAST Scanning Passes **Type:** Rule **ID:** `gitlab-project-sast-scan-pass` **Uses:** `gitlab/project/sast-scan-pass@v2/rules` -**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scan-pass.yaml) -**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scan-pass.rego) +**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml) +**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego) **Labels:** Gitlab, Project Verify SAST scanning is successful for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index e3c5eb98d..9f5710fd2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -6,8 +6,8 @@ title: Run SAST Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-sast-scanning` **Uses:** `gitlab/project/sast-scanning@v2/rules` -**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scanning.yaml) -**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/sast-scanning.rego) +**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml) +**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego) **Labels:** Gitlab, Project Verify SAST scanning is performed for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index d20639659..1fd68f141 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -6,8 +6,8 @@ title: Ensure Secrets Scanning Passes **Type:** Rule **ID:** `gitlab-project-secrets-scan-pass` **Uses:** `gitlab/project/secrets-scan-pass@v2/rules` -**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scan-pass.yaml) -**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scan-pass.rego) +**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml) +**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego) **Labels:** Gitlab, Project Verify secrets scanning is successful for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 3d38e1aba..706d9623d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -6,8 +6,8 @@ title: Run Secrets Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-secrets-scanning` **Uses:** `gitlab/project/secrets-scanning@v2/rules` -**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scanning.yaml) -**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/secrets-scanning.rego) +**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml) +**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego) **Labels:** Gitlab, Project Verify secrets scanning is performed for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 8d1fd60a6..75e832c28 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -6,8 +6,8 @@ title: Restrict Selective Code Owner Removals in GitLab **Type:** Rule **ID:** `gitlab-project-selective-code-owner-removals` **Uses:** `gitlab/project/selective-code-owner-removals@v2/rules` -**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/selective-code-owner-removals.yaml) -**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/selective-code-owner-removals.rego) +**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml) +**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego) **Labels:** Gitlab, Project Verify `selective_code_owner_removals` is set for the GitLab project. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 66950b0ac..4ad39d9df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -6,8 +6,8 @@ title: Set Visibility Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-project-visibility-level` **Uses:** `gitlab/project/visibility-check@v2/rules` -**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/visibility-check.yaml) -**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/v2/rules/gitlab/project/visibility-check.rego) +**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml) +**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego) **Labels:** Gitlab, Project Verify the GitLab project's visibility matches the required level. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 91a053f10..cce66555f 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -6,8 +6,8 @@ title: Allowed Base Image **Type:** Rule **ID:** `images-allowed-base-image` **Uses:** `images/allowed-base-image@v2/rules` -**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-base-image.yaml) -**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-base-image.rego) +**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml) +**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) **Labels:** SBOM, Images Verifies that every base image is from an approved source. The rule returns a summary diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index f616a520b..43acbd96d 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -6,8 +6,8 @@ title: Allowed Main Image Source **Type:** Rule **ID:** `images-allowed-image-source` **Uses:** `images/allowed-image-source@v2/rules` -**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-image-source.yaml) -**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/allowed-image-source.rego) +**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml) +**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego) **Labels:** SBOM, Images Ensures the main container image referenced in the SBOM is from an approved source. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 397e817a8..ef78aece7 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -6,8 +6,8 @@ title: Banned Ports **Type:** Rule **ID:** `images-banned-ports` **Uses:** `images/banned-ports@v2/rules` -**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-ports.yaml) -**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-ports.rego) +**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml) +**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) **Labels:** SBOM, Images Ensures that the container image does not expose ports that are disallowed by organizational policy. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 6ba8a73be..ff2f59d37 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -6,8 +6,8 @@ title: Disallow Specific Users in SBOM **Type:** Rule **ID:** `sbom-disallowed-users` **Uses:** `images/banned-users@v2/rules` -**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-users.yaml) -**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/banned-users.rego) +**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml) +**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego) **Labels:** SBOM, Image Verify specific users are not allowed in an SBOM. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index c291c323f..f61488eaf 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -6,8 +6,8 @@ title: Restrict Build Scripts **Type:** Rule **ID:** `images-disallowed-build-script` **Uses:** `images/blocklist-build-scripts@v2/rules` -**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-build-scripts.yaml) -**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-build-scripts.rego) +**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml) +**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego) **Labels:** SBOM, Images Verify no build scripts commands appear in block list. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index afeaf17f7..27cf02372 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -6,8 +6,8 @@ title: 4.2.1 Registry Connection HTTPS **Type:** Rule **ID:** `images-registry-https-check` **Uses:** `images/enforce-https-registry@v2/rules` -**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/enforce-https-registry.yaml) -**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/enforce-https-registry.rego) +**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml) +**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego) **Labels:** Registry, Images Checks if the container's registry scheme is HTTPS diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index da40a0d3b..532b5de63 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -6,8 +6,8 @@ title: Forbid Large Images **Type:** Rule **ID:** `images-project-large-image` **Uses:** `images/forbid-large-images@v2/rules` -**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/forbid-large-images.yaml) -**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/forbid-large-images.rego) +**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml) +**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego) **Labels:** SBOM, Images Verify the image size is below the specified threshold. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index de37a6e09..7dfa83e0a 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -6,8 +6,8 @@ title: Fresh Base Image **Type:** Rule **ID:** `images-fresh-base-image` **Uses:** `images/fresh-base-image@v2/rules` -**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-base-image.yaml) -**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-base-image.rego) +**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml) +**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego) **Labels:** SBOM, Images Verifies that each base image is not older than the specified threshold (max_days) from its creation date. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 061a8c0ec..011e9a83c 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -6,8 +6,8 @@ title: Fresh Image **Type:** Rule **ID:** `fresh-image` **Uses:** `images/fresh-image@v2/rules` -**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-image.yaml) -**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/fresh-image.rego) +**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml) +**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego) **Labels:** SBOM, Images Verify the image is not older than the specified threshold. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index e8bac88db..8a633208e 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -6,8 +6,8 @@ title: Require Signed Container Image **Type:** Rule **ID:** `images-require-signed-image` **Uses:** `images/image-signed@v2/rules` -**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/image-signed.yaml) -**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/image-signed.rego) +**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml) +**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego) **Labels:** Images, Blueprint Enforces that container images (target_type=container) are cryptographically signed. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 7f8a678e0..5e4418f93 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -6,8 +6,8 @@ title: Require Healthcheck **Type:** Rule **ID:** `images-require-healthcheck` **Uses:** `images/require-healthcheck@v2/rules` -**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/require-healthcheck.yaml) -**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/require-healthcheck.rego) +**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml) +**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego) **Labels:** SBOM, Images Checks that the container image includes at least one healthcheck property. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index a031eff95..b6752fa61 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -6,8 +6,8 @@ title: Disallow Container Shell Entrypoint **Type:** Rule **ID:** `images-disallow-shell-access` **Uses:** `images/restrict-shell-entrypoint@v2/rules` -**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/restrict-shell-entrypoint.yaml) -**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/restrict-shell-entrypoint.rego) +**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml) +**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego) **Labels:** SBOM, Images Verify the container image disallows shell entrypoint. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index df665a89f..6273ff3bf 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -6,8 +6,8 @@ title: Require Image Labels **Type:** Rule **ID:** `required-image-labels` **Uses:** `images/verify-labels-exist@v2/rules` -**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels-exist.yaml) -**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels-exist.rego) +**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego) **Labels:** SBOM, Images Verify the image has the specified labels. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index c545ad0fc..5c665edbb 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -6,8 +6,8 @@ title: Verify Image Labels **Type:** Rule **ID:** `image-labels` **Uses:** `images/verify-labels@v2/rules` -**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels.yaml) -**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/verify-labels.rego) +**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego) **Labels:** SBOM, Images Verify specified labels key-value pairs exist in the image. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index fa522891e..6520c5f75 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -6,8 +6,8 @@ title: Verify Exposed Credentials **Type:** Rule **ID:** `jenkins-exposed-credentials` **Uses:** `jenkins/folder/exposed-credentials@v2/rules` -**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/folder/exposed-credentials.yaml) -**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/folder/exposed-credentials.rego) +**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego) **Labels:** Jenkins, Folder Verify there are no exposed credentials. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index f1571eea0..88b9c6061 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -6,8 +6,8 @@ title: Verify Inactive Users **Type:** Rule **ID:** `jenkins-inactive-users` **Uses:** `jenkins/instance/inactive-users@v2/rules` -**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/inactive-users.yaml) -**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/inactive-users.rego) +**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml) +**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego) **Labels:** Jenkins, Instance Verify there are no inactive users. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 16274249e..a3780db29 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -6,8 +6,8 @@ title: Disallow Unused Users **Type:** Rule **ID:** `jenkins-unused-users` **Uses:** `jenkins/instance/unused-users@v2/rules` -**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/unused-users.yaml) -**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/v2/rules/jenkins/instance/unused-users.rego) +**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml) +**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego) **Labels:** Jenkins, Instance Verify there are no users with zero activity. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 7baca8aa5..28d2c9f5e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -6,8 +6,8 @@ title: Allowed Container Images **Type:** Rule **ID:** `k8s-namespace-blocked-images` **Uses:** `k8s/namespace/allowed-images@v2/rules` -**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-images.yaml) -**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/blocked-images.rego) +**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml) +**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego) **Labels:** K8s, Namespace Verify only container images specified in the Allowed List run within the Kubernetes namespace. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 1513003b0..9b89a7197 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -6,8 +6,8 @@ title: Allowed Namespace Registries **Type:** Rule **ID:** `k8s-namespace-allowed-registries` **Uses:** `k8s/namespace/allowed-registries@v2/rules` -**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-registries.yaml) -**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/allowed-registries.rego) +**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml) +**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego) **Labels:** K8s, Namespace Verify container images in Kubernetes namespaces originate from registries in the Allowed List. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index a0a351fdb..c3871a88f 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -6,8 +6,8 @@ title: Verify Namespace Runtime Duration **Type:** Rule **ID:** `k8s-namespace-verify-namespace-duration` **Uses:** `k8s/namespace/verify-namespace-duration@v2/rules` -**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-duration.yaml) -**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-duration.rego) +**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml) +**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego) **Labels:** K8s, Namespace Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index ab2fd2aa8..df2d3be60 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -6,8 +6,8 @@ title: Verify Namespace Termination **Type:** Rule **ID:** `k8s-namespace-verify-namespace-termination` **Uses:** `k8s/namespace/verify-namespace-termination@v2/rules` -**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-termination.yaml) -**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/verify-namespace-termination.rego) +**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml) +**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego) **Labels:** K8s, Namespace Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 9f0a56135..7aa6a3822 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -6,8 +6,8 @@ title: Allowed Namespaces **Type:** Rule **ID:** `k8s-namespace-white-listed-namespaces` **Uses:** `k8s/namespace/white-listed-namespaces@v2/rules` -**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-namespaces.yaml) -**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-namespaces.rego) +**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml) +**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego) **Labels:** K8s, Namespace Verify only namespaces specified in the Allowed List are allowed within the cluster. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index af0376911..db01ceb94 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -6,8 +6,8 @@ title: Allowed Pods in Namespace **Type:** Rule **ID:** `k8s-namespace-white-listed-pod` **Uses:** `k8s/namespace/white-listed-pod@v2/rules` -**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-pod.yaml) -**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/namespace/white-listed-pod.rego) +**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego) **Labels:** K8s, Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 590d5f2a6..ddbc7bcd1 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -6,8 +6,8 @@ title: Verify Pod Runtime Duration **Type:** Rule **ID:** `k8s-pods-verify-pod-duration` **Uses:** `k8s/pods/verify-pod-duration@v2/rules` -**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-duration.yaml) -**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-duration.rego) +**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml) +**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego) **Labels:** K8s, Pod Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index a4afffc97..8a884c359 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -6,8 +6,8 @@ title: Verify Pod Termination **Type:** Rule **ID:** `k8s-pods-verify-pod-termination` **Uses:** `k8s/pods/verify-pod-termination@v2/rules` -**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-termination.yaml) -**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/verify-pod-termination.rego) +**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml) +**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego) **Labels:** K8s, Pod Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index a35f1e033..83564dd83 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -6,8 +6,8 @@ title: Allowed Pods **Type:** Rule **ID:** `k8s-pods-white-listed-pod` **Uses:** `k8s/pods/white-listed-pod@v2/rules` -**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/white-listed-pod.yaml) -**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/v2/rules/k8s/pods/white-listed-pod.rego) +**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego) **Labels:** K8s, Pod Verify only pods explicitly listed in the Allowed List are allowed to run. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 52368b937..b6b5fc709 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -6,8 +6,8 @@ title: Verify File Integrity **Type:** Rule **ID:** `file-integrity` **Uses:** `multievidence/files_integrity@v2/rules` -**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/v2/rules/multievidence/files_integrity.yaml) -**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/v2/rules/multievidence/files_integrity.rego) +**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) +**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) **Labels:** SBOM Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index e31f40583..f7e5c044c 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -6,8 +6,8 @@ title: Verify Artifact Signature Using SARIF Report **Type:** Rule **ID:** `sarif-artifact-signed` **Uses:** `sarif/artifact-signed@v2/rules` -**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/artifact-signed.rego) +**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego) **Labels:** SARIF Verify the artifact referenced in the SARIF report is signed to confirm its integrity. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 69ea2dfa1..d5cfe94e7 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -6,8 +6,8 @@ title: Verify Required Evidence in SARIF **Type:** Rule **ID:** `required-sarif-evidence` **Uses:** `sarif/evidence-exists@v2/rules` -**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/evidence-exists.rego) +**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego) **Labels:** SARIF Verify all required evidence exists as defined by the SARIF policy. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 1c8b4c3a8..30dce095d 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -6,8 +6,8 @@ title: SARIF Update Needed **Type:** Rule **ID:** `sarif-update-needed` **Uses:** `sarif/patcheck/updates-needed@v2/rules` -**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/patcheck/updates-needed.yaml) -**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/patcheck/updates-needed.rego) +**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml) +**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego) **Labels:** SARIF Verify no security packages require updates. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index f5c37b197..dd74a5399 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -6,8 +6,8 @@ title: Verify IaC Misconfiguration Threshold in SARIF **Type:** Rule **ID:** `sarif-iac-findings` **Uses:** `sarif/report-iac-errors@v2/rules` -**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/report-iac-errors.yaml) -**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/report-iac-errors.rego) +**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml) +**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego) **Labels:** SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 780d53ad9..a26efb2d9 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -6,8 +6,8 @@ title: Trivy Blocklist CVE Check **Type:** Rule **ID:** `trivy-blocklist-cve` **Uses:** `sarif/trivy/blocklist-cve@v2/rules` -**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/blocklist-cve.yaml) -**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../blocklist-report.rego) +**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml) +**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 9a3c73495..633054d4b 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -6,8 +6,8 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-iac-findings` **Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` -**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) -**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../report-iac-errors.rego) +**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) +**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 0e13a7660..23518a777 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -6,8 +6,8 @@ title: Trivy Vulnerability Findings Check **Type:** Rule **ID:** `trivy-verify-vulnerability-findings` **Uses:** `sarif/trivy/verify-cve-severity@v2/rules` -**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-cve-severity.yaml) -**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-cve-severity.rego) +**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml) +**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 46321799d..d962690a2 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -6,8 +6,8 @@ title: Verify Attack Vector Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-attack-vectors` **Uses:** `sarif/trivy/verify-trivy-attack-vector@v2/rules` -**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) -**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../verify-attack-vector.rego) +**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) +**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego) **Labels:** SARIF, Trivy Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 36abb5bc1..6826e8689 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -6,8 +6,8 @@ title: Verify Trivy SARIF Report Compliance **Type:** Rule **ID:** `trivy-report` **Uses:** `sarif/trivy/verify-trivy-report@v2/rules` -**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/verify-trivy-report.yaml) -**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/trivy/../verify-sarif.rego) +**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml) +**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example **Labels:** SARIF, Trivy diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 21e308258..92fdaf29d 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -6,8 +6,8 @@ title: Verify Attack Vector Exists in SARIF **Type:** Rule **ID:** `sarif-attack-vectors` **Uses:** `sarif/verify-attack-vector@v2/rules` -**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-attack-vector.yaml) -**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-attack-vector.rego) +**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml) +**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego) **Labels:** SARIF Verify required evidence validates attack vectors in the SARIF report. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 505a199f0..4c3823468 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -6,8 +6,8 @@ title: Verify Rule Compliance in SARIF **Type:** Rule **ID:** `sarif-policy` **Uses:** `sarif/verify-sarif@v2/rules` -**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-sarif.yaml) -**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-sarif.rego) +**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml) +**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) **Labels:** SARIF Verify the SARIF report complies with defined generic rules for compliance and security. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index c8e8cfb8a..0485561fe 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -6,8 +6,8 @@ title: Verify Semgrep Rule in SARIF **Type:** Rule **ID:** `sarif-semgrep-report` **Uses:** `sarif/verify-semgrep-report@v2/rules` -**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-semgrep-report.yaml) -**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/blocklist-report.rego) +**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) +**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) **Labels:** SARIF, Semgrep Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 1d638ddf9..4268db939 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -6,8 +6,8 @@ title: Verify Tool Evidence in SARIF **Type:** Rule **ID:** `sarif-tool-evidence` **Uses:** `sarif/verify-tool-evidence@v2/rules` -**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-tool-evidence.yaml) -**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/v2/rules/sarif/verify-tool-evidence.rego) +**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml) +**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego) **Labels:** SARIF Verify required tools were used to generate the SARIF report. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index d06fba037..2a99bf842 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -6,8 +6,8 @@ title: NTIA SBOM Compliance Check **Type:** Rule **ID:** `NTIA-compliance` **Uses:** `sbom/NTIA-compliance@v2/rules` -**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/NTIA-compliance.yaml) -**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/NTIA-compliance.rego) +**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) +**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) **Labels:** SBOM, Compliance Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 8ce6359c1..f7f98bf35 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -6,8 +6,8 @@ title: Enforce Allowed SBOM Components **Type:** Rule **ID:** `sbom-allowed-components` **Uses:** `sbom/allowed-components@v2/rules` -**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/allowed-components.yaml) -**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/allowed-components.rego) +**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) +**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) **Labels:** SBOM, Image Verify the artifact contains only allowed components. diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 956b77178..f5611502d 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -6,8 +6,8 @@ title: Require SBOM Signature **Type:** Rule **ID:** `sbom-signed` **Uses:** `sbom/artifact-signed@v2/rules` -**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/artifact-signed.rego) +**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) **Labels:** SBOM, Blueprint Verify the SBOM is signed. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 8ee2d8a44..15aca0e6c 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -6,8 +6,8 @@ title: Restrict Disallowed SBOM Licenses **Type:** Rule **ID:** `sbom-disallowed-licenses` **Uses:** `sbom/banned-licenses@v2/rules` -**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-licenses.yaml) -**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/banned-licenses.rego) +**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) +**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) **Labels:** SBOM, Image Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index abb69f720..d4bfe789c 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -6,8 +6,8 @@ title: Restrict Disallowed Dependencies **Type:** Rule **ID:** `sbom-disallow-dependencies` **Uses:** `sbom/blocklist-packages@v2/rules` -**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/blocklist-packages.yaml) -**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/blocklist-packages.rego) +**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) +**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) **Labels:** SBOM, Image, Blueprint Verify the number of disallowed dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 5c0eb808a..881b92b4f 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -6,8 +6,8 @@ title: Enforce SBOM License Completeness **Type:** Rule **ID:** `sbom-require-complete-license-set` **Uses:** `sbom/complete-licenses@v2/rules` -**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/complete-licenses.yaml) -**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/complete-licenses.rego) +**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) +**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) **Labels:** SBOM, Image Verify all dependencies in the artifact have a license. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index d4706fb46..f94eface0 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -6,8 +6,8 @@ title: Enforce SBOM Freshness **Type:** Rule **ID:** `fresh-sbom` **Uses:** `sbom/fresh-sbom@v2/rules` -**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/fresh-sbom.yaml) -**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/fresh-sbom.rego) +**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) +**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) **Labels:** SBOM Verify the SBOM is not older than the specified duration. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 2d85ed86e..3913cfccc 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -6,8 +6,8 @@ title: Require SBOM Existence **Type:** Rule **ID:** `require-sbom` **Uses:** `sbom/require-sbom@v2/rules` -**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/require-sbom.yaml) -**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/require-sbom.rego) +**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) +**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) **Labels:** SBOM, Blueprint Verify the SBOM exists as evidence. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index c2e35582c..71a26911e 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -6,8 +6,8 @@ title: Enforce SBOM Dependencies **Type:** Rule **ID:** `sbom-required-dependencies` **Uses:** `sbom/required-packages@v2/rules` -**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/required-packages.yaml) -**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/required-packages.rego) +**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml) +**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) **Labels:** SBOM, Image Verify the artifact includes all required dependencies. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 950ccd48b..5b19a02a0 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -6,8 +6,8 @@ title: Require Specified SBOM Licenses **Type:** Rule **ID:** `sbom-hf-license` **Uses:** `sbom/verify-huggingface-license@v2/rules` -**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/v2/rules/sbom/verify-huggingface-license.yaml) -**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/v2/rules/sbom/verify-hf-license.rego) +**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) +**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) **Labels:** SBOM, Image Verify the artifact includes all specified licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 053a02b02..14cd5ea5b 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -6,8 +6,8 @@ title: Disallow dependencies in SLSA Provenance Document **Type:** Rule **ID:** `slsa-builder-unallowed-dependencies` **Uses:** `slsa/banned-builder-deps@v2/rules` -**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/banned-builder-deps.yaml) -**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/banned-builder-deps.rego) +**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml) +**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego) **Labels:** SLSA, Image Verify that dependencies in the block list do not appear in the SLSA Proveance document. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index c8e357d88..eea522396 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -6,8 +6,8 @@ title: Verify build time **Type:** Rule **ID:** `slsa-build-time` **Uses:** `slsa/build-time@v2/rules` -**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/build-time.yaml) -**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/build-time.rego) +**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml) +**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego) **Labels:** SLSA, Image Verify the artifact was created within the specified time window. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 333ee1a31..7541161b7 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -6,8 +6,8 @@ title: SLSA Field Exists in Provenance Document **Type:** Rule **ID:** `slsa-field-exists` **Uses:** `slsa/field-exists@v2/rules` -**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/field-exists.yaml) -**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/field-exists.rego) +**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml) +**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego) **Labels:** SLSA, Image Verify the specified field exists in the provenance document. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 42ef3a000..1072059a6 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -6,8 +6,8 @@ title: Verify Provenance Document Exists **Type:** Rule **ID:** `SLSA.L1` **Uses:** `slsa/l1-provenance-exists@v2/rules` -**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l1-provenance-exists.yaml) -**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l1-provenance-exists.rego) +**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml) +**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego) **Help:** https://slsa.dev/spec/v1.0/requirements **Labels:** SLSA diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index e551c8002..1eb3fb757 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -6,8 +6,8 @@ title: Verify that provenance is authenticated **Type:** Rule **ID:** `SLSA.L2` **Uses:** `slsa/l2-provenance-authenticated@v2/rules` -**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l2-provenance-authenticated.yaml) -**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/l2-provenance-authenticated.rego) +**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml) +**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego) **Help:** https://slsa.dev/spec/v1.0/requirements **Labels:** SLSA diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index cb5eb157c..950a6256d 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -6,8 +6,8 @@ title: Verify that artifact was created by the specified builder **Type:** Rule **ID:** `slsa-verify-builder` **Uses:** `slsa/verify-builder@v2/rules` -**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-builder.yaml) -**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-builder.rego) +**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml) +**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego) **Labels:** SLSA, Image Verify the artifact was created by the specified builder. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 509243165..cd4edb511 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -6,8 +6,8 @@ title: Verify that artifact has no disallowed builder dependencies **Type:** Rule **ID:** `slsa-verify-byproducts` **Uses:** `slsa/verify-byproducts@v2/rules` -**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-byproducts.yaml) -**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/v2/rules/slsa/verify-byproducts.rego) +**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml) +**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego) **Labels:** SLSA, Image Verify the artifact has no disallowed builder dependencies. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index e90ec24ac..fdc2a3496 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -6,7 +6,7 @@ title: Enforce 2FA **Type:** Rule **ID:** `PS.1.1` **Uses:** `ssdf/ps-1-2fa@v2/rules` -**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-2fa.yaml) +**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) **Labels:** SSDF PS.1 Require 2FA for accessing code diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 86f667925..4891a81b4 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -6,7 +6,7 @@ title: Branch protected **Type:** Rule **ID:** `PS.1.2` **Uses:** `ssdf/ps-1-branch-protection@v2/rules` -**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-branch-protection.yaml) +**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) **Labels:** SSDF PS.1 Require branch protection for the repository diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 91eb43325..422e2a081 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -6,7 +6,7 @@ title: Limit admins **Type:** Rule **ID:** `PS.1.3` **Uses:** `ssdf/ps-1-limit-admins@v2/rules` -**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-limit-admins.yaml) +**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) **Labels:** SSDF PS.1 Restrict the maximum number of organization admins diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index c39a2ef98..80c4616a2 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -6,7 +6,7 @@ title: Repo private **Type:** Rule **ID:** `PS.1.4` **Uses:** `ssdf/ps-1-repo-private@v2/rules` -**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-repo-private.yaml) +**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) **Labels:** SSDF PS.1 Assure the repository is private diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 4f8a82fcd..ef1fda082 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -6,7 +6,7 @@ title: Require signoff on web commits **Type:** Rule **ID:** `PS.1.5` **Uses:** `ssdf/ps-1-web-commit-signoff@v2/rules` -**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) +**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) **Labels:** SSDF PS.1 Require contributors to sign when committing to Github through the web interface diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 6d3a48126..2d72b8b70 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -6,7 +6,7 @@ title: Image-verifiable **Type:** Rule **ID:** `PS.2` **Uses:** `ssdf/ps-2-image-verifiable@v2/rules` -**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-2-image-verifiable.yaml) +**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) **Labels:** SSDF PS.2 Provide a mechanism to verify the integrity of the image diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 72e5dc571..64f993885 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -6,7 +6,7 @@ title: Code archived **Type:** Rule **ID:** `PS.3.1` **Uses:** `ssdf/ps-3.1-code-archived@v2/rules` -**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-3.1-code-archived.yaml) +**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) **Labels:** SSDF PS.3.1 Verify that the software release data is archived. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 46074fc10..aaef83158 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -6,7 +6,7 @@ title: SBOM archived **Type:** Rule **ID:** `PS.3.2` **Uses:** `ssdf/ps-3.2-archived-sbom@v2/rules` -**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) +**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) **Labels:** SSDF PS.3.2 Archive SBOM diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 160946b93..36d801043 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -7,7 +7,7 @@ title: SLSA L1 Framework **ID:** `SLSA.L1` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l1.yaml) +**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml) **Help:** https://slsa.dev/ Evaluate SLSA Level 1 diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 83e79790f..927f60fd5 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -7,7 +7,7 @@ title: SLSA L2 Framework **ID:** `SLSA.L2` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/slsa.l2.yaml) +**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml) **Help:** https://slsa.dev/ Evaluate SLSA Level 2 diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index ec94a0467..cf99c6064 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -7,7 +7,7 @@ title: NIST Application Container Security Initiative **ID:** `SP-800-190` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-190.yaml) +**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-190.yaml) **Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 38bf749a0..8e4fb3962 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -7,7 +7,7 @@ title: NIST Supply Chain Integrity Initiative **ID:** `SP-800-53` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/sp-800-53.yaml) +**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-53.yaml) **Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index c1e991443..be5c34990 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -7,7 +7,7 @@ title: SSDF Client Initiative **ID:** `SSDF` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/v2/initiatives/ssdf.yaml) +**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/ssdf.yaml) **Help:** https://csrc.nist.gov/pubs/sp/800/218/final Evaluate PS rules from the SSDF initiative From 6220690cb90660dcad853273954becc9d3256e7f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 16:54:37 +0200 Subject: [PATCH 094/191] tmp gen docsush --- .../initiatives/rules/api/scribe-api-cve-product.md | 3 --- docs/configuration/initiatives/rules/api/scribe-api-cve.md | 3 --- .../initiatives/rules/api/scribe-api-published.md | 3 --- docs/configuration/initiatives/rules/api/scribe-api.md | 3 --- .../initiatives/rules/bitbucket/project/allow-admins.md | 3 --- .../initiatives/rules/bitbucket/project/allow-users.md | 3 --- .../initiatives/rules/bitbucket/project/exposed-credentials.md | 3 --- .../initiatives/rules/bitbucket/project/long-live-tokens.md | 3 --- .../initiatives/rules/bitbucket/repository/allow-admins.md | 3 --- .../initiatives/rules/bitbucket/repository/allow-users.md | 3 --- .../rules/bitbucket/repository/branch-protection.md | 3 --- .../initiatives/rules/bitbucket/workspace/allow-admins.md | 3 --- .../initiatives/rules/bitbucket/workspace/allow-users.md | 3 --- .../initiatives/rules/dockerhub/token-expiration.md | 3 --- .../initiatives/rules/dockerhub/token-not-used.md | 3 --- docs/configuration/initiatives/rules/generic/k8s-jailbreak.md | 3 --- docs/configuration/initiatives/rules/generic/trivy-exists.md | 3 --- docs/configuration/initiatives/rules/git/coding-permissions.md | 3 --- docs/configuration/initiatives/rules/git/no-commit-to-main.md | 3 --- .../configuration/initiatives/rules/git/no-unsigned-commits.md | 3 --- .../initiatives/rules/github/api/branch-protection.md | 3 --- .../initiatives/rules/github/api/signed-commits-list.md | 3 --- .../initiatives/rules/github/api/signed-commits-range.md | 3 --- docs/configuration/initiatives/rules/github/org/2fa.md | 3 --- .../initiatives/rules/github/org/advanced-security.md | 3 --- .../configuration/initiatives/rules/github/org/allow-admins.md | 3 --- docs/configuration/initiatives/rules/github/org/allow-users.md | 3 --- .../initiatives/rules/github/org/create-private-repos.md | 3 --- .../configuration/initiatives/rules/github/org/create-repos.md | 3 --- .../initiatives/rules/github/org/dependabot-alerts.md | 3 --- .../rules/github/org/dependabot-security-updates-sa.md | 3 --- .../rules/github/org/dependabot-security-updates.md | 3 --- .../initiatives/rules/github/org/dependency-graph.md | 3 --- docs/configuration/initiatives/rules/github/org/max-admins.md | 3 --- docs/configuration/initiatives/rules/github/org/old-secrets.md | 3 --- .../initiatives/rules/github/org/pp-custom-link.md | 3 --- .../initiatives/rules/github/org/push-protection-sa.md | 3 --- .../initiatives/rules/github/org/push-protection.md | 3 --- .../initiatives/rules/github/org/repo-visibility.md | 3 --- .../initiatives/rules/github/org/secret-scanning-sa.md | 3 --- .../initiatives/rules/github/org/secret-scanning.md | 3 --- .../initiatives/rules/github/org/validity-checks-sa.md | 3 --- .../initiatives/rules/github/org/validity-checks.md | 3 --- .../initiatives/rules/github/org/web-commit-signoff.md | 3 --- .../initiatives/rules/github/repository/branch-protection.md | 3 --- .../initiatives/rules/github/repository/branch-verification.md | 3 --- .../rules/github/repository/check-signed-commits.md | 3 --- .../rules/github/repository/default-branch-protection.md | 3 --- .../initiatives/rules/github/repository/dependabot.md | 3 --- .../rules/github/repository/ephemeral-runners-only.md | 3 --- .../initiatives/rules/github/repository/no-cache-usage.md | 3 --- .../initiatives/rules/github/repository/no-org-secrets.md | 3 --- .../initiatives/rules/github/repository/old-secrets.md | 3 --- .../initiatives/rules/github/repository/push-protection.md | 3 --- .../initiatives/rules/github/repository/repo-private.md | 3 --- .../initiatives/rules/github/repository/secret-scanning.md | 3 --- .../initiatives/rules/github/repository/signed-commits.md | 3 --- .../initiatives/rules/github/repository/validity-checks.md | 3 --- .../initiatives/rules/github/repository/visibility.md | 3 --- .../initiatives/rules/github/repository/web-commit-signoff.md | 3 --- docs/configuration/initiatives/rules/gitlab/api/push-rules.md | 3 --- .../initiatives/rules/gitlab/api/signed-commits-list.md | 3 --- .../initiatives/rules/gitlab/api/signed-commits-range.md | 3 --- .../configuration/initiatives/rules/gitlab/org/allow-admins.md | 3 --- .../initiatives/rules/gitlab/org/allow-token-scopes.md | 3 --- docs/configuration/initiatives/rules/gitlab/org/allow-users.md | 3 --- .../initiatives/rules/gitlab/org/blocked-users.md | 3 --- .../initiatives/rules/gitlab/org/expiring-tokens.md | 3 --- .../initiatives/rules/gitlab/org/forbid-token-scopes.md | 3 --- .../initiatives/rules/gitlab/org/inactive-projects.md | 3 --- .../initiatives/rules/gitlab/org/longlive-tokens.md | 3 --- docs/configuration/initiatives/rules/gitlab/org/max-admins.md | 3 --- .../initiatives/rules/gitlab/org/projects-visibility.md | 3 --- .../initiatives/rules/gitlab/org/unused-tokens.md | 3 --- .../initiatives/rules/gitlab/pipeline/verify-labels-exist.md | 3 --- .../initiatives/rules/gitlab/pipeline/verify-labels.md | 3 --- .../initiatives/rules/gitlab/project/abandoned-project.md | 3 --- .../initiatives/rules/gitlab/project/approvals-policy-check.md | 3 --- .../rules/gitlab/project/approvers-per-merge-request.md | 3 --- .../initiatives/rules/gitlab/project/author-email-regex.md | 3 --- .../initiatives/rules/gitlab/project/check-cwe.md | 3 --- .../initiatives/rules/gitlab/project/check-signed-commits.md | 3 --- .../initiatives/rules/gitlab/project/co-approval-required.md | 3 --- .../rules/gitlab/project/commit-author-email-check.md | 3 --- .../rules/gitlab/project/commit-author-name-check.md | 3 --- .../initiatives/rules/gitlab/project/commit-committer-check.md | 3 --- .../initiatives/rules/gitlab/project/commit-message-check.md | 3 --- .../initiatives/rules/gitlab/project/commits-validated.md | 3 --- .../initiatives/rules/gitlab/project/committer-email-check.md | 3 --- .../initiatives/rules/gitlab/project/committer-name-check.md | 3 --- .../rules/gitlab/project/critical-severity-limit.md | 3 --- .../rules/gitlab/project/description-substring-check.md | 3 --- .../rules/gitlab/project/disallowed-banned-approvers.md | 3 --- .../initiatives/rules/gitlab/project/force-push-protection.md | 3 --- .../initiatives/rules/gitlab/project/medium-severity-limit.md | 3 --- .../initiatives/rules/gitlab/project/member-check.md | 3 --- .../initiatives/rules/gitlab/project/merge-access-level.md | 3 --- .../rules/gitlab/project/merge-requests-author-approval.md | 3 --- .../project/merge-requests-disable-committers-approval.md | 3 --- .../rules/gitlab/project/message-substring-check.md | 3 --- .../initiatives/rules/gitlab/project/prevent-secrets-check.md | 3 --- .../initiatives/rules/gitlab/project/protect-ci-secrets.md | 3 --- .../initiatives/rules/gitlab/project/push-access-level.md | 3 --- .../initiatives/rules/gitlab/project/push-rules-set.md | 3 --- .../rules/gitlab/project/reject-unsigned-commits.md | 3 --- .../rules/gitlab/project/require-password-to-approve.md | 3 --- .../rules/gitlab/project/required-minimal-approvers.md | 3 --- .../initiatives/rules/gitlab/project/reset-pprovals-on-push.md | 3 --- .../initiatives/rules/gitlab/project/sast-scan-pass.md | 3 --- .../initiatives/rules/gitlab/project/sast-scanning.md | 3 --- .../initiatives/rules/gitlab/project/secrets-scan-pass.md | 3 --- .../initiatives/rules/gitlab/project/secrets-scanning.md | 3 --- .../rules/gitlab/project/selective-code-owner-removals.md | 3 --- .../initiatives/rules/gitlab/project/visibility-check.md | 3 --- .../initiatives/rules/images/allowed-base-image.md | 3 --- .../initiatives/rules/images/allowed-image-source.md | 3 --- docs/configuration/initiatives/rules/images/banned-ports.md | 3 --- docs/configuration/initiatives/rules/images/banned-users.md | 3 --- .../initiatives/rules/images/blocklist-build-scripts.md | 3 --- .../initiatives/rules/images/enforce-https-registry.md | 3 --- .../initiatives/rules/images/forbid-large-images.md | 3 --- .../configuration/initiatives/rules/images/fresh-base-image.md | 3 --- docs/configuration/initiatives/rules/images/fresh-image.md | 3 --- docs/configuration/initiatives/rules/images/image-signed.md | 3 --- .../initiatives/rules/images/require-healthcheck.md | 3 --- .../initiatives/rules/images/restrict-shell-entrypoint.md | 3 --- .../initiatives/rules/images/verify-labels-exist.md | 3 --- docs/configuration/initiatives/rules/images/verify-labels.md | 3 --- .../initiatives/rules/jenkins/folder/exposed-credentials.md | 3 --- .../initiatives/rules/jenkins/instance/inactive-users.md | 3 --- .../initiatives/rules/jenkins/instance/unused-users.md | 3 --- .../initiatives/rules/k8s/namespace/allowed-images.md | 3 --- .../initiatives/rules/k8s/namespace/allowed-registries.md | 3 --- .../rules/k8s/namespace/verify-namespace-duration.md | 3 --- .../rules/k8s/namespace/verify-namespace-termination.md | 3 --- .../initiatives/rules/k8s/namespace/white-listed-namespaces.md | 3 --- .../initiatives/rules/k8s/namespace/white-listed-pod.md | 3 --- .../initiatives/rules/k8s/pods/verify-pod-duration.md | 3 --- .../initiatives/rules/k8s/pods/verify-pod-termination.md | 3 --- .../initiatives/rules/k8s/pods/white-listed-pod.md | 3 --- .../initiatives/rules/multievidence/files_integrity.md | 3 --- .../initiatives/rules/sarif/patcheck/updates-needed.md | 3 --- .../configuration/initiatives/rules/sarif/report-iac-errors.md | 3 --- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 3 --- .../initiatives/rules/sarif/trivy/report-trivy-iac-errors.md | 3 --- .../rules/sarif/trivy/verify-trivy-attack-vector.md | 3 --- .../initiatives/rules/sarif/trivy/verify-trivy-report.md | 3 --- .../initiatives/rules/sarif/verify-attack-vector.md | 3 --- docs/configuration/initiatives/rules/sarif/verify-sarif.md | 3 --- .../initiatives/rules/sarif/verify-semgrep-report.md | 3 --- docs/configuration/initiatives/rules/sbom/NTIA-compliance.md | 3 --- .../configuration/initiatives/rules/sbom/allowed-components.md | 3 --- docs/configuration/initiatives/rules/sbom/banned-licenses.md | 3 --- .../configuration/initiatives/rules/sbom/blocklist-packages.md | 3 --- docs/configuration/initiatives/rules/sbom/complete-licenses.md | 3 --- docs/configuration/initiatives/rules/sbom/fresh-sbom.md | 3 --- docs/configuration/initiatives/rules/sbom/required-packages.md | 3 --- .../initiatives/rules/sbom/verify-huggingface-license.md | 3 --- .../initiatives/rules/slsa/banned-builder-deps.md | 3 --- docs/configuration/initiatives/rules/slsa/build-time.md | 3 --- docs/configuration/initiatives/rules/slsa/field-exists.md | 3 --- docs/configuration/initiatives/rules/slsa/verify-builder.md | 3 --- docs/configuration/initiatives/rules/slsa/verify-byproducts.md | 3 --- docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md | 3 --- .../initiatives/rules/ssdf/ps-1-branch-protection.md | 3 --- docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md | 3 --- docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md | 3 --- .../initiatives/rules/ssdf/ps-1-web-commit-signoff.md | 3 --- .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 3 --- .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 3 --- .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 3 --- 171 files changed, 513 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index ba2d5be0a..bc34d09d2 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -16,9 +16,6 @@ Verify via Scribe API that there no critical or high severity vulnerabilities in Evidence **IS NOT** required for this rule. ::: :::tip -Rule Result will be set as 'open' if evidence is missing. -::: -:::tip Rule requires the Scribe API to be enabled. ::: :::warning diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index f122d429a..f3ccc21c3 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -12,9 +12,6 @@ title: Verify No Critical or High Vulnerabilities Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Rule requires the Scribe API to be enabled. ::: diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index 615cc3ba6..3b7673ced 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -12,9 +12,6 @@ title: Scribe Published Policy Verify image Scribe Publish flag is set for container image. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Rule requires the Scribe API to be enabled. ::: diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index 42012a693..4808d0547 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -11,9 +11,6 @@ title: Apply Scribe Template Policy Verify XX using the Scribe API template rule. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Rule requires the Scribe API to be enabled. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index bd24f9763..41e120efe 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -11,9 +11,6 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 5f725d6f5..a2abd5848 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -11,9 +11,6 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 9d51faf2a..6a3f45bad 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -12,9 +12,6 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 5ecef8388..b11156945 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -12,9 +12,6 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 07fd69e58..be91a6762 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -12,9 +12,6 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index e155d3605..a09f09fd3 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -12,9 +12,6 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index aa55fa4ed..e36e4f9fb 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -12,9 +12,6 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index edeed5585..fe24bf014 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -12,9 +12,6 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 487bcfe6d..be6c9c163 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -12,9 +12,6 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 7ce6b43dc..dd24d466e 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -12,9 +12,6 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 74a443849..64be7001a 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -12,9 +12,6 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 41bbb70d3..811c7bf4c 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -12,9 +12,6 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index ab244dc4c..84cc03342 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -11,9 +11,6 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index b3cea170b..71dcd52d0 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -12,9 +12,6 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 1c772d72c..f66865433 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -12,9 +12,6 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index b1524d90b..f5bc6333d 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -12,9 +12,6 @@ title: Disallow Unsigned Commits Verify all commits are signed. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 08c9a5a5b..df970d8ae 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -15,9 +15,6 @@ Verify GitHub branch protection rules :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 60bae2a0a..5d1b10243 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -15,9 +15,6 @@ Verify selected commits are signed in the GitHub organization. :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index f61997182..63421e471 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -15,9 +15,6 @@ Verify commits in the specified time range are signed. :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index cd6fe373a..0b2528b66 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -17,9 +17,6 @@ Verify `two_factor_requirement` is enabled in the GitHub organization. Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 7f993b735..031daca80 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -12,9 +12,6 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 02d1cc6c6..cdd6fa2ae 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -12,9 +12,6 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 64f273427..62d5f813f 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -12,9 +12,6 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 69158d1ea..396748d6f 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -12,9 +12,6 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 78f855909..a5d2bc268 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -12,9 +12,6 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index a33b02393..506601fe4 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -12,9 +12,6 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 052010885..38d578958 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -12,9 +12,6 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index bf57d1b78..ae3003520 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -12,9 +12,6 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index fa110abd0..5712d230a 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -12,9 +12,6 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 7a69e2bbc..85446a360 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -12,9 +12,6 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 20145ddad..851b084ad 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -12,9 +12,6 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 4782f0d16..444ac8c85 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -12,9 +12,6 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 9a12f10c9..de43c6a0e 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -12,9 +12,6 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 0d4bbdf2c..dd0adb064 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -13,9 +13,6 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index ffc4f4713..3fc3071dd 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -12,9 +12,6 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 3f5eb3502..c3a142b47 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -12,9 +12,6 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 444b00459..30c8347cd 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -12,9 +12,6 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index e5753f71b..9de145602 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -12,9 +12,6 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 6bc76b144..584e9ea25 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -12,9 +12,6 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 1fcf3d305..aca7fdd1a 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -12,9 +12,6 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 63eee0235..756f549be 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -12,9 +12,6 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index ec01637a1..c8ac71503 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -12,9 +12,6 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 81fbd1958..600cefe54 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -12,9 +12,6 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index b1d4c2385..a1a100063 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -12,9 +12,6 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index ba02412fd..9b76b98cb 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -12,9 +12,6 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index e64a03e7c..4f787590f 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -12,9 +12,6 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index fdbb7cbb2..fec2c4e4e 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -12,9 +12,6 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 32c0eb9e3..20546baf0 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -12,9 +12,6 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 5720e91b4..3c2b767a5 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -12,9 +12,6 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 389c5366e..72e946067 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -12,9 +12,6 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 1e8678b4a..70bd763d1 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -12,9 +12,6 @@ title: Verify Repository Is Private Verify the GitHub repository is private. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 04e02fde6..36d4475ac 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -12,9 +12,6 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 4ce151ab5..32120c6c3 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -12,9 +12,6 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 43321fd1f..5e9d0c646 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -12,9 +12,6 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index f81396c45..e97443f8a 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -12,9 +12,6 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index c37fc1e93..94666f0b1 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -12,9 +12,6 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 749afe489..5f884da8a 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -15,9 +15,6 @@ Verify GitLab push rules are configured via the API. :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index c8f622c2b..8fcabb683 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -15,9 +15,6 @@ Verify the selected commits are signed in the GitLab organization. :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 2fc63a580..c20f33bf6 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -15,9 +15,6 @@ Verify the selected range of commits is signed via the GitLab API. :::tip Evidence **IS NOT** required for this rule. ::: -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index eb4ad033b..c6c7fc16a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -12,9 +12,6 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index b65b35b43..a64ef0c39 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -12,9 +12,6 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index b059c9995..d990dfea0 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -12,9 +12,6 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index b064d228c..aa4349934 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -12,9 +12,6 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index ce7b7e46a..8a2424599 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -12,9 +12,6 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index c5f5ee169..18ef8f3da 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -12,9 +12,6 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 8c4a5b1c5..bd37263ef 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -12,9 +12,6 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index c62837dc1..866a76b31 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -12,9 +12,6 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index f1524da1b..8459f907e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -12,9 +12,6 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 507183995..6cae12864 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -12,9 +12,6 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index f1933e4b9..06ca661b3 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -12,9 +12,6 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 0e5ff4e45..62f63d10d 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -12,9 +12,6 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index ee5c506a6..be53d20fe 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -12,9 +12,6 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index e180f349a..35b74b328 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -12,9 +12,6 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 220fffdc8..33138e67d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -12,9 +12,6 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index e19d55801..ce97b7a88 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -12,9 +12,6 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index 45db114d1..8be5ff2ef 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -12,9 +12,6 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 9ad8f9feb..5daa58a78 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -12,9 +12,6 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index a6a9fb97e..66865e2e2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -12,9 +12,6 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index cc901a22e..ef9916b74 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -12,9 +12,6 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index f9b40e60e..5d39ca3dd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -12,9 +12,6 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 370e4d07f..c88d34dd4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -12,9 +12,6 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 62e15ce57..892461aea 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -12,9 +12,6 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 10bae785c..cdad3c662 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -12,9 +12,6 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 55bfa996e..cc2ea1577 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -12,9 +12,6 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 07c71a50e..d9974edd4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -12,9 +12,6 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index dbcd45dba..1e0aa8365 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -12,9 +12,6 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index ac21268ad..48ec0f234 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -12,9 +12,6 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index aaf9f0891..db35a4da2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -12,9 +12,6 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 6c7276eca..49b4d4afe 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -12,9 +12,6 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 42df2d6a3..a8dc4a9e7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -12,9 +12,6 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 1830ce178..ae27a438e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -12,9 +12,6 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index e1f9fc822..cce047947 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -12,9 +12,6 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 3340df0df..67336f1e2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -12,9 +12,6 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 2fc963379..ccc5a11f8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -12,9 +12,6 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 651e5e1de..3710b445f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -12,9 +12,6 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 067e513df..f91151c15 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -12,9 +12,6 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 31e3805b8..87ddcfa55 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -12,9 +12,6 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 3ebaaccfb..b43af03d8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -12,9 +12,6 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 2a217d06f..41af8e597 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -12,9 +12,6 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 7b96e8eec..3f2565256 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -12,9 +12,6 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 3f1160032..00f5f9576 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -12,9 +12,6 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index e8f7f05a2..842fd7baa 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -12,9 +12,6 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 3cfa4bcce..d53d95685 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -12,9 +12,6 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index d58e839a9..de222f970 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -12,9 +12,6 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index f1f9deebe..6b7398174 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -12,9 +12,6 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 9f5710fd2..e937c1c17 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -12,9 +12,6 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 1fd68f141..c496bc1b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -12,9 +12,6 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 706d9623d..bdc28e647 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -12,9 +12,6 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 75e832c28..0936e760f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -12,9 +12,6 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 4ad39d9df..93faca041 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -12,9 +12,6 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index cce66555f..23925a6c4 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -21,9 +21,6 @@ This rule requires Dockerfile context; for example, run it with: Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 43acbd96d..77d5b339c 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -18,9 +18,6 @@ Ensures the main container image referenced in the SBOM is from an approved sour Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index ef78aece7..409021714 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -20,9 +20,6 @@ It fails if any banned port is exposed or if no banned ports list is provided. Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index ff2f59d37..3d7ad5f8d 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -17,9 +17,6 @@ Verify specific users are not allowed in an SBOM. Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index f61488eaf..6e5f4ee34 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -17,9 +17,6 @@ Verify no build scripts commands appear in block list. Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 27cf02372..6aada8987 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -13,9 +13,6 @@ title: 4.2.1 Registry Connection HTTPS Checks if the container's registry scheme is HTTPS -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 532b5de63..99f026685 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -17,9 +17,6 @@ Verify the image size is below the specified threshold. Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 7dfa83e0a..84b7b18ff 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -18,9 +18,6 @@ Verifies that each base image is not older than the specified threshold (max_day Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 011e9a83c..e978351a0 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -17,9 +17,6 @@ Verify the image is not older than the specified threshold. Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 8a633208e..f2d5c6360 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -18,9 +18,6 @@ Enforces that container images (target_type=container) are cryptographically sig Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 5e4418f93..1ed53bf2d 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -18,9 +18,6 @@ Checks that the container image includes at least one healthcheck property. Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index b6752fa61..5ec161ebe 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -17,9 +17,6 @@ Verify the container image disallows shell entrypoint. Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 6273ff3bf..1a769985e 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -17,9 +17,6 @@ Verify the image has the specified labels. Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 5c665edbb..fc0d72ce7 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -17,9 +17,6 @@ Verify specified labels key-value pairs exist in the image. Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 6520c5f75..9d67e217c 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -12,9 +12,6 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 88b9c6061..20e244090 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -12,9 +12,6 @@ title: Verify Inactive Users Verify there are no inactive users. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index a3780db29..41c420e29 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -12,9 +12,6 @@ title: Disallow Unused Users Verify there are no users with zero activity. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 28d2c9f5e..626ab5cfc 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -12,9 +12,6 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 9b89a7197..582154e0d 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -12,9 +12,6 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index c3871a88f..0f3b9c178 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -12,9 +12,6 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index df2d3be60..acbbb76c9 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -12,9 +12,6 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 7aa6a3822..d1d8db167 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -12,9 +12,6 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index db01ceb94..97b8caaa4 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -12,9 +12,6 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index ddbc7bcd1..579c3b4c2 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -12,9 +12,6 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 8a884c359..f330227d2 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -12,9 +12,6 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 83564dd83..6dcf8fb5a 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -12,9 +12,6 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index b6b5fc709..e97ea127b 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -12,9 +12,6 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS** required by default. ::: diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 30dce095d..4346695ef 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -12,9 +12,6 @@ title: SARIF Update Needed Verify no security packages require updates. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index dd74a5399..8ae23e90d 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -17,9 +17,6 @@ Verify the number of infrastructure-as-code (IaC) errors in the SARIF report rem Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index a26efb2d9..070c81c37 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -18,9 +18,6 @@ Verify a CVE Blocklist against a SARIF report Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 633054d4b..48e443c8c 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -18,9 +18,6 @@ Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF repo Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index d962690a2..09c3bb967 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -12,9 +12,6 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 6826e8689..ed94efd13 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -18,9 +18,6 @@ Verify the Trivy SARIF report complies with predefined rules to ensure complianc Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 92fdaf29d..a4d158219 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -17,9 +17,6 @@ Verify required evidence validates attack vectors in the SARIF report. Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 4c3823468..190f5ad33 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -17,9 +17,6 @@ Verify the SARIF report complies with defined generic rules for compliance and s Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 0485561fe..6e282a861 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -17,9 +17,6 @@ Verify the Semgrep SARIF report complies with predefined rules to ensure complia Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 2a99bf842..1a0e144b7 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -18,9 +18,6 @@ Checks that: 4) Optionally enforces a required supplier (case-insensitive match for supplier name). -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index f7f98bf35..22283be2a 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -12,9 +12,6 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 15aca0e6c..2a49b6d06 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -12,9 +12,6 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index d4bfe789c..a94b00735 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -12,9 +12,6 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 881b92b4f..151ea8190 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -12,9 +12,6 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index f94eface0..83f9019a0 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -12,9 +12,6 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 71a26911e..53f63bd3c 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -12,9 +12,6 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 5b19a02a0..e146a37c6 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -12,9 +12,6 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 14cd5ea5b..cc8f9a142 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -12,9 +12,6 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index eea522396..699a523bd 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -12,9 +12,6 @@ title: Verify build time Verify the artifact was created within the specified time window. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 7541161b7..e6942fddd 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -12,9 +12,6 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 950a6256d..1786acb9c 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -12,9 +12,6 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index cd4edb511..afa7ef8e2 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -12,9 +12,6 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index fdc2a3496..d4b1246d1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -16,9 +16,6 @@ PS.1 Require 2FA for accessing code Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 4891a81b4..fc1b8d0db 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -16,9 +16,6 @@ PS.1 Require branch protection for the repository Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 422e2a081..58f1f6880 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -16,9 +16,6 @@ PS.1 Restrict the maximum number of organization admins Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 80c4616a2..0a6881445 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -16,9 +16,6 @@ PS.1 Assure the repository is private Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index ef1fda082..090191be6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -16,9 +16,6 @@ PS.1 Require contributors to sign when committing to Github through the web inte Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 2d72b8b70..ca16e00e6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -16,9 +16,6 @@ PS.2 Provide a mechanism to verify the integrity of the image Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 64f993885..e565a5d60 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -18,9 +18,6 @@ We assume running in Github thus the code is allways stored in a repository Archives code changes to maintain a secure, immutable history for auditing and traceability. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index aaef83158..eabf79521 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -16,9 +16,6 @@ PS.3.2 Archive SBOM Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: From a0fb0698dd95f1dbc8ca3d826d62b2a2d4aee23b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:04:27 +0200 Subject: [PATCH 095/191] tmp gen docsush --- .../rules/bitbucket/project/allow-admins.md | 3 +++ .../rules/bitbucket/project/allow-users.md | 3 +++ .../rules/bitbucket/project/exposed-credentials.md | 3 +++ .../rules/bitbucket/project/long-live-tokens.md | 3 +++ .../rules/bitbucket/repository/allow-admins.md | 3 +++ .../rules/bitbucket/repository/allow-users.md | 3 +++ .../rules/bitbucket/repository/branch-protection.md | 3 +++ .../rules/bitbucket/workspace/allow-admins.md | 3 +++ .../rules/bitbucket/workspace/allow-users.md | 3 +++ .../initiatives/rules/dockerhub/token-expiration.md | 3 +++ .../initiatives/rules/dockerhub/token-not-used.md | 3 +++ .../initiatives/rules/generic/artifact-signed.md | 3 +++ .../initiatives/rules/generic/evidence-exists.md | 3 +++ .../initiatives/rules/generic/k8s-jailbreak.md | 3 +++ .../initiatives/rules/generic/trivy-exists.md | 3 +++ .../initiatives/rules/git/artifact-signed.md | 3 +++ .../initiatives/rules/git/coding-permissions.md | 3 +++ .../initiatives/rules/git/evidence-exists.md | 3 +++ .../initiatives/rules/git/no-commit-to-main.md | 3 +++ .../initiatives/rules/git/no-unsigned-commits.md | 3 +++ .../initiatives/rules/github/org/2fa.md | 13 ++++++++----- .../rules/github/org/advanced-security.md | 3 +++ .../initiatives/rules/github/org/allow-admins.md | 3 +++ .../initiatives/rules/github/org/allow-users.md | 3 +++ .../rules/github/org/create-private-repos.md | 3 +++ .../initiatives/rules/github/org/create-repos.md | 3 +++ .../rules/github/org/dependabot-alerts.md | 3 +++ .../github/org/dependabot-security-updates-sa.md | 3 +++ .../rules/github/org/dependabot-security-updates.md | 3 +++ .../rules/github/org/dependency-graph.md | 3 +++ .../initiatives/rules/github/org/max-admins.md | 3 +++ .../initiatives/rules/github/org/old-secrets.md | 3 +++ .../initiatives/rules/github/org/pp-custom-link.md | 3 +++ .../rules/github/org/push-protection-sa.md | 3 +++ .../initiatives/rules/github/org/push-protection.md | 3 +++ .../initiatives/rules/github/org/repo-visibility.md | 3 +++ .../rules/github/org/secret-scanning-sa.md | 3 +++ .../initiatives/rules/github/org/secret-scanning.md | 3 +++ .../rules/github/org/validity-checks-sa.md | 3 +++ .../initiatives/rules/github/org/validity-checks.md | 3 +++ .../rules/github/org/web-commit-signoff.md | 3 +++ .../rules/github/repository/branch-protection.md | 3 +++ .../rules/github/repository/branch-verification.md | 3 +++ .../rules/github/repository/check-signed-commits.md | 3 +++ .../github/repository/default-branch-protection.md | 3 +++ .../rules/github/repository/dependabot.md | 3 +++ .../github/repository/ephemeral-runners-only.md | 3 +++ .../rules/github/repository/no-cache-usage.md | 3 +++ .../rules/github/repository/no-org-secrets.md | 3 +++ .../rules/github/repository/old-secrets.md | 3 +++ .../rules/github/repository/push-protection.md | 3 +++ .../rules/github/repository/repo-private.md | 3 +++ .../rules/github/repository/secret-scanning.md | 3 +++ .../rules/github/repository/signed-commits.md | 3 +++ .../rules/github/repository/validity-checks.md | 3 +++ .../rules/github/repository/visibility.md | 3 +++ .../rules/github/repository/web-commit-signoff.md | 3 +++ .../initiatives/rules/gitlab/org/allow-admins.md | 3 +++ .../rules/gitlab/org/allow-token-scopes.md | 3 +++ .../initiatives/rules/gitlab/org/allow-users.md | 3 +++ .../initiatives/rules/gitlab/org/blocked-users.md | 3 +++ .../initiatives/rules/gitlab/org/expiring-tokens.md | 3 +++ .../rules/gitlab/org/forbid-token-scopes.md | 3 +++ .../rules/gitlab/org/inactive-projects.md | 3 +++ .../initiatives/rules/gitlab/org/longlive-tokens.md | 3 +++ .../initiatives/rules/gitlab/org/max-admins.md | 3 +++ .../rules/gitlab/org/projects-visibility.md | 3 +++ .../initiatives/rules/gitlab/org/unused-tokens.md | 3 +++ .../rules/gitlab/pipeline/verify-labels-exist.md | 3 +++ .../rules/gitlab/pipeline/verify-labels.md | 3 +++ .../rules/gitlab/project/abandoned-project.md | 3 +++ .../rules/gitlab/project/approvals-policy-check.md | 3 +++ .../gitlab/project/approvers-per-merge-request.md | 3 +++ .../rules/gitlab/project/author-email-regex.md | 3 +++ .../initiatives/rules/gitlab/project/check-cwe.md | 3 +++ .../rules/gitlab/project/check-signed-commits.md | 3 +++ .../rules/gitlab/project/co-approval-required.md | 3 +++ .../gitlab/project/commit-author-email-check.md | 3 +++ .../gitlab/project/commit-author-name-check.md | 3 +++ .../rules/gitlab/project/commit-committer-check.md | 3 +++ .../rules/gitlab/project/commit-message-check.md | 3 +++ .../rules/gitlab/project/commits-validated.md | 3 +++ .../rules/gitlab/project/committer-email-check.md | 3 +++ .../rules/gitlab/project/committer-name-check.md | 3 +++ .../rules/gitlab/project/critical-severity-limit.md | 3 +++ .../gitlab/project/description-substring-check.md | 3 +++ .../gitlab/project/disallowed-banned-approvers.md | 3 +++ .../rules/gitlab/project/force-push-protection.md | 3 +++ .../rules/gitlab/project/medium-severity-limit.md | 3 +++ .../rules/gitlab/project/member-check.md | 3 +++ .../rules/gitlab/project/merge-access-level.md | 3 +++ .../project/merge-requests-author-approval.md | 3 +++ .../merge-requests-disable-committers-approval.md | 3 +++ .../rules/gitlab/project/message-substring-check.md | 3 +++ .../rules/gitlab/project/prevent-secrets-check.md | 3 +++ .../rules/gitlab/project/protect-ci-secrets.md | 3 +++ .../rules/gitlab/project/push-access-level.md | 3 +++ .../rules/gitlab/project/push-rules-set.md | 3 +++ .../rules/gitlab/project/reject-unsigned-commits.md | 3 +++ .../gitlab/project/require-password-to-approve.md | 3 +++ .../gitlab/project/required-minimal-approvers.md | 3 +++ .../rules/gitlab/project/reset-pprovals-on-push.md | 3 +++ .../rules/gitlab/project/sast-scan-pass.md | 3 +++ .../rules/gitlab/project/sast-scanning.md | 3 +++ .../rules/gitlab/project/secrets-scan-pass.md | 3 +++ .../rules/gitlab/project/secrets-scanning.md | 3 +++ .../gitlab/project/selective-code-owner-removals.md | 3 +++ .../rules/gitlab/project/visibility-check.md | 3 +++ .../initiatives/rules/images/allowed-base-image.md | 13 ++++++++----- .../rules/images/allowed-image-source.md | 13 ++++++++----- .../initiatives/rules/images/banned-ports.md | 13 ++++++++----- .../initiatives/rules/images/banned-users.md | 13 ++++++++----- .../rules/images/blocklist-build-scripts.md | 13 ++++++++----- .../rules/images/enforce-https-registry.md | 3 +++ .../initiatives/rules/images/forbid-large-images.md | 13 ++++++++----- .../initiatives/rules/images/fresh-base-image.md | 13 ++++++++----- .../initiatives/rules/images/fresh-image.md | 13 ++++++++----- .../initiatives/rules/images/image-signed.md | 13 ++++++++----- .../initiatives/rules/images/require-healthcheck.md | 13 ++++++++----- .../rules/images/restrict-shell-entrypoint.md | 13 ++++++++----- .../initiatives/rules/images/verify-labels-exist.md | 13 ++++++++----- .../initiatives/rules/images/verify-labels.md | 13 ++++++++----- .../rules/jenkins/folder/exposed-credentials.md | 3 +++ .../rules/jenkins/instance/inactive-users.md | 3 +++ .../rules/jenkins/instance/unused-users.md | 3 +++ .../rules/k8s/namespace/allowed-images.md | 3 +++ .../rules/k8s/namespace/allowed-registries.md | 3 +++ .../k8s/namespace/verify-namespace-duration.md | 3 +++ .../k8s/namespace/verify-namespace-termination.md | 3 +++ .../rules/k8s/namespace/white-listed-namespaces.md | 3 +++ .../rules/k8s/namespace/white-listed-pod.md | 3 +++ .../rules/k8s/pods/verify-pod-duration.md | 3 +++ .../rules/k8s/pods/verify-pod-termination.md | 3 +++ .../initiatives/rules/k8s/pods/white-listed-pod.md | 3 +++ .../rules/multievidence/files_integrity.md | 3 +++ .../initiatives/rules/sarif/artifact-signed.md | 13 ++++++++----- .../initiatives/rules/sarif/evidence-exists.md | 13 ++++++++----- .../rules/sarif/patcheck/updates-needed.md | 3 +++ .../initiatives/rules/sarif/report-iac-errors.md | 13 ++++++++----- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 13 ++++++++----- .../rules/sarif/trivy/report-trivy-iac-errors.md | 13 ++++++++----- .../rules/sarif/trivy/verify-cve-severity.md | 13 ++++++++----- .../rules/sarif/trivy/verify-trivy-attack-vector.md | 3 +++ .../rules/sarif/trivy/verify-trivy-report.md | 13 ++++++++----- .../initiatives/rules/sarif/verify-attack-vector.md | 13 ++++++++----- .../initiatives/rules/sarif/verify-sarif.md | 13 ++++++++----- .../rules/sarif/verify-semgrep-report.md | 13 ++++++++----- .../initiatives/rules/sarif/verify-tool-evidence.md | 13 ++++++++----- .../initiatives/rules/sbom/NTIA-compliance.md | 3 +++ .../initiatives/rules/sbom/allowed-components.md | 3 +++ .../initiatives/rules/sbom/artifact-signed.md | 3 +++ .../initiatives/rules/sbom/banned-licenses.md | 3 +++ .../initiatives/rules/sbom/blocklist-packages.md | 3 +++ .../initiatives/rules/sbom/complete-licenses.md | 3 +++ .../initiatives/rules/sbom/fresh-sbom.md | 3 +++ .../initiatives/rules/sbom/require-sbom.md | 3 +++ .../initiatives/rules/sbom/required-packages.md | 3 +++ .../rules/sbom/verify-huggingface-license.md | 3 +++ .../initiatives/rules/slsa/banned-builder-deps.md | 3 +++ .../initiatives/rules/slsa/build-time.md | 3 +++ .../initiatives/rules/slsa/field-exists.md | 3 +++ .../initiatives/rules/slsa/l1-provenance-exists.md | 11 +++++++---- .../rules/slsa/l2-provenance-authenticated.md | 13 ++++++++----- .../initiatives/rules/slsa/verify-builder.md | 3 +++ .../initiatives/rules/slsa/verify-byproducts.md | 3 +++ .../initiatives/rules/ssdf/ps-1-2fa.md | 13 ++++++++----- .../rules/ssdf/ps-1-branch-protection.md | 13 ++++++++----- .../initiatives/rules/ssdf/ps-1-limit-admins.md | 13 ++++++++----- .../initiatives/rules/ssdf/ps-1-repo-private.md | 13 ++++++++----- .../rules/ssdf/ps-1-web-commit-signoff.md | 13 ++++++++----- .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 13 ++++++++----- .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 13 ++++++++----- .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 13 ++++++++----- 173 files changed, 693 insertions(+), 174 deletions(-) diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 41e120efe..8c0a62124 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -11,6 +11,9 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. +:::note +This rule requires Unsigned Bitbucket Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index a2abd5848..6d4bf7354 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -11,6 +11,9 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. +:::note +This rule requires Unsigned Bitbucket Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 6a3f45bad..e5c1d223d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -12,6 +12,9 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. +:::note +This rule requires Unsigned Bitbucket Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index b11156945..3b1cf7b50 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -12,6 +12,9 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. +:::note +This rule requires Unsigned Bitbucket Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index be91a6762..71b253108 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -12,6 +12,9 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. +:::note +This rule requires Unsigned Bitbucket Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index a09f09fd3..9e22f1145 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -12,6 +12,9 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. +:::note +This rule requires Unsigned Bitbucket Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index e36e4f9fb..b225ff684 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -12,6 +12,9 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. +:::note +This rule requires Unsigned Bitbucket Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index fe24bf014..385ec3cfb 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -12,6 +12,9 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. +:::note +This rule requires Unsigned Bitbucket Workspace Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index be6c9c163..dbe2ca211 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -12,6 +12,9 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. +:::note +This rule requires Unsigned Bitbucket Workspace Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index dd24d466e..b3b3e4dc6 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -12,6 +12,9 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 64be7001a..95c9e4b98 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -12,6 +12,9 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 3e5d53eb9..5e048fb21 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -15,6 +15,9 @@ Verify required evidence is signed. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Signed Generic Statement. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 047ad1fe7..022435d35 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -15,6 +15,9 @@ Verify required evidence exists. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned Generic Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 811c7bf4c..f55ada14f 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -12,6 +12,9 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 84cc03342..cbb972d5f 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -11,6 +11,9 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists +:::note +This rule requires Unsigned Generic Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 965493558..acb644ec9 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -15,6 +15,9 @@ Verify the Git artifact is signed. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Signed Git SBOM. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 71dcd52d0..c6a49f232 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -12,6 +12,9 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. +:::note +This rule requires Unsigned Git SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index fa1b43b50..f221c5766 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -15,6 +15,9 @@ Verify required Git evidence exists. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned Git SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index f66865433..184b2ddbc 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -12,6 +12,9 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. +:::note +This rule requires Unsigned Git SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index f5bc6333d..d5ca12057 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -12,6 +12,9 @@ title: Disallow Unsigned Commits Verify all commits are signed. +:::note +This rule requires Unsigned Git SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 0b2528b66..06e8a1755 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -12,11 +12,9 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. - -## Mitigation -Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - - +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. + + + ## Description This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 031daca80..5388dbb6b 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -12,6 +12,9 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index cdd6fa2ae..17bff2a39 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -12,6 +12,9 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 62d5f813f..ce6104031 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -12,6 +12,9 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 396748d6f..0df61bb9b 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -12,6 +12,9 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index a5d2bc268..598a44431 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -12,6 +12,9 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 506601fe4..387d11035 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -12,6 +12,9 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 38d578958..b8374ed0a 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -12,6 +12,9 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index ae3003520..d7a4b8121 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -12,6 +12,9 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 5712d230a..c8b8def1f 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -12,6 +12,9 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 85446a360..a83065d5c 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -12,6 +12,9 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 851b084ad..b1b2e7fff 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -12,6 +12,9 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 444ac8c85..ba3fd9d15 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -12,6 +12,9 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index de43c6a0e..7f4f01129 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -12,6 +12,9 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index dd0adb064..7f19d4684 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -13,6 +13,9 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 3fc3071dd..0e9116307 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -12,6 +12,9 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index c3a142b47..0ae9d9483 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -12,6 +12,9 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 30c8347cd..61f501e49 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -12,6 +12,9 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 9de145602..ae5b75715 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -12,6 +12,9 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 584e9ea25..a1f29b5a2 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -12,6 +12,9 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index aca7fdd1a..0bd6da2fe 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -12,6 +12,9 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. +:::note +This rule requires Unsigned Github Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 756f549be..25acbb3e9 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -12,6 +12,9 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index c8ac71503..5e2f24e7a 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -12,6 +12,9 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 600cefe54..5f2b09a1f 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -12,6 +12,9 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index a1a100063..baed475c5 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -12,6 +12,9 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 9b76b98cb..0b7295fd6 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -12,6 +12,9 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 4f787590f..b450a6877 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -12,6 +12,9 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index fec2c4e4e..f3cdab8d2 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -12,6 +12,9 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 20546baf0..c8d824d0f 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -12,6 +12,9 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 3c2b767a5..ebc0b0597 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -12,6 +12,9 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 72e946067..b9b9d38b5 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -12,6 +12,9 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 70bd763d1..52c10f180 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -12,6 +12,9 @@ title: Verify Repository Is Private Verify the GitHub repository is private. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 36d4475ac..6963e291b 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -12,6 +12,9 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 32120c6c3..38bbf94a6 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -12,6 +12,9 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 5e9d0c646..8e956334e 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -12,6 +12,9 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index e97443f8a..44a595901 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -12,6 +12,9 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 94666f0b1..13916e4eb 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -12,6 +12,9 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. +:::note +This rule requires Unsigned Github Repository Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index c6c7fc16a..7fd46f0d4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -12,6 +12,9 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index a64ef0c39..d226bf6f9 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -12,6 +12,9 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index d990dfea0..8fc34d7c5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -12,6 +12,9 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index aa4349934..311a99276 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -12,6 +12,9 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index 8a2424599..4d63cebdd 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -12,6 +12,9 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 18ef8f3da..305449618 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -12,6 +12,9 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index bd37263ef..5d909833b 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -12,6 +12,9 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 866a76b31..ae308b35a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -12,6 +12,9 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 8459f907e..991ba61b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -12,6 +12,9 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 6cae12864..0f0a91f7a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -12,6 +12,9 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 06ca661b3..79fb1a3c5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -12,6 +12,9 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. +:::note +This rule requires Unsigned Gitlab Organization Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 62f63d10d..9021b26f1 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -12,6 +12,9 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index be53d20fe..5ae0c160c 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -12,6 +12,9 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 35b74b328..8f5ea00cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -12,6 +12,9 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 33138e67d..f2a1172bd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -12,6 +12,9 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index ce97b7a88..ba9b83487 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -12,6 +12,9 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index 8be5ff2ef..f74267627 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -12,6 +12,9 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 5daa58a78..b47448447 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -12,6 +12,9 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 66865e2e2..5fc6f5173 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -12,6 +12,9 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index ef9916b74..5108ec541 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -12,6 +12,9 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 5d39ca3dd..2f3fe8876 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -12,6 +12,9 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index c88d34dd4..10dcc4ab3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -12,6 +12,9 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 892461aea..ab9b55924 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -12,6 +12,9 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index cdad3c662..8dd963b6b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -12,6 +12,9 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index cc2ea1577..2c0a8bba0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -12,6 +12,9 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index d9974edd4..913b289f4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -12,6 +12,9 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 1e0aa8365..1faf603c8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -12,6 +12,9 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 48ec0f234..6b98226ca 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -12,6 +12,9 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index db35a4da2..e158b7cd6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -12,6 +12,9 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 49b4d4afe..82168f002 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -12,6 +12,9 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index a8dc4a9e7..8b7fcf3f1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -12,6 +12,9 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index ae27a438e..1cf7d5384 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -12,6 +12,9 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index cce047947..d5b423a2d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -12,6 +12,9 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 67336f1e2..5120eed1e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -12,6 +12,9 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index ccc5a11f8..b2e45fc59 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -12,6 +12,9 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 3710b445f..1f0fad062 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -12,6 +12,9 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index f91151c15..b9007f6e5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -12,6 +12,9 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 87ddcfa55..b837ffaa9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -12,6 +12,9 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index b43af03d8..ec45e3d02 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -12,6 +12,9 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 41af8e597..5f746bdf5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -12,6 +12,9 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 3f2565256..06c292e10 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -12,6 +12,9 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 00f5f9576..c263768b5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -12,6 +12,9 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 842fd7baa..03811b8b7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -12,6 +12,9 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index d53d95685..cf66fbd12 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -12,6 +12,9 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index de222f970..5685bc46c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -12,6 +12,9 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 6b7398174..ffb3602a4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -12,6 +12,9 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index e937c1c17..19d5a7dd3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -12,6 +12,9 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index c496bc1b8..72de1e15f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -12,6 +12,9 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index bdc28e647..c7db738ed 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -12,6 +12,9 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 0936e760f..6e13ce541 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -12,6 +12,9 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 93faca041..95314a91a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -12,6 +12,9 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. +:::note +This rule requires Unsigned Gitlab Project Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 23925a6c4..9d28fe302 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -16,11 +16,9 @@ This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. - -## Mitigation -Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -31,6 +29,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. + + + ## Description This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images. A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true". diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 77d5b339c..541599623 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -13,11 +13,9 @@ title: Allowed Main Image Source Ensures the main container image referenced in the SBOM is from an approved source. - -## Mitigation -Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -28,6 +26,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. + + + ## Description This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source. It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`). diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 409021714..557511b51 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -15,11 +15,9 @@ The rule examines properties in the SBOM metadata and checks each value (expecte It fails if any banned port is exposed or if no banned ports list is provided. - -## Mitigation -Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -30,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. + + + ## Description This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 3d7ad5f8d..83276188e 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -12,11 +12,9 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. - -## Mitigation -Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -27,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. + + + ## Description This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 6e5f4ee34..578f4aea7 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -12,11 +12,9 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. - -## Mitigation -Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. + + + ## Description This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 6aada8987..fe0191872 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -13,6 +13,9 @@ title: 4.2.1 Registry Connection HTTPS Checks if the container's registry scheme is HTTPS +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 99f026685..ccdf9fc9a 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -12,11 +12,9 @@ title: Forbid Large Images Verify the image size is below the specified threshold. - -## Mitigation -Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. + + + ## Description This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 84b7b18ff..6e11c1dae 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -13,11 +13,9 @@ title: Fresh Base Image Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - -## Mitigation -Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -28,6 +26,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. + + + ## Description This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index e978351a0..6a6541fea 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -12,11 +12,9 @@ title: Fresh Image Verify the image is not older than the specified threshold. - -## Mitigation -Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -27,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. + + + ## Description This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index f2d5c6360..f964d785b 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -13,11 +13,9 @@ title: Require Signed Container Image Enforces that container images (target_type=container) are cryptographically signed. - -## Mitigation -Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -28,6 +26,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. + + + ## Description This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 1ed53bf2d..da6b4a867 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -13,11 +13,9 @@ title: Require Healthcheck Checks that the container image includes at least one healthcheck property. - -## Mitigation -Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -28,6 +26,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Mitigation +Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. + + + ## Description This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined. It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 5ec161ebe..db28d8589 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -12,11 +12,9 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. - -## Mitigation -Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. + + + ## Description This rule ensures that container images do not allow shell access by verifying their configured entrypoint. Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 1a769985e..c3f7427ca 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -12,11 +12,9 @@ title: Require Image Labels Verify the image has the specified labels. - -## Mitigation -Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. + + + ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label (as defined in the `with.labels` parameter) exists with the correct value. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index fc0d72ce7..87e85c830 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -12,11 +12,9 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. - -## Mitigation -Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. - - +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. + + + ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label (as defined in the `with.labels` parameter) exists with the correct value. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 9d67e217c..45dadc6e0 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -12,6 +12,9 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 20e244090..90ec7eef3 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -12,6 +12,9 @@ title: Verify Inactive Users Verify there are no inactive users. +:::note +This rule requires Unsigned Jenkins Instance Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 41c420e29..5aba3986a 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -12,6 +12,9 @@ title: Disallow Unused Users Verify there are no users with zero activity. +:::note +This rule requires Unsigned Jenkins Instance Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 626ab5cfc..947be6cf7 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -12,6 +12,9 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 582154e0d..90f5ab4ae 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -12,6 +12,9 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 0f3b9c178..3c14b93ec 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -12,6 +12,9 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index acbbb76c9..0fe55ce60 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -12,6 +12,9 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index d1d8db167..8dbea82a7 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -12,6 +12,9 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 97b8caaa4..06743a433 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -12,6 +12,9 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 579c3b4c2..d81477f6a 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -12,6 +12,9 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index f330227d2..757b70f2f 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -12,6 +12,9 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 6dcf8fb5a..03bccf1d9 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -12,6 +12,9 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. +:::note +This rule requires Unsigned Discovery Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index e97ea127b..15420aa97 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -12,6 +12,9 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. +:::note +This rule requires Signed Image SBOM. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index f7e5c044c..d3d72dae1 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -12,14 +12,12 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. - -## Mitigation -Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. - - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Signed SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: @@ -27,6 +25,11 @@ Signed Evidence for this rule **IS** required by default. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. + + + ## Description This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed. It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index d5cfe94e7..e8c52db75 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -12,14 +12,12 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. - -## Mitigation -By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. - - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -27,6 +25,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 4346695ef..500f1bb94 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -12,6 +12,9 @@ title: SARIF Update Needed Verify no security packages require updates. +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 8ae23e90d..c9b9cbfb5 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -12,11 +12,9 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. - -## Mitigation -Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + + ## Description This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 070c81c37..e5e6fe773 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -13,11 +13,9 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report - -## Mitigation -Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -25,6 +23,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Mitigation +Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. + + + ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 48e443c8c..9266bdfd1 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -13,11 +13,9 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. - -## Mitigation -Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -25,6 +23,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + + ## Description This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 23518a777..0b4f3befa 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -15,14 +15,12 @@ Verifies that vulnerability findings in the SARIF evidence from Trivy do not exc the defined severity threshold. - -## Mitigation -Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -30,6 +28,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + + ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it complies with a set of predefined rules. The evaluation is based on several configurable parameters: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 09c3bb967..53d699a78 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -12,6 +12,9 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index ed94efd13..19ce02530 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -13,11 +13,9 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. - -## Mitigation -Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -25,6 +23,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + + ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it complies with a set of predefined rules. The evaluation is based on several configurable parameters: diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index a4d158219..8b6e56510 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -12,11 +12,9 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. - -## Mitigation -Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. + + + ## Description This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities associated with specific attack vectors are properly identified. The rule works as follows: diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 190f5ad33..6ffbe36c3 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -12,11 +12,9 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. - -## Mitigation -Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. + + + ## Description This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules. It does so by using helper functions from the `data.sarif` module to: diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 6e282a861..fbd29c985 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -12,11 +12,9 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. - -## Mitigation -Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. - - +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -24,6 +22,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. + + + ## Description This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules. It iterates over the vulnerability results in the SARIF report (located under diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 4268db939..999a6267d 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -12,14 +12,12 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. - -## Mitigation -Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. - - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned SARIF Evidence. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -27,6 +25,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. + + + ## Description This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner (e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 1a0e144b7..f298ed76f 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -18,6 +18,9 @@ Checks that: 4) Optionally enforces a required supplier (case-insensitive match for supplier name). +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 22283be2a..aaae60175 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -12,6 +12,9 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index f5611502d..08aadaa8f 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -15,6 +15,9 @@ Verify the SBOM is signed. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Signed SBOM. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 2a49b6d06..1a05cfe53 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -12,6 +12,9 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index a94b00735..62c76edf8 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -12,6 +12,9 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. +:::note +This rule requires Unsigned Image SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 151ea8190..4c7c2d533 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -12,6 +12,9 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 83f9019a0..a91ed9d0a 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -12,6 +12,9 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 3913cfccc..15280afbb 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -15,6 +15,9 @@ Verify the SBOM exists as evidence. :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 53f63bd3c..87bb1231c 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -12,6 +12,9 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index e146a37c6..24f1e2978 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -12,6 +12,9 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. +:::note +This rule requires Unsigned SBOM. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index cc8f9a142..a2c8b5c79 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -12,6 +12,9 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 699a523bd..bd5cd1fb2 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -12,6 +12,9 @@ title: Verify build time Verify the artifact was created within the specified time window. +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index e6942fddd..90f271866 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -12,6 +12,9 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 1072059a6..702c58c48 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -13,13 +13,12 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. - -## Mitigation -Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -30,6 +29,10 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 1eb3fb757..32c9fd8d0 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -13,14 +13,12 @@ title: Verify that provenance is authenticated Verify the artifact is signed. - -## Mitigation -Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. - - :::tip > Evidence **IS** required for this rule and will fail if missing. ::: +:::note +This rule requires Signed SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS** required by default. ::: @@ -31,6 +29,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 1786acb9c..b267d0888 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -12,6 +12,9 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index afa7ef8e2..0557ab189 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -12,6 +12,9 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. +:::note +This rule requires Unsigned SLSA Provenance. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index d4b1246d1..de3fe4a48 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -11,11 +11,9 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code - -## Mitigation -Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. + + + ## Description This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index fc1b8d0db..ec11a54aa 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -11,11 +11,9 @@ title: Branch protected PS.1 Require branch protection for the repository - -## Mitigation -Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. + + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 58f1f6880..62c3d5340 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -11,11 +11,9 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins - -## Mitigation -Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. + + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 0a6881445..1e952a43a 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -11,11 +11,9 @@ title: Repo private PS.1 Assure the repository is private - -## Mitigation -Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. + + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 090191be6..8b7d65c2c 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -11,11 +11,9 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface - -## Mitigation -Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. + + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index ca16e00e6..1164bdd9b 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -11,11 +11,9 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image - -## Mitigation -Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,6 +21,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index e565a5d60..1a774aa03 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -13,11 +13,9 @@ PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository - -## Mitigation -Archives code changes to maintain a secure, immutable history for auditing and traceability. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -25,6 +23,11 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Archives code changes to maintain a secure, immutable history for auditing and traceability. + + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index eabf79521..a13701d57 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -11,11 +11,9 @@ title: SBOM archived PS.3.2 Archive SBOM - -## Mitigation -Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. - - +:::note +This rule requires Unsigned Statement. +::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: @@ -23,3 +21,8 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. + + + From dac498647edc848878f907de7d1035bd34bc35b8 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:11:50 +0200 Subject: [PATCH 096/191] tmp gen docsush --- .../initiatives/rules/bitbucket/project/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/project/allow-users.md | 2 +- .../rules/bitbucket/project/exposed-credentials.md | 2 +- .../initiatives/rules/bitbucket/project/long-live-tokens.md | 2 +- .../initiatives/rules/bitbucket/repository/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/repository/allow-users.md | 2 +- .../rules/bitbucket/repository/branch-protection.md | 2 +- .../initiatives/rules/bitbucket/workspace/allow-admins.md | 2 +- .../initiatives/rules/bitbucket/workspace/allow-users.md | 2 +- .../initiatives/rules/dockerhub/token-expiration.md | 2 +- .../initiatives/rules/dockerhub/token-not-used.md | 2 +- .../initiatives/rules/generic/artifact-signed.md | 3 +++ .../initiatives/rules/generic/evidence-exists.md | 5 ++++- .../configuration/initiatives/rules/generic/k8s-jailbreak.md | 2 +- docs/configuration/initiatives/rules/generic/trivy-exists.md | 2 +- docs/configuration/initiatives/rules/git/artifact-signed.md | 3 +++ .../initiatives/rules/git/coding-permissions.md | 2 +- docs/configuration/initiatives/rules/git/evidence-exists.md | 5 ++++- .../configuration/initiatives/rules/git/no-commit-to-main.md | 2 +- .../initiatives/rules/git/no-unsigned-commits.md | 2 +- docs/configuration/initiatives/rules/github/org/2fa.md | 2 +- .../initiatives/rules/github/org/advanced-security.md | 2 +- .../initiatives/rules/github/org/allow-admins.md | 2 +- .../initiatives/rules/github/org/allow-users.md | 2 +- .../initiatives/rules/github/org/create-private-repos.md | 2 +- .../initiatives/rules/github/org/create-repos.md | 2 +- .../initiatives/rules/github/org/dependabot-alerts.md | 2 +- .../rules/github/org/dependabot-security-updates-sa.md | 2 +- .../rules/github/org/dependabot-security-updates.md | 2 +- .../initiatives/rules/github/org/dependency-graph.md | 2 +- .../configuration/initiatives/rules/github/org/max-admins.md | 2 +- .../initiatives/rules/github/org/old-secrets.md | 2 +- .../initiatives/rules/github/org/pp-custom-link.md | 2 +- .../initiatives/rules/github/org/push-protection-sa.md | 2 +- .../initiatives/rules/github/org/push-protection.md | 2 +- .../initiatives/rules/github/org/repo-visibility.md | 2 +- .../initiatives/rules/github/org/secret-scanning-sa.md | 2 +- .../initiatives/rules/github/org/secret-scanning.md | 2 +- .../initiatives/rules/github/org/validity-checks-sa.md | 2 +- .../initiatives/rules/github/org/validity-checks.md | 2 +- .../initiatives/rules/github/org/web-commit-signoff.md | 2 +- .../initiatives/rules/github/repository/branch-protection.md | 2 +- .../rules/github/repository/branch-verification.md | 2 +- .../rules/github/repository/check-signed-commits.md | 2 +- .../rules/github/repository/default-branch-protection.md | 2 +- .../initiatives/rules/github/repository/dependabot.md | 2 +- .../rules/github/repository/ephemeral-runners-only.md | 2 +- .../initiatives/rules/github/repository/no-cache-usage.md | 2 +- .../initiatives/rules/github/repository/no-org-secrets.md | 2 +- .../initiatives/rules/github/repository/old-secrets.md | 2 +- .../initiatives/rules/github/repository/push-protection.md | 2 +- .../initiatives/rules/github/repository/repo-private.md | 2 +- .../initiatives/rules/github/repository/secret-scanning.md | 2 +- .../initiatives/rules/github/repository/signed-commits.md | 2 +- .../initiatives/rules/github/repository/validity-checks.md | 2 +- .../initiatives/rules/github/repository/visibility.md | 2 +- .../rules/github/repository/web-commit-signoff.md | 2 +- .../initiatives/rules/gitlab/org/allow-admins.md | 2 +- .../initiatives/rules/gitlab/org/allow-token-scopes.md | 2 +- .../initiatives/rules/gitlab/org/allow-users.md | 2 +- .../initiatives/rules/gitlab/org/blocked-users.md | 2 +- .../initiatives/rules/gitlab/org/expiring-tokens.md | 2 +- .../initiatives/rules/gitlab/org/forbid-token-scopes.md | 2 +- .../initiatives/rules/gitlab/org/inactive-projects.md | 2 +- .../initiatives/rules/gitlab/org/longlive-tokens.md | 2 +- .../configuration/initiatives/rules/gitlab/org/max-admins.md | 2 +- .../initiatives/rules/gitlab/org/projects-visibility.md | 2 +- .../initiatives/rules/gitlab/org/unused-tokens.md | 2 +- .../initiatives/rules/gitlab/pipeline/verify-labels-exist.md | 2 +- .../initiatives/rules/gitlab/pipeline/verify-labels.md | 2 +- .../initiatives/rules/gitlab/project/abandoned-project.md | 2 +- .../rules/gitlab/project/approvals-policy-check.md | 2 +- .../rules/gitlab/project/approvers-per-merge-request.md | 2 +- .../initiatives/rules/gitlab/project/author-email-regex.md | 2 +- .../initiatives/rules/gitlab/project/check-cwe.md | 2 +- .../initiatives/rules/gitlab/project/check-signed-commits.md | 2 +- .../initiatives/rules/gitlab/project/co-approval-required.md | 2 +- .../rules/gitlab/project/commit-author-email-check.md | 2 +- .../rules/gitlab/project/commit-author-name-check.md | 2 +- .../rules/gitlab/project/commit-committer-check.md | 2 +- .../initiatives/rules/gitlab/project/commit-message-check.md | 2 +- .../initiatives/rules/gitlab/project/commits-validated.md | 2 +- .../rules/gitlab/project/committer-email-check.md | 2 +- .../initiatives/rules/gitlab/project/committer-name-check.md | 2 +- .../rules/gitlab/project/critical-severity-limit.md | 2 +- .../rules/gitlab/project/description-substring-check.md | 2 +- .../rules/gitlab/project/disallowed-banned-approvers.md | 2 +- .../rules/gitlab/project/force-push-protection.md | 2 +- .../rules/gitlab/project/medium-severity-limit.md | 2 +- .../initiatives/rules/gitlab/project/member-check.md | 2 +- .../initiatives/rules/gitlab/project/merge-access-level.md | 2 +- .../rules/gitlab/project/merge-requests-author-approval.md | 2 +- .../project/merge-requests-disable-committers-approval.md | 2 +- .../rules/gitlab/project/message-substring-check.md | 2 +- .../rules/gitlab/project/prevent-secrets-check.md | 2 +- .../initiatives/rules/gitlab/project/protect-ci-secrets.md | 2 +- .../initiatives/rules/gitlab/project/push-access-level.md | 2 +- .../initiatives/rules/gitlab/project/push-rules-set.md | 2 +- .../rules/gitlab/project/reject-unsigned-commits.md | 2 +- .../rules/gitlab/project/require-password-to-approve.md | 2 +- .../rules/gitlab/project/required-minimal-approvers.md | 2 +- .../rules/gitlab/project/reset-pprovals-on-push.md | 2 +- .../initiatives/rules/gitlab/project/sast-scan-pass.md | 2 +- .../initiatives/rules/gitlab/project/sast-scanning.md | 2 +- .../initiatives/rules/gitlab/project/secrets-scan-pass.md | 2 +- .../initiatives/rules/gitlab/project/secrets-scanning.md | 2 +- .../rules/gitlab/project/selective-code-owner-removals.md | 2 +- .../initiatives/rules/gitlab/project/visibility-check.md | 2 +- .../initiatives/rules/images/allowed-base-image.md | 2 +- .../initiatives/rules/images/allowed-image-source.md | 2 +- docs/configuration/initiatives/rules/images/banned-ports.md | 2 +- docs/configuration/initiatives/rules/images/banned-users.md | 2 +- .../initiatives/rules/images/blocklist-build-scripts.md | 2 +- .../initiatives/rules/images/enforce-https-registry.md | 2 +- .../initiatives/rules/images/forbid-large-images.md | 2 +- .../initiatives/rules/images/fresh-base-image.md | 2 +- docs/configuration/initiatives/rules/images/fresh-image.md | 2 +- docs/configuration/initiatives/rules/images/image-signed.md | 2 +- .../initiatives/rules/images/require-healthcheck.md | 2 +- .../initiatives/rules/images/restrict-shell-entrypoint.md | 2 +- .../initiatives/rules/images/verify-labels-exist.md | 2 +- docs/configuration/initiatives/rules/images/verify-labels.md | 2 +- .../initiatives/rules/jenkins/folder/exposed-credentials.md | 2 +- .../initiatives/rules/jenkins/instance/inactive-users.md | 2 +- .../initiatives/rules/jenkins/instance/unused-users.md | 2 +- .../initiatives/rules/k8s/namespace/allowed-images.md | 2 +- .../initiatives/rules/k8s/namespace/allowed-registries.md | 2 +- .../rules/k8s/namespace/verify-namespace-duration.md | 2 +- .../rules/k8s/namespace/verify-namespace-termination.md | 2 +- .../rules/k8s/namespace/white-listed-namespaces.md | 2 +- .../initiatives/rules/k8s/namespace/white-listed-pod.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-duration.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-termination.md | 2 +- .../initiatives/rules/k8s/pods/white-listed-pod.md | 2 +- .../configuration/initiatives/rules/sarif/artifact-signed.md | 3 +++ .../configuration/initiatives/rules/sarif/evidence-exists.md | 5 ++++- .../initiatives/rules/sarif/patcheck/updates-needed.md | 2 +- .../initiatives/rules/sarif/report-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 2 +- .../initiatives/rules/sarif/trivy/report-trivy-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/verify-cve-severity.md | 5 ++++- .../rules/sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../initiatives/rules/sarif/trivy/verify-trivy-report.md | 2 +- .../initiatives/rules/sarif/verify-attack-vector.md | 2 +- docs/configuration/initiatives/rules/sarif/verify-sarif.md | 2 +- .../initiatives/rules/sarif/verify-semgrep-report.md | 2 +- .../initiatives/rules/sarif/verify-tool-evidence.md | 5 ++++- docs/configuration/initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../initiatives/rules/sbom/allowed-components.md | 2 +- docs/configuration/initiatives/rules/sbom/artifact-signed.md | 3 +++ docs/configuration/initiatives/rules/sbom/banned-licenses.md | 2 +- .../initiatives/rules/sbom/blocklist-packages.md | 2 +- .../initiatives/rules/sbom/complete-licenses.md | 2 +- docs/configuration/initiatives/rules/sbom/fresh-sbom.md | 2 +- docs/configuration/initiatives/rules/sbom/require-sbom.md | 5 ++++- .../initiatives/rules/sbom/required-packages.md | 2 +- .../initiatives/rules/sbom/verify-huggingface-license.md | 2 +- .../initiatives/rules/slsa/banned-builder-deps.md | 2 +- docs/configuration/initiatives/rules/slsa/build-time.md | 2 +- docs/configuration/initiatives/rules/slsa/field-exists.md | 2 +- .../initiatives/rules/slsa/l1-provenance-exists.md | 5 ++++- .../initiatives/rules/slsa/l2-provenance-authenticated.md | 3 +++ docs/configuration/initiatives/rules/slsa/verify-builder.md | 2 +- .../initiatives/rules/slsa/verify-byproducts.md | 2 +- docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../initiatives/rules/ssdf/ps-1-branch-protection.md | 2 +- .../initiatives/rules/ssdf/ps-1-limit-admins.md | 2 +- .../initiatives/rules/ssdf/ps-1-repo-private.md | 2 +- .../initiatives/rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 2 +- .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 2 +- .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 2 +- 172 files changed, 203 insertions(+), 167 deletions(-) diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 8c0a62124..9bdd1db6d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Unsigned Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 6d4bf7354..12f049d9b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Unsigned Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index e5c1d223d..7c28fa7a5 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -13,7 +13,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Unsigned Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 3b1cf7b50..cfc9b6371 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -13,7 +13,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Unsigned Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 71b253108..5820f33b4 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Unsigned Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 9e22f1145..560863cff 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Unsigned Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index b225ff684..ec54a105d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Unsigned Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 385ec3cfb..e9e6d792e 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Unsigned Bitbucket Workspace Discovery Evidence. +This rule requires Bitbucket Workspace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index dbe2ca211..8c43e2867 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Unsigned Bitbucket Workspace Discovery Evidence. +This rule requires Bitbucket Workspace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index b3b3e4dc6..40880dc10 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 95c9e4b98..c91995f73 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 5e048fb21..8be36da52 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -19,6 +19,9 @@ Verify required evidence is signed. This rule requires Signed Generic Statement. ::: :::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 022435d35..71d534566 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -16,7 +16,10 @@ Verify required evidence exists. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned Generic Statement. +This rule requires Generic Statement. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index f55ada14f..8e5c9ccb5 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index cbb972d5f..73bbd5d62 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Unsigned Generic Statement. +This rule requires Generic Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index acb644ec9..92c460c02 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -19,6 +19,9 @@ Verify the Git artifact is signed. This rule requires Signed Git SBOM. ::: :::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index c6a49f232..a029fab81 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Unsigned Git SBOM. +This rule requires Git SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index f221c5766..917dc07a7 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -16,7 +16,10 @@ Verify required Git evidence exists. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned Git SBOM. +This rule requires Git SBOM. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 184b2ddbc..730c6c077 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Unsigned Git SBOM. +This rule requires Git SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index d5ca12057..ad050230a 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Unsigned Git SBOM. +This rule requires Git SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 06e8a1755..8deea1bfc 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -13,7 +13,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 5388dbb6b..a4e996c05 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -13,7 +13,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 17bff2a39..3742c9e54 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index ce6104031..a6426d4f9 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 0df61bb9b..2ccec5e96 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 598a44431..f17992779 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 387d11035..559ba7ec0 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -13,7 +13,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index b8374ed0a..b32177204 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index d7a4b8121..18cfd66bc 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index c8b8def1f..014622205 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -13,7 +13,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index a83065d5c..c57efbb9f 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index b1b2e7fff..44c819196 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index ba3fd9d15..f6f2b1c2d 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 7f4f01129..501c76dbe 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 7f19d4684..64c516e10 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -14,7 +14,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 0e9116307..05e233c31 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -13,7 +13,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 0ae9d9483..9ab913582 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 61f501e49..2b6d4e6e1 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index ae5b75715..54ce28bc8 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index a1f29b5a2..5aa4c64b5 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 0bd6da2fe..7b48e3e95 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Unsigned Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 25acbb3e9..d6a6ae797 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 5e2f24e7a..944beb018 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -13,7 +13,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 5f2b09a1f..1c1bb4475 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index baed475c5..91e13d186 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 0b7295fd6..fb0fc5d66 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -13,7 +13,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index b450a6877..75a07202a 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -13,7 +13,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index f3cdab8d2..efa95bfa1 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -13,7 +13,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index c8d824d0f..1322b9ffa 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -13,7 +13,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index ebc0b0597..c9b1656d9 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -13,7 +13,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index b9b9d38b5..d3a48a516 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -13,7 +13,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 52c10f180..34d5e5458 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -13,7 +13,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 6963e291b..5d0d47a6e 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 38bbf94a6..4f55ec642 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 8e956334e..33fe7e69e 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -13,7 +13,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 44a595901..7dc385c2e 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -13,7 +13,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 13916e4eb..5a827b9d4 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Unsigned Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 7fd46f0d4..4e04f5f1c 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index d226bf6f9..cf6e8ea7f 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -13,7 +13,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 8fc34d7c5..997c819b2 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 311a99276..68109c141 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -13,7 +13,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index 4d63cebdd..ed58a7bed 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -13,7 +13,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 305449618..dffbd9d0e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -13,7 +13,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 5d909833b..3b30b1d00 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -13,7 +13,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index ae308b35a..03d318627 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -13,7 +13,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 991ba61b8..fd7740e56 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 0f0a91f7a..e78561b44 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -13,7 +13,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 79fb1a3c5..f7249edc3 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -13,7 +13,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Unsigned Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 9021b26f1..de2c9f78b 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index 5ae0c160c..f5ddcd7c2 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 8f5ea00cb..496142b03 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -13,7 +13,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index f2a1172bd..7f3a539f5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -13,7 +13,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index ba9b83487..3f703d42f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -13,7 +13,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index f74267627..d1ee40d0a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -13,7 +13,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index b47448447..ec9dc8d01 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -13,7 +13,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 5fc6f5173..58d8d416b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -13,7 +13,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 5108ec541..fe37355e6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -13,7 +13,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 2f3fe8876..9ec5efe51 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -13,7 +13,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 10dcc4ab3..13facc004 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -13,7 +13,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index ab9b55924..5395839fa 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -13,7 +13,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 8dd963b6b..1ca7d224e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -13,7 +13,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 2c0a8bba0..b86b69fee 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -13,7 +13,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 913b289f4..5842ccb7f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 1faf603c8..b56373433 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 6b98226ca..04b350b40 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index e158b7cd6..dfe25456d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -13,7 +13,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 82168f002..89a4956f2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -13,7 +13,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 8b7fcf3f1..cb89b22f3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -13,7 +13,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 1cf7d5384..b2b82bf0e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index d5b423a2d..c20e2f791 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -13,7 +13,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 5120eed1e..7830c6619 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -13,7 +13,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index b2e45fc59..c984891b3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -13,7 +13,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 1f0fad062..95f8f0183 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -13,7 +13,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index b9007f6e5..1e356b28b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -13,7 +13,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index b837ffaa9..09e89ce28 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -13,7 +13,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index ec45e3d02..65e03d8fd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -13,7 +13,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 5f746bdf5..fb8ce3529 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -13,7 +13,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 06c292e10..313fa3495 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -13,7 +13,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index c263768b5..752bc59e2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -13,7 +13,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 03811b8b7..fd28986ff 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -13,7 +13,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index cf66fbd12..3a449a811 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -13,7 +13,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 5685bc46c..562dc9948 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -13,7 +13,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index ffb3602a4..652158cb8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 19d5a7dd3..d853587ce 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -13,7 +13,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 72de1e15f..6f02553f2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index c7db738ed..4dd6b1842 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -13,7 +13,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 6e13ce541..c34ae1c54 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -13,7 +13,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 95314a91a..7139dac39 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -13,7 +13,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Unsigned Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 9d28fe302..e55d06a2a 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 541599623..f471fdd5d 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 557511b51..b28f68878 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 83276188e..cf3eb76ab 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 578f4aea7..b7061fafe 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index fe0191872..fcacb7a3f 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index ccdf9fc9a..03c1d5170 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 6e11c1dae..cea67d69b 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 6a6541fea..38f8044c4 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index f964d785b..61a883e35 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index da6b4a867..e54f0fd48 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index db28d8589..0b8b314b1 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index c3f7427ca..c586f71b8 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 87e85c830..679005f59 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 45dadc6e0..8cd486307 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 90ec7eef3..fb5da471e 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -13,7 +13,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Unsigned Jenkins Instance Discovery Evidence. +This rule requires Jenkins Instance Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 5aba3986a..a90ce2599 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -13,7 +13,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Unsigned Jenkins Instance Discovery Evidence. +This rule requires Jenkins Instance Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 947be6cf7..b2dfe847b 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 90f5ab4ae..25a9cd898 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 3c14b93ec..312838915 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 0fe55ce60..889685065 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 8dbea82a7..808417d5d 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 06743a433..8e7d294ea 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index d81477f6a..c4978ab73 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 757b70f2f..fb8600c51 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 03bccf1d9..b3a84e5b7 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires Unsigned Discovery Evidence. +This rule requires Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index d3d72dae1..e16f95590 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -19,6 +19,9 @@ Verify the artifact referenced in the SARIF report is signed to confirm its inte This rule requires Signed SARIF Evidence. ::: :::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index e8c52db75..c3ede736b 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -16,7 +16,10 @@ Verify all required evidence exists as defined by the SARIF policy. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 500f1bb94..4a11e37bc 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index c9b9cbfb5..7d187b33f 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index e5e6fe773..aa38d297f 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 9266bdfd1..64c363569 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 0b4f3befa..d3bccc821 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -19,7 +19,10 @@ the defined severity threshold. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 53d699a78..85cc76ed0 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 19ce02530..442faaf8e 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 8b6e56510..84e8bce5a 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 6ffbe36c3..93d5367dd 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index fbd29c985..031283e65 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 999a6267d..fee0a3c5c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -16,7 +16,10 @@ Verify required tools were used to generate the SARIF report. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned SARIF Evidence. +This rule requires SARIF Evidence. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index f298ed76f..3758c1ca0 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -19,7 +19,7 @@ Checks that: :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index aaae60175..44b98b3bd 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 08aadaa8f..935cc7eec 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -19,6 +19,9 @@ Verify the SBOM is signed. This rule requires Signed SBOM. ::: :::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 1a05cfe53..b630ba4db 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 62c76edf8..864d2bdaa 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Unsigned Image SBOM. +This rule requires Image SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 4c7c2d533..2b620fc3e 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index a91ed9d0a..adf9c16be 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 15280afbb..c5e3e54bd 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -16,7 +16,10 @@ Verify the SBOM exists as evidence. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 87bb1231c..3d98b02db 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 24f1e2978..e44f2f497 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires Unsigned SBOM. +This rule requires SBOM. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index a2c8b5c79..302b38e93 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index bd5cd1fb2..5c9e7ffe5 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 90f271866..a4205039f 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 702c58c48..a89c851a2 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -17,7 +17,10 @@ Verify that the Provenance document evidence exists. > Evidence **IS** required for this rule and will fail if missing. ::: :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 32c9fd8d0..f97a61977 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -20,6 +20,9 @@ Verify the artifact is signed. This rule requires Signed SLSA Provenance. ::: :::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index b267d0888..57a52a3aa 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 0557ab189..2da8e8907 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires Unsigned SLSA Provenance. +This rule requires SLSA Provenance. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index de3fe4a48..5794ded80 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index ec11a54aa..971679dbd 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 62c3d5340..2c0a10621 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 1e952a43a..985c26262 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 8b7d65c2c..fe7af4475 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 1164bdd9b..11a9827b4 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 1a774aa03..7c01e6413 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index a13701d57..210ff5944 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires Unsigned Statement. +This rule requires Statement. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From 1bcd4bd04dae44ebc73cd191bc575d78a4da05b4 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:13:30 +0200 Subject: [PATCH 097/191] tmp gen docsush --- .../initiatives/rules/images/enforce-https-registry.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index fcacb7a3f..652ef8436 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -1,8 +1,8 @@ --- -sidebar_label: 4.2.1 Registry Connection HTTPS -title: 4.2.1 Registry Connection HTTPS +sidebar_label: Registry Connection HTTPS +title: Registry Connection HTTPS --- -# 4.2.1 Registry Connection HTTPS +# Registry Connection HTTPS **Type:** Rule **ID:** `images-registry-https-check` **Uses:** `images/enforce-https-registry@v2/rules` From adfe090e415c9ef41fff323cc231e91c7b2015e5 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:15:14 +0200 Subject: [PATCH 098/191] tmp gen docsush --- docs/configuration/initiatives/rules/sbom/_category_.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/rules/sbom/_category_.json b/docs/configuration/initiatives/rules/sbom/_category_.json index b474ce5da..cdfd70c71 100644 --- a/docs/configuration/initiatives/rules/sbom/_category_.json +++ b/docs/configuration/initiatives/rules/sbom/_category_.json @@ -1,4 +1,4 @@ { - "label": "Sbom", + "label": "SBOM", "position": 1 } \ No newline at end of file From ab7416039d50abc3132aec096aa1dc1d2a1ab998 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:15:58 +0200 Subject: [PATCH 099/191] tmp gen docsush --- docs/configuration/initiatives/rules/sarif/_category_.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/rules/sarif/_category_.json b/docs/configuration/initiatives/rules/sarif/_category_.json index a5d7cee10..1d0527158 100644 --- a/docs/configuration/initiatives/rules/sarif/_category_.json +++ b/docs/configuration/initiatives/rules/sarif/_category_.json @@ -1,4 +1,4 @@ { - "label": "Sarif", + "label": "SARIF", "position": 1 } \ No newline at end of file From a5ff2eacbbd9534f41824d2e687d23f33c1243ba Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:19:22 +0200 Subject: [PATCH 100/191] tmp gen docsush --- docs/configuration/_category_.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/_category_.json b/docs/configuration/_category_.json index edc80b142..61a128126 100644 --- a/docs/configuration/_category_.json +++ b/docs/configuration/_category_.json @@ -1,4 +1,4 @@ { "label": "Configuration", - "position": 1 + "position": 999 } \ No newline at end of file From cf3f4c8280740950b418760d945c951b31c7ff4c Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:20:52 +0200 Subject: [PATCH 101/191] tmp gen docsush --- docs/configuration/initiatives/_category_.json | 2 +- docs/configuration/initiatives/rules/_category_.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index cb94d3950..91373f0a0 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 1 + "position": 888 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/_category_.json b/docs/configuration/initiatives/rules/_category_.json index 03176cc52..46c5e5953 100644 --- a/docs/configuration/initiatives/rules/_category_.json +++ b/docs/configuration/initiatives/rules/_category_.json @@ -1,4 +1,4 @@ { "label": "Rule Configuration", - "position": 2 + "position": 999 } \ No newline at end of file From 698bfac15d2a8d73d02aac1762b0c66d083a1948 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:21:36 +0200 Subject: [PATCH 102/191] tmp gen docsush --- docs/configuration/initiatives/_category_.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/_category_.json b/docs/configuration/initiatives/_category_.json index 91373f0a0..6cd81f819 100644 --- a/docs/configuration/initiatives/_category_.json +++ b/docs/configuration/initiatives/_category_.json @@ -1,4 +1,4 @@ { "label": "Reference: Policies and Configuration Guide", - "position": 888 + "position": 999 } \ No newline at end of file From cde656e4b1f42de719dd2c7de8505f172ec9ab63 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:22:40 +0200 Subject: [PATCH 103/191] tmp gen docsush --- docs/configuration/initiatives/rules/slsa/_category_.json | 2 +- docs/configuration/initiatives/rules/ssdf/_category_.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/slsa/_category_.json b/docs/configuration/initiatives/rules/slsa/_category_.json index 36f7a4e44..da652e8f6 100644 --- a/docs/configuration/initiatives/rules/slsa/_category_.json +++ b/docs/configuration/initiatives/rules/slsa/_category_.json @@ -1,4 +1,4 @@ { - "label": "Slsa", + "label": "SLSA", "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/ssdf/_category_.json b/docs/configuration/initiatives/rules/ssdf/_category_.json index 684da0604..dc1b66dcb 100644 --- a/docs/configuration/initiatives/rules/ssdf/_category_.json +++ b/docs/configuration/initiatives/rules/ssdf/_category_.json @@ -1,4 +1,4 @@ { - "label": "Ssdf", + "label": "SSDF", "position": 1 } \ No newline at end of file From 1117cd732274d1aebe4bc14aaef3e8c2249212fb Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 12 Mar 2025 17:26:49 +0200 Subject: [PATCH 104/191] tmp gen docsush --- .../initiatives/rules/dockerhub/token-expiration.md | 4 ++-- .../initiatives/rules/dockerhub/token-not-used.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 40880dc10..3838ddfac 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Discovery Evidence. +This rule requires Dockerhub Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,5 +29,5 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project | +| labels | - asset_type=project
- platform=dockerhub | diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index c91995f73..ffca962e3 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Discovery Evidence. +This rule requires Dockerhub Project Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,5 +29,5 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project | +| labels | - asset_type=project
- platform=dockerhub | From f1601eaae8f64ca47a8d7139d68ff3e9e8f0b75b Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 12 Mar 2025 17:27:13 +0200 Subject: [PATCH 105/191] small adjustments --- docs/guides/enforcing-sdlc-initiative.md | 96 ++++++++++++------------ 1 file changed, 48 insertions(+), 48 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 44aebcf7f..6c0d2f27f 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -89,7 +89,7 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up Only the rules that are applicable to the target (the `busybox:latest` docker image) were verified. Other rules were disabled automatically, and no result was generated for them. ::: :::info - To verify the whole SSDF initiative, you need to run GitHub discovery. See [platforms discovery](../platforms/overview). + To verify the whole SSDF initiative, you need to run SCM platform discovery. See [platforms discovery](../platforms/overview). ::: ### Running a single rule verification @@ -147,64 +147,64 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule ### Targetless Run - Some of the rules in this catalog can also be run in "targetless" mode, - meaning that the evidence will be looked up based only on the product name, version, and options specified in the rule config. - No target for preliminary analysis is needed. - This is usually helpful for third-party reports, such as security scans and [platform discoveries](../platforms/overview). +Some of the rules in this catalog can also be run in "targetless" mode, +meaning that the evidence will be looked up based only on the product name, version, and options specified in the rule config. +No target for preliminary analysis is needed. +This is usually helpful for third-party reports, such as security scans and [platform discoveries](../platforms/overview). - As an example, let's run `trivy` to create a SARIF report: +As an example, let's run `trivy` to create a SARIF report: - ```bash - trivy image --format sarif --output results.sarif ubuntu:latest - ``` +```bash +trivy image --format sarif --output results.sarif ubuntu:latest +``` - Then, create evidence from this report: +Then, create evidence from this report: - ```bash - valint evidence results.sarif \ - --product-key -- product-version \ - --scribe.client-secret - ``` +```bash +valint evidence results.sarif \ + --product-key -- product-version \ + --scribe.client-secret +``` - Finally, verify the evidence against the rule. Note that we don't need to provide `valint` with the target report: +Finally, verify the evidence against the rule. Note that we don't need to provide `valint` with the target report: - ```bash - valint verify --rule sarif/trivy/verify-trivy-report@v2 \ - --product-key -- product-version \ - --scribe.client-secret - ``` +```bash +valint verify --rule sarif/trivy/verify-trivy-report@v2 \ + --product-key -- product-version \ + --scribe.client-secret +``` - `valint` will use the latest evidence for the specified product name and version that meets the other rule requirements. - In our example, the rule needs an evidence created by the "Trivy Vulnerability Scanner" tool, - so `valint` was able to find it just by this partial context. +`valint` will use the latest evidence for the specified product name and version that meets the other rule requirements. +In our example, the rule needs an evidence created by the "Trivy Vulnerability Scanner" tool, +so `valint` was able to find it just by this partial context. -
+
- Initiative results +Initiative results - ```bash - ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ [default] Control "Default" Evaluation Summary │ - ├────────────────┬──────────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────┬───────────────┤ - │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ - ├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ - │ trivy-report │ Verify Trivy SARIF Report Compliance │ error │ false │ fail │ 113 violations | 0 max allowed │ results.sarif │ - ├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ - │ CONTROL RESULT │ │ │ │ FAIL │ │ │ - └────────────────┴──────────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────┴───────────────┘ - - ┌────────────────────────────────────────────────────────────────────────┐ - │ [client-initiative] Initiative "client-initiative" Evaluation Summary │ - ├───────────────────┬───────────────┬───────────────────────────┬────────┤ - │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ - ├───────────────────┼───────────────┼───────────────────────────┼────────┤ - │ default │ Default │ trivy-report(fail) │ fail │ - ├───────────────────┼───────────────┼───────────────────────────┼────────┤ - │ INITIATIVE RESULT │ │ │ FAIL │ - └───────────────────┴───────────────┴───────────────────────────┴────────┘ - ``` +```bash +┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [default] Control "Default" Evaluation Summary │ +├────────────────┬──────────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────┬───────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ +│ trivy-report │ Verify Trivy SARIF Report Compliance │ error │ false │ fail │ 113 violations | 0 max allowed │ results.sarif │ +├────────────────┼──────────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────┼───────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────┴──────────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────┴───────────────┘ + +┌────────────────────────────────────────────────────────────────────────┐ +│ [client-initiative] Initiative "client-initiative" Evaluation Summary │ +├───────────────────┬───────────────┬───────────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼───────────────┼───────────────────────────┼────────┤ +│ default │ Default │ trivy-report(fail) │ fail │ +├───────────────────┼───────────────┼───────────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴───────────────┴───────────────────────────┴────────┘ +``` -
+
### Whole initiative verification From 94bd8b83c301a91eddef05d4a801b90dc58ce03c Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 12:11:51 +0200 Subject: [PATCH 106/191] test gen docs --- docs/configuration/initiatives/bp1.md | 24 +++++++++---------- .../rules/api/scribe-api-cve-product.md | 1 + .../initiatives/rules/api/scribe-api-cve.md | 1 + .../rules/api/scribe-api-published.md | 1 + .../initiatives/rules/api/scribe-api.md | 1 + .../rules/bitbucket/project/allow-admins.md | 1 + .../rules/bitbucket/project/allow-users.md | 1 + .../bitbucket/project/long-live-tokens.md | 1 + .../bitbucket/repository/allow-admins.md | 1 + .../rules/bitbucket/repository/allow-users.md | 1 + .../bitbucket/repository/branch-protection.md | 1 + .../rules/bitbucket/workspace/allow-admins.md | 1 + .../rules/bitbucket/workspace/allow-users.md | 1 + .../rules/generic/artifact-signed.md | 6 ++--- .../rules/generic/evidence-exists.md | 6 ++--- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 7 +++--- .../rules/git/coding-permissions.md | 3 ++- .../initiatives/rules/git/evidence-exists.md | 6 ++--- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../initiatives/rules/github/_category_.json | 2 +- .../rules/github/api/_category_.json | 2 +- .../rules/github/api/branch-protection.md | 1 + .../rules/github/api/signed-commits-list.md | 1 + .../rules/github/api/signed-commits-range.md | 1 + .../initiatives/rules/github/org/2fa.md | 1 + .../rules/github/org/advanced-security.md | 1 + .../rules/github/org/allow-admins.md | 1 + .../rules/github/org/allow-users.md | 1 + .../rules/github/org/create-private-repos.md | 1 + .../rules/github/org/create-repos.md | 1 + .../rules/github/org/dependabot-alerts.md | 1 + .../github/org/dependabot-security-updates.md | 1 + .../rules/github/org/dependency-graph.md | 1 + .../rules/github/org/max-admins.md | 1 + .../rules/github/org/old-secrets.md | 1 + .../rules/github/org/pp-custom-link.md | 1 + .../rules/github/org/push-protection.md | 1 + .../rules/github/org/repo-visibility.md | 1 + .../rules/github/org/secret-scanning.md | 1 + .../rules/github/org/validity-checks.md | 1 + .../github/repository/branch-protection.md | 1 + .../github/repository/branch-verification.md | 1 + .../rules/github/repository/old-secrets.md | 1 + .../rules/github/repository/visibility.md | 1 + .../rules/gitlab/api/push-rules.md | 1 + .../rules/gitlab/api/signed-commits-list.md | 1 + .../rules/gitlab/api/signed-commits-range.md | 1 + .../rules/gitlab/org/allow-admins.md | 1 + .../rules/gitlab/org/allow-token-scopes.md | 1 + .../rules/gitlab/org/allow-users.md | 1 + .../rules/gitlab/org/blocked-users.md | 1 + .../rules/gitlab/org/expiring-tokens.md | 1 + .../rules/gitlab/org/forbid-token-scopes.md | 1 + .../rules/gitlab/org/inactive-projects.md | 1 + .../rules/gitlab/org/longlive-tokens.md | 1 + .../rules/gitlab/org/max-admins.md | 1 + .../rules/gitlab/org/projects-visibility.md | 1 + .../rules/gitlab/org/unused-tokens.md | 1 + .../gitlab/pipeline/verify-labels-exist.md | 3 ++- .../rules/gitlab/pipeline/verify-labels.md | 3 ++- .../rules/gitlab/project/abandoned-project.md | 1 + .../gitlab/project/approvals-policy-check.md | 1 + .../project/approvers-per-merge-request.md | 1 + .../gitlab/project/author-email-regex.md | 1 + .../rules/gitlab/project/check-cwe.md | 1 + .../gitlab/project/co-approval-required.md | 1 + .../project/commit-author-email-check.md | 1 + .../project/commit-author-name-check.md | 1 + .../gitlab/project/commit-message-check.md | 1 + .../gitlab/project/committer-email-check.md | 1 + .../gitlab/project/committer-name-check.md | 1 + .../gitlab/project/critical-severity-limit.md | 1 + .../project/description-substring-check.md | 1 + .../project/disallowed-banned-approvers.md | 1 + .../gitlab/project/force-push-protection.md | 1 + .../gitlab/project/medium-severity-limit.md | 1 + .../gitlab/project/merge-access-level.md | 1 + .../project/merge-requests-author-approval.md | 1 + ...ge-requests-disable-committers-approval.md | 1 + .../gitlab/project/message-substring-check.md | 1 + .../gitlab/project/protect-ci-secrets.md | 1 + .../rules/gitlab/project/push-access-level.md | 1 + .../project/require-password-to-approve.md | 1 + .../gitlab/project/reset-pprovals-on-push.md | 1 + .../project/selective-code-owner-removals.md | 1 + .../rules/gitlab/project/visibility-check.md | 1 + .../rules/images/allowed-base-image.md | 11 +++++---- .../rules/images/allowed-image-source.md | 11 +++++---- .../initiatives/rules/images/banned-ports.md | 15 +++++++++++- .../initiatives/rules/images/banned-users.md | 3 ++- .../rules/images/blocklist-build-scripts.md | 3 ++- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 3 ++- .../rules/images/fresh-base-image.md | 3 ++- .../initiatives/rules/images/fresh-image.md | 11 +++++---- .../initiatives/rules/images/image-signed.md | 14 ++++++++++- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 11 +++++---- .../initiatives/rules/images/verify-labels.md | 11 +++++---- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 1 + .../rules/k8s/namespace/allowed-images.md | 3 ++- .../rules/k8s/namespace/allowed-registries.md | 3 ++- .../namespace/verify-namespace-duration.md | 3 ++- .../namespace/verify-namespace-termination.md | 3 ++- .../k8s/namespace/white-listed-namespaces.md | 3 ++- .../rules/k8s/namespace/white-listed-pod.md | 3 ++- .../rules/k8s/pods/verify-pod-duration.md | 3 ++- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 3 ++- .../rules/multievidence/files_integrity.md | 3 ++- .../rules/sarif/artifact-signed.md | 7 +++--- .../rules/sarif/evidence-exists.md | 6 ++--- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 3 ++- .../rules/sarif/trivy/blocklist-cve.md | 3 ++- .../sarif/trivy/report-trivy-iac-errors.md | 3 ++- .../rules/sarif/trivy/verify-cve-severity.md | 7 +++--- .../sarif/trivy/verify-trivy-attack-vector.md | 3 ++- .../rules/sarif/trivy/verify-trivy-report.md | 3 ++- .../rules/sarif/verify-attack-vector.md | 3 ++- .../initiatives/rules/sarif/verify-sarif.md | 3 ++- .../rules/sarif/verify-semgrep-report.md | 3 ++- .../rules/sarif/verify-tool-evidence.md | 6 ++--- .../initiatives/rules/sbom/NTIA-compliance.md | 3 ++- .../rules/sbom/allowed-components.md | 3 ++- .../initiatives/rules/sbom/artifact-signed.md | 7 +++--- .../initiatives/rules/sbom/banned-licenses.md | 3 ++- .../rules/sbom/blocklist-packages.md | 3 ++- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 3 ++- .../initiatives/rules/sbom/require-sbom.md | 6 ++--- .../rules/sbom/required-packages.md | 3 ++- .../rules/sbom/verify-huggingface-license.md | 3 ++- .../rules/slsa/banned-builder-deps.md | 3 ++- .../initiatives/rules/slsa/build-time.md | 3 ++- .../initiatives/rules/slsa/field-exists.md | 3 ++- .../rules/slsa/l1-provenance-exists.md | 6 ++--- .../rules/slsa/l2-provenance-authenticated.md | 7 +++--- .../initiatives/rules/slsa/verify-builder.md | 3 ++- .../rules/slsa/verify-byproducts.md | 3 ++- .../initiatives/rules/ssdf/ps-1-2fa.md | 3 ++- .../rules/ssdf/ps-1-branch-protection.md | 3 ++- .../rules/ssdf/ps-1-limit-admins.md | 3 ++- .../rules/ssdf/ps-1-repo-private.md | 3 ++- .../rules/ssdf/ps-1-web-commit-signoff.md | 3 ++- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 3 ++- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 ++-- docs/configuration/initiatives/sp-800-190.md | 24 +++++++++---------- docs/configuration/initiatives/sp-800-53.md | 12 +++++----- docs/configuration/initiatives/ssdf.md | 16 ++++++------- 158 files changed, 314 insertions(+), 161 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 14356dc18..45e99f9e8 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -62,7 +62,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -83,8 +83,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -105,7 +105,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -126,7 +126,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -151,7 +151,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -193,7 +193,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -214,7 +214,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -235,7 +235,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -256,6 +256,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index bc34d09d2..dc7731c5d 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -26,3 +26,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | superset | `{'cve': {'max': 0, 'severity': 6}}` | + diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index f3ccc21c3..30678cfc8 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -37,3 +37,4 @@ Rule is scoped by product and target. | Parameter | Default | |-----------|---------| | superset | `{'cve': {'max': 0, 'severity': 6}}` | + diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index 3b7673ced..7f9b596ce 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -32,3 +32,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | superset | `{'published': None}` | + diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index 4808d0547..ad81d49f1 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -32,3 +32,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | superset | None | + diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 9bdd1db6d..406324ca7 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -34,3 +34,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_admins | [] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 12f049d9b..6b14e246e 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -34,3 +34,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_users | [] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index cfc9b6371..f1ea8252d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -34,3 +34,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_days | 30 | + diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 5820f33b4..b73f73b45 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_admins | [] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 560863cff..874d6c001 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_users | [] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index ec54a105d..29e5b12ef 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | branches | ['main'] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index e9e6d792e..1ff8344c9 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_admins | [] | + diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 8c43e2867..87d9c1544 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_users | [] | + diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 8be36da52..b2b7896c5 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -12,12 +12,12 @@ title: Generic Artifact Signed Verify required evidence is signed. +:::note +This rule requires Signed [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Signed Generic Statement. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 71d534566..54dab6c32 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -12,12 +12,12 @@ title: Required Generic Evidence Exists Verify required evidence exists. +:::note +This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Generic Statement. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 8e5c9ccb5..d5b57bd63 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 73bbd5d62..4a05f972c 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Generic Statement. +This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 92c460c02..dfeaa10c3 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -12,12 +12,12 @@ title: Git Artifact Signed Verify the Git artifact is signed. +:::note +This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Signed Git SBOM. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: @@ -43,3 +43,4 @@ Rule is scoped by product and target. | Parameter | Default | |-----------|---------| | identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index a029fab81..acf3afbb0 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -38,3 +38,4 @@ Rule is scoped by product and target. |-----------|---------| | ids | [] | | files | [] | + diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 917dc07a7..24397eb69 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -12,12 +12,12 @@ title: Required Git Evidence Exists Verify required Git evidence exists. +:::note +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Git SBOM. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 730c6c077..002321cee 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index ad050230a..6fd2542fb 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/_category_.json b/docs/configuration/initiatives/rules/github/_category_.json index b0cc1e8af..174a64f21 100644 --- a/docs/configuration/initiatives/rules/github/_category_.json +++ b/docs/configuration/initiatives/rules/github/_category_.json @@ -1,4 +1,4 @@ { - "label": "Github", + "label": "GitHub", "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/github/api/_category_.json b/docs/configuration/initiatives/rules/github/api/_category_.json index 60c66511c..e753985fa 100644 --- a/docs/configuration/initiatives/rules/github/api/_category_.json +++ b/docs/configuration/initiatives/rules/github/api/_category_.json @@ -1,4 +1,4 @@ { - "label": "Github API", + "label": "GitHub API", "position": 1 } \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index df970d8ae..e0b2d2e0a 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -27,3 +27,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | repo | `{{ .Args.Repo }}` | | branch | `{{ .Args.Branch }}` | | branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` | + diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 5d1b10243..498569af5 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -26,3 +26,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | access_token | | | owner | | | repo | | + diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index 63421e471..5ef9ddcab 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -28,3 +28,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | since | None | | until | None | | sha | None | + diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 8deea1bfc..5eda39198 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -55,3 +55,4 @@ layer of security against unauthorized access. | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index a4e996c05..57cee45e4 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 3742c9e54..2736fa0fd 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_admins | [] | + diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index a6426d4f9..93e85754a 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_users | [] | + diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 2ccec5e96..eaabeb5df 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | True | + diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index f17992779..e40a0fc0b 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 559ba7ec0..273891728 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 18cfd66bc..ab4a596ca 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 014622205..a05490a54 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index c57efbb9f..a6883d4e0 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_admins | 0 | + diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 44c819196..ac6ba4db7 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_secret_age | 12 | + diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index f6f2b1c2d..7885e1cef 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 64c516e10..b0ccc2510 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | True | + diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 05e233c31..be53e401a 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_repo_names | [] | + diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 2b6d4e6e1..3e5071862 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 5aa4c64b5..de2578f95 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index d6a6ae797..7cbb7b726 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | desired_protected | True | | branches | ['main', 'master'] | + diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 944beb018..c0232ca9d 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | desired_verified | False | + diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index c9b1656d9..8098387ae 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_secret_age | 12 | + diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 7dc385c2e..1b42ba1ec 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_repo_names | [] | + diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 5f884da8a..0775d11ca 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -25,3 +25,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | api_token | `{{ .Args.Token }}` | | project | `{{ .Args.Project }}` | | push_rule | `{'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None}` | + diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 8fcabb683..14681c39d 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -25,3 +25,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | commit_id_list | [] | | private_token | | | project_id | | + diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index c20f33bf6..cfbac0ea1 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -26,3 +26,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | until | | | project_id | | | private_token | | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 4e04f5f1c..9c8f1d359 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_admins | [] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index cf6e8ea7f..7e068f2df 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_token_scopes | ['api', 'read_api', 'read_repository', 'read_registry'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 997c819b2..211c9fbac 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_users | [] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 68109c141..b749c7fe6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | blocked_users | [] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index ed58a7bed..46440fb45 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | exiring_in_days | 30 | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index dffbd9d0e..4ad5f6292 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | project_scopes | ['write_api', 'write_repository'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 3b30b1d00..4058355ad 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | inactive_for_days | 90 | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 03d318627..43c55eba9 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | exiring_in_days | 365 | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index fd7740e56..768eaf342 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_admins | 0 | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index e78561b44..c2ac1f5b9 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_public | ['Learn GitLab', 'Scribe Gitlab Test'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index f7249edc3..30936ae98 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | unused_for_days | 90 | + diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index de2c9f78b..881abb840 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | labels | ['app.kubernetes.io/instance'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index f5ddcd7c2..fe866adad 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | labels | `{'app.kubernetes.io/instance': 'defaul1t'}` | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 496142b03..d273fb71b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | inactive_for_days | 30 | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 7f3a539f5..c406be23c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | name | All Members | | approvals_required_min | 2 | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 3f703d42f..b2b2385e6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | disable_overriding_approvers_per_merge_request | False | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index d1ee40d0a..a91734621 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | author_email_regex | | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index ec9dc8d01..0d034d1f1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | cwe_value | 89 | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index fe37355e6..0befebd2e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | branch | main | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 9ec5efe51..f4905465a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_authors | ['mail@example.com'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 13facc004..b33750fe0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_authors | ['examplename'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 1ca7d224e..607ee95b3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | commit_message_regex | .*JIRA-\d+.* | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 5842ccb7f..ced8323c1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_committers | ['mail@example.com'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index b56373433..46132c432 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_committers | ['somename'] | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 04b350b40..14ed65a3e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_allowed_vulnerability_count | 0 | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index dfe25456d..e6cdeaf9e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | pattern | (?i)insdput | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 89a4956f2..ff15dff93 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | banned_list | [] | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index cb89b22f3..6242517bd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | branch | main | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index b2b82bf0e..76eb0cb21 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_allowed_specific_severity | 0 | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 7830c6619..55b310bbd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | branch | main | | access_level_description | Maintainers | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index c984891b3..29f919741 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | merge_requests_author_approval | True | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 95f8f0183..fd7faa56c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | merge_requests_disable_committers_approval | False | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 1e356b28b..09642db8e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | pattern | (?i)dghd | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 65e03d8fd..400affd97 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | pattern | (?i)(token|secret) | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index fb8ce3529..23fb7915a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | branch | main | | access_level_description | Maintainers | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index fd28986ff..82d07759d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | require_password_to_approve | True | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 562dc9948..b19b1c0b0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | reset_approvals_on_push | True | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index c34ae1c54..69cdb4882 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | selective_code_owner_removals | True | + diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 7139dac39..39f8550ad 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | visibility | private | + diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index e55d06a2a..f9575e44c 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -56,7 +56,8 @@ is found, a violation is recorded indicating that the necessary base image infor | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| approved_sources | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| approved_sources | list | False | A list of approved base image pattern. | + diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index f471fdd5d..581f158df 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -53,7 +53,8 @@ The matching is performed using a case-insensitive, anchored regex. | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| approved_sources | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| approved_sources | list | False | A list of approved Image source patterns. | + diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index b28f68878..d3b675be8 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,19 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). + +**Input Example:** + +```yaml +- uses: images/banned-ports@v2/rules + with: + banned_ports: + - port: "3000" + protocol: "tcp" + - port: "8080" + protocol: "tcp" +``` ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -60,3 +72,4 @@ It performs the following steps: | Parameter | Default | |-----------|---------| | banned_ports | [] | + diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index cf3eb76ab..e390fb456 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -56,3 +56,4 @@ a violation is recorded. | Parameter | Default | |-----------|---------| | users | ['root'] | + diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index b7061fafe..2f725d6ff 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -44,3 +44,4 @@ If a match is found, the rule generates a violation indicating that a disallowed | Parameter | Default | |-----------|---------| | blocklist | [] | + diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 652ef8436..ab97c3334 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 03c1d5170..7524abdee 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -53,3 +53,4 @@ The extracted size is then converted to a numeric value and compared against the | Parameter | Default | |-----------|---------| | max_size | 77819980 | + diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index cea67d69b..ec569c467 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -54,3 +54,4 @@ If any base image is older than the allowed age, or if no base image data is fou | Parameter | Default | |-----------|---------| | max_days | 183 | + diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 38f8044c4..79255340d 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -50,7 +50,8 @@ the rule flags the image as too old and generates a violation with details on th | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 183 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | True | The maximum allowed age of the image in days. | + diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 61a883e35..8e6159148 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,18 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). + +**Input Example:** + +```yaml +- uses: images/image-signed@v2/rules + identity: + emails: + - bob@company.com + - alice@company.com + +``` ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -57,3 +68,4 @@ for images that do not require a signature. Otherwise, if the evidence does not |-----------|---------| | skip_image_regex | ['.*alpine.*'] | | identity | `{'emails': [], 'common-names': []}` | + diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index e54f0fd48..178b85b54 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 0b8b314b1..f21003fb8 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index c586f71b8..b67636ef8 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -49,7 +49,8 @@ This rule checks the CycloneDX SBOM evidence for the container image to verify t | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | list | False | A list of required labels. | + diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 679005f59..626705175 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -49,7 +49,8 @@ required label (as defined in the `with.labels` parameter) exists with the corre | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | list | False | A list of required labels. | + diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 8cd486307..5edac9331 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index fb5da471e..1cb8ce014 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -34,3 +34,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | inactive_for_days | 90 | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index b2dfe847b..9b553db04 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | images_to_include | [] | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 25a9cd898..aad2ce45a 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | allowed_registries | [] | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 312838915..7c1bdff20 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | threshold_date | 1970-01-01T00:00:00Z | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 889685065..020791e50 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | namespaces | ['.*'] | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 808417d5d..bc3ec2e17 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | namespaces | [] | + diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 8e7d294ea..9c747e710 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | white_listed_pod | [] | | verify_namespaces | ['.*'] | + diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index c4978ab73..d08e197d5 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | max_days | 30 | + diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index fb8600c51..f24cee5c9 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index b3a84e5b7..ce82f0598 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires Discovery Evidence. +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,3 +36,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | white_listed_pod | [] | | verify_namespaces | ['.*'] | + diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 15420aa97..5ab67284d 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. +This rule requires Signed [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS** required by default. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | | path_prefix | pkg:file/ | + diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index e16f95590..476af7694 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -12,12 +12,12 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. +:::note +This rule requires Signed [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Signed SARIF Evidence. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: @@ -57,3 +57,4 @@ Additionally, the rule validates that the signature corresponds to one of the ex | Parameter | Default | |-----------|---------| | identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index c3ede736b..0af116e31 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -12,12 +12,12 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. +:::note +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires SARIF Evidence. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 4a11e37bc..7d6604086 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 7d187b33f..e33e46368 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -51,3 +51,4 @@ Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vu | Parameter | Default | |-----------|---------| | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index aa38d297f..a829db854 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -61,3 +61,4 @@ the rule ID, severity (extracted from the rule’s properties), and the location |-----------|---------| | rule_ids | [] | | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 64c363569..726ac4677 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -54,3 +54,4 @@ Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Tr | Parameter | Default | |-----------|---------| | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index d3bccc821..1b1c4cf68 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -15,12 +15,12 @@ Verifies that vulnerability findings in the SARIF evidence from Trivy do not exc the defined severity threshold. +:::note +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires SARIF Evidence. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: @@ -66,3 +66,4 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola | Parameter | Default | |-----------|---------| | severity_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 85cc76ed0..0a155df95 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -37,3 +37,4 @@ Rule is scoped by product. |-----------|---------| | attack_vectors | [] | | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 442faaf8e..eaa5df0e3 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -63,3 +63,4 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola | rule_ids | [] | | ignore | [] | | max_allowed | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 84e8bce5a..0b07d71b2 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -60,3 +60,4 @@ associated with specific attack vectors are properly identified. The rule works |-----------|---------| | attack_vectors | [] | | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 93d5367dd..936899fcf 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -62,3 +62,4 @@ severity, and the corresponding location in the artifact. | rule_ids | [] | | ignore | [] | | max_allowed | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 031283e65..99cf5fb32 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -57,3 +57,4 @@ Each violation includes details such as the rule identifier, the extracted sever |-----------|---------| | rule_ids | [] | | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index fee0a3c5c..76b204fba 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -12,12 +12,12 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. +:::note +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires SARIF Evidence. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 3758c1ca0..d338da895 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -19,7 +19,7 @@ Checks that: :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -43,3 +43,4 @@ Rule is scoped by product and target. |-----------|---------| | required_author | `{}` | | required_supplier | `{}` | + diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 44b98b3bd..45057c907 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -37,3 +37,4 @@ Rule is scoped by product and target. |-----------|---------| | types | ['library', 'operating-system'] | | allowlist | [] | + diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 935cc7eec..f2763d75b 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -12,12 +12,12 @@ title: Require SBOM Signature Verify the SBOM is signed. +:::note +This rule requires Signed [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Signed SBOM. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: @@ -42,3 +42,4 @@ Rule is scoped by product and target. | Parameter | Default | |-----------|---------| | identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index b630ba4db..87203f4c9 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -37,3 +37,4 @@ Rule is scoped by product and target. |-----------|---------| | blocklist | [] | | blocklisted_limit | 0 | + diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 864d2bdaa..1c5aee362 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -38,3 +38,4 @@ Rule is scoped by product and target. |-----------|---------| | blocklist | [] | | blocklisted_limit | 0 | + diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 2b620fc3e..8419c93a3 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index adf9c16be..0c2a3b39f 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,3 +36,4 @@ Rule is scoped by product and target. | Parameter | Default | |-----------|---------| | max_days | 30 | + diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index c5e3e54bd..10c4a27db 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -12,12 +12,12 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. +:::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires SBOM. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 3d98b02db..1eb072f15 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -37,3 +37,4 @@ Rule is scoped by product and target. |-----------|---------| | required_pkgs | [] | | violations_limit | 0 | + diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index e44f2f497..3385214f8 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. +This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,3 +36,4 @@ Rule is scoped by product and target. | Parameter | Default | |-----------|---------| | licenses | [] | + diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 302b38e93..40ac39c7d 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -33,3 +33,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | blocklist | [] | + diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 5c9e7ffe5..0d6fbcced 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | start_hour | 8 | | end_hour | 20 | | workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] | + diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index a4205039f..97de076ff 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -34,3 +34,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl |-----------|---------| | paths | [] | | violations_threshold | 0 | + diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index a89c851a2..f8f226354 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -13,12 +13,12 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. +:::note +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires SLSA Provenance. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index f97a61977..35759aaa9 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -13,12 +13,12 @@ title: Verify that provenance is authenticated Verify the artifact is signed. +:::note +This rule requires Signed [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: -:::note -This rule requires Signed SLSA Provenance. -::: :::tip > Evidence **IS** required for this rule and will fail if missing. ::: @@ -48,3 +48,4 @@ Cryptographic authentication prevents tampering with provenance data, ensuring t | Parameter | Default | |-----------|---------| | identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 57a52a3aa..9e9dffd0c 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -34,3 +34,4 @@ Rule is scoped by pipeline and product. | Parameter | Default | |-----------|---------| | id | `{{ .Env.HOSTNAME }}` | + diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 2da8e8907..9cdb585b4 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -33,3 +33,4 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | Parameter | Default | |-----------|---------| | byproducts | [] | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 5794ded80..4284aa729 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -45,3 +45,4 @@ layer of security against unauthorized access. | Parameter | Default | |-----------|---------| | desired_value | False | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 971679dbd..9afb089b3 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -30,3 +30,4 @@ Enforces branch protection policies to prevent unauthorized commits and maintain | Parameter | Default | |-----------|---------| | desired_protected | True | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 2c0a10621..3f27fbdb1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -30,3 +30,4 @@ Limits the number of administrative accounts, minimizing the potential for abuse | Parameter | Default | |-----------|---------| | max_admins | 3 | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 985c26262..f4176955b 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -30,3 +30,4 @@ Ensures that repositories remain private, reducing the risk of sensitive code be | Parameter | Default | |-----------|---------| | desired_value | True | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index fe7af4475..eee772afb 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -30,3 +30,4 @@ Requires signoff on web commits to ensure that code changes are reviewed and app | Parameter | Default | |-----------|---------| | desired_value | True | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 11a9827b4..4675ce38f 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 7c01e6413..c3225e77a 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,3 +35,4 @@ Archives code changes to maintain a secure, immutable history for auditing and t | short_description | Code is archived. | | description | Since the code is within a repository, it is archived. | | reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. | + diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 210ff5944..c122bb09a 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires Statement. +This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 36d801043..01ef16f39 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -45,4 +45,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 927f60fd5..a9f31f96f 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -45,5 +45,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index cf99c6064..12b060a93 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -48,23 +48,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -81,9 +81,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 8e4fb3962..033b710fc 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -51,10 +51,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -70,7 +70,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -85,5 +85,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index be5c34990..60b72e3b1 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -51,8 +51,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## SSDF-ORG @@ -67,9 +67,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## SSDF-REPO @@ -84,8 +84,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 9210376b4d1bc4755c60715a8c3ada3f43eeebf2 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 12:23:33 +0200 Subject: [PATCH 107/191] test gen docs --- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 2 +- .../rules/git/coding-permissions.md | 2 +- .../initiatives/rules/git/evidence-exists.md | 2 +- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 2 +- .../k8s/namespace/white-listed-namespaces.md | 2 +- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 34 ++++++++++++++++++- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 21 +++++++++++- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- .../rules/slsa/banned-builder-deps.md | 2 +- .../initiatives/rules/slsa/build-time.md | 2 +- .../initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- .../initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- 74 files changed, 125 insertions(+), 74 deletions(-) diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index b2b7896c5..1c07217b9 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -13,7 +13,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires Signed [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 54dab6c32..ed7c0b59a 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index d5b57bd63..adc2f5c52 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 4a05f972c..62de3dec5 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index dfeaa10c3..fb29318b9 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -13,7 +13,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index acf3afbb0..49f182c2e 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 24397eb69..f7f31be3c 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 002321cee..c1d28e97b 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index 6fd2542fb..f978773cf 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 881abb840..70c32ae48 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index fe866adad..e60103a2b 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index f9575e44c..f1207f7c1 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 581f158df..00fdf6223 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index d3b675be8..19e051e20 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index e390fb456..42eb5647b 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 2f725d6ff..db85e6261 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index ab97c3334..ca853f4e3 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 7524abdee..c88744295 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index ec569c467..826a0994c 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 79255340d..9a4b4586f 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 8e6159148..4a850a2a5 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 178b85b54..f3e24b7bc 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index f21003fb8..512e11e3f 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index b67636ef8..c136e7854 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 626705175..807a72503 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 5edac9331..95408d2f6 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 9b553db04..9d6823387 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index aad2ce45a..a128ee6a2 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 7c1bdff20..55400b135 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 020791e50..e1ece90d1 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index bc3ec2e17..d7c64fff5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 9c747e710..217ae89a5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index d08e197d5..21ef2afeb 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index f24cee5c9..0019ab20f 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index ce82f0598..485d59203 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/docs/platforms/discover). +This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 5ab67284d..27e869d1a 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires Signed [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 476af7694..a6bd6c54b 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -13,7 +13,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires Signed [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 0af116e31..3eaef2c56 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -13,7 +13,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 7d6604086..47ad48804 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index e33e46368..14fadf3f0 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index a829db854..da5ef4f78 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 726ac4677..b4375cee5 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 1b1c4cf68..2cc18ad46 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -16,7 +16,7 @@ the defined severity threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 0a155df95..cff527078 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index eaa5df0e3..0c464fd5d 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 0b07d71b2..9d563a929 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 936899fcf..f9248746c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 99cf5fb32..1c6986744 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 76b204fba..6e3ff51e5 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -13,7 +13,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/docs/valint/sarif). +This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index d338da895..f98af3821 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -19,7 +19,7 @@ Checks that: :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 45057c907..7006bfe78 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,20 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type + +**Input Example:** + +```yaml +- uses: sbom/allowed-components@v2/rules + with: + types: + - library + - operating-system +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +38,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components. +It performs the following steps: + +1. Iterates over the components listed in the SBOM. +2. Checks each component's type against the allowed types specified in the `with.types` configuration. +3. Compares each component's name against the allowlist provided in the `with.allowlist` configuration. + - If a component's type or name is not allowed, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of components with their types and names. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index f2763d75b..f57e10646 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -13,7 +13,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires Signed [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 87203f4c9..950e31433 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +25,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses +remains below the specified threshold. It performs the following steps: + +1. Iterates over the components listed in the SBOM. +2. Checks each component's license against the blocklist provided in the `with.blocklist` configuration. +3. Counts the number of components with disallowed licenses. + - If the count exceeds the specified `with.blocklisted_limit`, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of components with their licenses. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 1c5aee362..32f46bb5d 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 8419c93a3..c14cd2521 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 0c2a3b39f..7f4048bbd 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 10c4a27db..0f6c385c5 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -13,7 +13,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 1eb072f15..40806f525 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 3385214f8..b6f8755f1 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/docs/valint/sbom). +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 40ac39c7d..88d953aed 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 0d6fbcced..b0559398b 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 97de076ff..6b137f8ff 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index f8f226354..9674bc2e3 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -14,7 +14,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 35759aaa9..727c8e7b0 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -14,7 +14,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires Signed [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 9e9dffd0c..17ce53121 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 9cdb585b4..3519c403f 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/docs/valint/help/valint_slsa). +This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 4284aa729..265adbc1e 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 9afb089b3..8cde70cb1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 3f27fbdb1..a9922e619 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index f4176955b..2b6068b92 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index eee772afb..e46c57e81 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 4675ce38f..6af44c012 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index c3225e77a..5c906d233 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index c122bb09a..1112259d6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/docs/valint/generic). +This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From 90c754c8b636b3218135f63bd89dc81aa620869e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 12:25:11 +0200 Subject: [PATCH 108/191] test gen docs --- .../initiatives/rules/images/banned-users.md | 8 ++++---- .../initiatives/rules/images/forbid-large-images.md | 8 ++++---- .../initiatives/rules/images/fresh-base-image.md | 8 ++++---- .../initiatives/rules/sbom/allowed-components.md | 10 +++++----- .../initiatives/rules/sbom/banned-licenses.md | 10 +++++----- 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 42eb5647b..72df0f138 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -52,8 +52,8 @@ a violation is recorded. | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| users | ['root'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| users | list | False | A list of disallowed users. Each entry should be a string representing a username. | diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index c88744295..5a53f837a 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -49,8 +49,8 @@ The extracted size is then converted to a numeric value and compared against the | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_size | 77819980 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_size | integer | True | The maximum allowed image size in bytes. | diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 826a0994c..0d318bb37 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -50,8 +50,8 @@ If any base image is older than the allowed age, or if no base image data is fou | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 183 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | True | The maximum allowed age of the base image in days. | diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 7006bfe78..87fe3fec7 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -64,9 +64,9 @@ It performs the following steps: | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| types | ['library', 'operating-system'] | -| allowlist | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| types | list | True | A list of allowed component types. | +| allowlist | list | True | A list of allowed components. | diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 950e31433..cc3ae681b 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -51,9 +51,9 @@ remains below the specified threshold. It performs the following steps: | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocklist | [] | -| blocklisted_limit | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| blocklist | list | False | A list of disallowed licenses. | +| blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. | From 2c279a6ee21cb78bc93b835d01e3eb2225e6a165 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 12:27:54 +0200 Subject: [PATCH 109/191] test gen docs --- .../initiatives/rules/k8s/namespace/allowed-images.md | 4 ++-- .../initiatives/rules/k8s/namespace/allowed-registries.md | 4 ++-- .../rules/k8s/namespace/verify-namespace-duration.md | 4 ++-- .../rules/k8s/namespace/verify-namespace-termination.md | 4 ++-- .../rules/k8s/namespace/white-listed-namespaces.md | 4 ++-- .../initiatives/rules/k8s/namespace/white-listed-pod.md | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 9d6823387..f1f69a819 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index a128ee6a2..2ec560c74 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 55400b135..761e964c5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index e1ece90d1..dc4beae0a 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index d7c64fff5..d2ec75882 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 217ae89a5..79c14111c 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -29,7 +29,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace | +| labels | - asset_type=namespace
- platform=k8s | ## Rule Parameters (`with`) | Parameter | Default | From d4799c97414eefc53328fd5dd9f7d4952b0b3fcd Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 12:29:02 +0200 Subject: [PATCH 110/191] test gen docs --- .../initiatives/rules/images/banned-ports.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 19e051e20..8a00018f5 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -68,8 +68,8 @@ It performs the following steps: | target_type | container | | filter-by | ['target', 'product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| banned_ports | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| banned_ports | list | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. | From 9b4c8a951ba4d12b6422f4eb40067c0de1dfdc6f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 14:10:52 +0200 Subject: [PATCH 111/191] test gen docs --- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 8 +-- .../initiatives/rules/images/image-signed.md | 22 ++++--- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 38 ++++++++++-- .../rules/k8s/namespace/allowed-registries.md | 36 +++++++++-- .../namespace/verify-namespace-duration.md | 34 ++++++++-- .../k8s/namespace/white-listed-namespaces.md | 39 ++++++++++-- .../rules/k8s/namespace/white-listed-pod.md | 40 ++++++++++-- .../rules/k8s/pods/verify-pod-duration.md | 38 ++++++++++-- .../rules/k8s/pods/verify-pod-termination.md | 20 +++++- .../rules/k8s/pods/white-listed-pod.md | 44 ++++++++++--- .../rules/sarif/artifact-signed.md | 5 -- .../rules/sarif/report-iac-errors.md | 8 +-- .../rules/sarif/trivy/blocklist-cve.md | 10 +-- .../sarif/trivy/report-trivy-iac-errors.md | 8 +-- .../rules/sarif/trivy/verify-cve-severity.md | 8 +-- .../sarif/trivy/verify-trivy-attack-vector.md | 10 +-- .../rules/sarif/trivy/verify-trivy-report.md | 16 ++--- .../rules/sarif/verify-attack-vector.md | 10 +-- .../initiatives/rules/sarif/verify-sarif.md | 16 ++--- .../rules/sarif/verify-semgrep-report.md | 13 ++-- .../initiatives/rules/sbom/NTIA-compliance.md | 62 +++++++++++++++---- .../rules/sbom/allowed-components.md | 6 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 4 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 20 +++++- .../initiatives/rules/sbom/fresh-sbom.md | 39 ++++++++++-- .../initiatives/rules/sbom/require-sbom.md | 18 +++++- .../rules/sbom/required-packages.md | 44 +++++++++++-- .../rules/sbom/verify-huggingface-license.md | 43 +++++++++++-- 36 files changed, 530 insertions(+), 145 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index f1207f7c1..d2ba6f4c1 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -59,5 +59,5 @@ is found, a violation is recorded indicating that the necessary base image infor ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| approved_sources | list | False | A list of approved base image pattern. | +| approved_sources | array | False | A list of approved base image pattern. | diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 00fdf6223..52bc01611 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -56,5 +56,5 @@ The matching is performed using a case-insensitive, anchored regex. ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| approved_sources | list | False | A list of approved Image source patterns. | +| approved_sources | array | False | A list of approved Image source patterns. | diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 8a00018f5..2ba35447f 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -71,5 +71,5 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| banned_ports | list | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. | +| banned_ports | array | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. | diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 72df0f138..9ad6c8f89 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -55,5 +55,5 @@ a violation is recorded. ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| users | list | False | A list of disallowed users. Each entry should be a string representing a username. | +| users | array | False | A list of disallowed users. Each entry should be a string representing a username. | diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index db85e6261..19559c7e1 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -40,8 +40,8 @@ If a match is found, the rule generates a violation indicating that a disallowed | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocklist | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| blocklist | array | False | A list of disallowed build script commands. Each entry should be a string representing a command or substring. | diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 4a850a2a5..c3d2b246a 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -20,11 +20,13 @@ This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/ ```yaml - uses: images/image-signed@v2/rules - identity: - emails: - - bob@company.com - - alice@company.com - + with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* ``` ::: :::tip @@ -63,9 +65,9 @@ for images that do not require a signature. Otherwise, if the evidence does not | filter-by | ['product', 'target'] | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| skip_image_regex | ['.*alpine.*'] | -| identity | `{'emails': [], 'common-names': []}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| identity | object | False | Identity information for the signers | +| skip_image_regex | array | False | Patterns to bypass the signature requirement for certain images | diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index c136e7854..1c7aea3bc 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -52,5 +52,5 @@ This rule checks the CycloneDX SBOM evidence for the container image to verify t ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| labels | list | False | A list of required labels. | +| labels | array | False | A list of required labels. | diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 807a72503..03d3ea175 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -52,5 +52,5 @@ required label (as defined in the `with.labels` parameter) exists with the corre ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| labels | list | False | A list of required labels. | +| labels | array | False | A list of required labels. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index f1f69a819..d20360c9e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -14,6 +14,20 @@ Verify only container images specified in the Allowed List run within the Kubern :::note This rule requires K8s Namespace Discovery Evidence. + +**Input** +`images_to_include` is a list of image repository names. + +**Input Example:** + +```yaml +- uses: k8s/namespace/allowed-images@v2/rules + with: + images_to_include: + - docker.io/my_org/my_image1 + - docker.io/my_org/my_image2 +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +36,22 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. + + +## Description +This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the container images running in the namespace. +2. Checks each image against the allowed list specified in the `with.images_to_include` configuration. + - If an image is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +61,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| images_to_include | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| images_to_include | array | False | List of allowed container images. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 2ec560c74..804fd20aa 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -14,6 +14,17 @@ Verify container images in Kubernetes namespaces originate from registries in th :::note This rule requires K8s Namespace Discovery Evidence. + +**Input Example:** + +```yaml +- uses: k8s/namespace/allowed-registries@v2/rules + with: + allowed_registries: + - docker.io/* + - gcr.io/* +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +33,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. + + + +## Description +This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the container images running in the namespace. +2. Checks each image's registry against the allowed registries specified in the `with.allowed_registries` configuration. + - If an image's registry is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +59,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_registries | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_registries | array | False | A list of allowed container registries Regex patterns. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 761e964c5..1fdf927ef 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -14,6 +14,15 @@ Verify Kubernetes namespaces adhere to a specified runtime duration to enforce l :::note This rule requires K8s Namespace Discovery Evidence. + +**Input Example:** + +```yaml +- uses: k8s/namespace/verify-namespace-duration@v2/rules + with: + threshold_date: "1970-01-01T00:00:00Z" +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +31,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. + + + +## Description +This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit. +It performs the following steps: + +1. Iterates over the namespaces in the cluster. +2. Checks each namespace's duration against the limit specified in the `with.threshold_date` configuration. + - If a namespace's duration exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +57,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| threshold_date | 1970-01-01T00:00:00Z | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| threshold_date | string | False | The threshold date for namespace duration (supports regex). | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index d2ec75882..c52086a7b 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -14,6 +14,20 @@ Verify only namespaces specified in the Allowed List are allowed within the clus :::note This rule requires K8s Namespace Discovery Evidence. + +**Input** +`namespaces` is a list of allowed namespaces. + +**Input Example:** + +```yaml +- uses: k8s/namespace/white-listed-namespaces@v2/rules + with: + namespaces: + - default + - kube-system +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +36,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces. + + + +## Description +This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster. +It performs the following steps: + +1. Iterates over the namespaces in the cluster. +2. Checks each namespace against the whitelist specified in the `with.namespaces` configuration. + - If a namespace is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +62,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| namespaces | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| namespaces | array | True | A list of allowed namespaces. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 79c14111c..5ef0bac76 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -14,6 +14,20 @@ Verify only pods explicitly listed in the Allowed List run within a Kubernetes n :::note This rule requires K8s Namespace Discovery Evidence. + +**Input** +`white_listed_pod` is a list of allowed pods. + +**Input Example:** + +```yaml +- uses: k8s/namespace/white-listed-pod@v2/rules + with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +36,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods. + + + +## Description +This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the pods in the namespace. +2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. + - If a pod is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,9 +62,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| white_listed_pod | [] | -| verify_namespaces | ['.*'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| white_listed_pod | array | True | A list of allowed pods (supports regex). | diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 21ef2afeb..6fd24b9f3 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,16 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Pod Discovery Evidence. + +**Input Example:** + +```yaml +- uses: k8s/pods/verify-pod-duration@v2/rules + with: + max_days: 10 +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +31,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. + + + +## Description +This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit. +It performs the following steps: + +1. Iterates over the pods in the cluster. +2. Checks each pod's duration against the limit specified in the `with.max_days` configuration. + - If a pod's duration exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -29,10 +55,10 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod | +| labels | - asset_type=pod
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 30 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | False | The maximum allowed duration for pods in days. | diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 0019ab20f..90afee0b6 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Pod Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +22,22 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. + + + +## Description +This rule verifies that pods in Kubernetes are terminated properly within the specified time frame. +It performs the following steps: + +1. Iterates over the pods marked for termination in the cluster. +2. Checks each pod's termination status is present, if such a status is present, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -29,5 +45,5 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod | +| labels | - asset_type=pod
- platform=k8s | diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 485d59203..a7b212653 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,20 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires K8s Pod Discovery Evidence. + +**Input Example:** + +```yaml +- uses: k8s/pods/white-listed-pod@v2/rules + with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* + verify_namespaces: + - ".*" +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +35,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods. + + + +## Description +This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster. +It performs the following steps: + +1. Iterates over the pods in the cluster. +2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. + - If a pod is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -29,11 +59,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | content_body_type | generic | | target_type | data | | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod | +| labels | - asset_type=pod
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| white_listed_pod | [] | -| verify_namespaces | ['.*'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| white_listed_pod | array | True | A list of allowed pods (supports regex). | +| verify_namespaces | array | True | A list of namespaces to verify (supports regex). | diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index a6bd6c54b..7567b9186 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -53,8 +53,3 @@ Additionally, the rule validates that the signature corresponds to one of the ex | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| identity | `{'common-names': [], 'emails': []}` | - diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 14fadf3f0..1c5436001 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -47,8 +47,8 @@ Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vu | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index da5ef4f78..ed2ef745e 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -56,9 +56,9 @@ the rule ID, severity (extracted from the rule’s properties), and the location | tool | Trivy Vulnerability Scanner | | filter-by | ['product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| rule_ids | [] | -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_ids | array | False | List of CVE identifiers to check for in the Trivy SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed violations. | diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index b4375cee5..09bbace70 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -50,8 +50,8 @@ Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Tr | tool | Trivy Vulnerability Scanner | | filter-by | ['product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 2cc18ad46..c13ba8ee9 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -62,8 +62,8 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola | tool | Trivy Vulnerability Scanner | | filter-by | ['product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| severity_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| severity_threshold | integer | True | The maximum severity level allowed for vulnerabilities. | diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index cff527078..6f028541e 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -32,9 +32,9 @@ Rule is scoped by product. | tool | Trivy Vulnerability Scanner | | filter-by | ['product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| attack_vectors | [] | -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| attack_vectors | array | False | List of attack vectors to check for in the Trivy SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed attack vector violations in the Trivy SARIF report. | diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 0c464fd5d..e83fa8d8a 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -55,12 +55,12 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola | tool | Trivy Vulnerability Scanner | | filter-by | ['product'] | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| rule_level | [] | -| precision | [] | -| rule_ids | [] | -| ignore | [] | -| max_allowed | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the Trivy SARIF report. | +| precision | array | False | List of precision levels to check for in the Trivy SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the Trivy SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the Trivy SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 9d563a929..9b92a0ed0 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -55,9 +55,9 @@ associated with specific attack vectors are properly identified. The rule works | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| attack_vectors | [] | -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| attack_vectors | array | False | List of attack vectors to check for in the SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed attack vector violations. | diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index f9248746c..9d71c499c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -54,12 +54,12 @@ severity, and the corresponding location in the artifact. | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| rule_level | [] | -| precision | [] | -| rule_ids | [] | -| ignore | [] | -| max_allowed | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the SARIF report. | +| precision | array | False | List of precision levels to check for in the SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 1c6986744..b1caba364 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -52,9 +52,12 @@ Each violation includes details such as the rule identifier, the extracted sever | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| rule_ids | [] | -| violations_threshold | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the SARIF report. | +| precision | array | False | List of precision levels to check for in the SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index f98af3821..db8fa316b 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -8,18 +8,39 @@ title: NTIA SBOM Compliance Check **Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) -**Labels:** SBOM, Compliance +**Labels:** SBOM, Compliance, Image, Source Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. -Checks that: - 1) Authors exist, are non-empty, and each author has both a name and email. - 2) Supplier exists with non-empty name, url, and contact. At least one contact has non-empty email. - 3) Optionally enforces a required author (case-insensitive match for name/email). - 4) Optionally enforces a required supplier (case-insensitive match for supplier name). :::note This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. + +For example, +```yaml +valint bom my_company/my_image:latest \ + --author-name "bob" \ + --author-email bob@my_company.com \ + --author-phone "123-456-7890" \ + --supplier-email bob@my_company.com \ + --author-email "bob@my_company.com" --supplier-name "alice" \ + --supplier-url "https://my_company.com" --supplier-phone "123-456-7890" +``` + +**Input Example:** + +```yaml +- uses: sbom/NTIA-compliance@v2/rules + with: + required_author: + name: "bom" + email: "bob@company.com" + required_supplier: + name: "alice" +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -31,6 +52,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers. + + + +## Description +This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers. +It performs the following steps: + +1. Checks that authors exist, are non-empty, and each author has both a name and email. +2. Checks that the supplier exists with a non-empty name, URL, and contact. At least one contact must have a non-empty email. +3. Optionally enforces a required author (case-insensitive match for name/email). +4. Optionally enforces a required supplier (case-insensitive match for supplier name). + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include metadata for authors and suppliers. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -38,9 +78,9 @@ Rule is scoped by product and target. | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| required_author | `{}` | -| required_supplier | `{}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| required_author | object | False | The required author (case-insensitive match for name/email). | +| required_supplier | object | False | The required supplier (case-insensitive match for supplier name). | diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 87fe3fec7..4bd8708aa 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -8,7 +8,7 @@ title: Enforce Allowed SBOM Components **Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image +**Labels:** SBOM, Image, Source Verify the artifact contains only allowed components. @@ -67,6 +67,6 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| types | list | True | A list of allowed component types. | -| allowlist | list | True | A list of allowed components. | +| types | array | True | A list of allowed component types. | +| allowlist | array | True | A list of allowed components. | diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index f57e10646..d2dcdb4de 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -8,7 +8,7 @@ title: Require SBOM Signature **Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint +**Labels:** SBOM, Blueprint, Source Verify the SBOM is signed. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index cc3ae681b..d93594454 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -8,7 +8,7 @@ title: Restrict Disallowed SBOM Licenses **Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image +**Labels:** SBOM, Image, Source Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. @@ -54,6 +54,6 @@ remains below the specified threshold. It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| blocklist | list | False | A list of disallowed licenses. | +| blocklist | array | False | A list of disallowed licenses. | | blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. | diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 32f46bb5d..2f6539121 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -8,7 +8,7 @@ title: Restrict Disallowed Dependencies **Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint +**Labels:** SBOM, Image, Blueprint, Source Verify the number of disallowed dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index c14cd2521..fc187ad9a 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -8,7 +8,7 @@ title: Enforce SBOM License Completeness **Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image +**Labels:** SBOM, Image, Source Verify all dependencies in the artifact have a license. @@ -25,6 +25,24 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency for the presence of a license. + - If a dependency does not have a license, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies with their licenses. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 7f4048bbd..74b4159ef 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -8,12 +8,23 @@ title: Enforce SBOM Freshness **Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM +**Labels:** SBOM, Image, Source Verify the SBOM is not older than the specified duration. :::note This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +Ensure that the SBOM includes a creation date to verify its freshness. + +**Input Example:** + +```yaml +- uses: sbom/fresh-sbom@v2/rules + with: + max_days: 30 +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +36,24 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration. +It performs the following steps: + +1. Checks the creation date of the SBOM. +2. Compares the creation date against the maximum allowed age specified in the `with.max_days` configuration. + - If the SBOM is older than the allowed duration, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a creation date. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -32,8 +61,8 @@ Rule is scoped by product and target. | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 30 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | False | The maximum allowed age of the SBOM in days. | diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 0f6c385c5..a300f3ea8 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -8,7 +8,7 @@ title: Require SBOM Existence **Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) -**Labels:** SBOM, Blueprint +**Labels:** SBOM, Blueprint, Image, Source Verify the SBOM exists as evidence. @@ -31,6 +31,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies. + + + +## Description +This rule verifies the existence of an SBOM as evidence. +It performs the following steps: + +1. Checks for the presence of an SBOM. + - If the SBOM is missing, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 40806f525..221e5a242 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -10,10 +10,24 @@ title: Enforce SBOM Dependencies **Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) **Labels:** SBOM, Image -Verify the artifact includes all required dependencies. +Verify the artifact includes all required dependencies specified as a list of PURLs. :::note This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +Ensure that the SBOM includes all required dependencies to meet compliance requirements. + +**Input Example:** + +```yaml +- uses: sbom/required-packages@v2/rules + with: + required_pkgs: + - "pkg:maven/org.apache.commons/commons-lang3@3.9" + - "pkg:npm/lodash@4.17.15" + violations_limit: 0 +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +39,24 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements. + + + +## Description +This rule verifies that the artifact includes all required dependencies as specified. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency against the required dependencies specified in the `with.required_pkgs` configuration. + - If a required dependency is missing, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -32,9 +64,9 @@ Rule is scoped by product and target. | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| required_pkgs | [] | -| violations_limit | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| required_pkgs | array | True | A list of required dependencies specified as PURLs. | +| violations_limit | integer | False | The maximum number of allowed violations. | diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index b6f8755f1..1e7f7fd1a 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -8,12 +8,26 @@ title: Require Specified SBOM Licenses **Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image +**Labels:** SBOM, Image, Source Verify the artifact includes all specified licenses. :::note This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +Ensure that the SBOM includes all specified licenses to meet compliance requirements. +This rule accesses the Hugging Face API to validate the licenses. + +**Input Example:** + +```yaml +- uses: sbom/verify-huggingface-license@v2/rules + with: + licenses: + - "MIT" + - "Apache-2.0" +``` + ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +39,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses. + + + +## Description +This rule verifies that the artifact includes all specified licenses. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency for the presence of the specified licenses in the `with.licenses` configuration. + - If a specified license is missing, the rule flags it as a violation. +3. Accesses the Hugging Face API to validate the licenses. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies with their licenses. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -32,8 +65,8 @@ Rule is scoped by product and target. | signed | False | | content_body_type | cyclonedx-json | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| licenses | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| licenses | array | True | A list of specified licenses. | From d0c608d8c86ce3c159b165b9f77258d3bae3bc30 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 14:53:20 +0200 Subject: [PATCH 112/191] test gen docs --- .../initiatives/rules/api/scribe-api-cve.md | 12 +++++--- .../rules/api/scribe-api-published.md | 16 +++++++--- .../rules/dockerhub/token-expiration.md | 16 ++++++++++ .../rules/dockerhub/token-not-used.md | 10 +++++++ .../initiatives/rules/git/artifact-signed.md | 19 +++++++++++- .../rules/git/coding-permissions.md | 29 +++++++++++++++---- .../initiatives/rules/git/evidence-exists.md | 7 ++++- .../rules/git/no-commit-to-main.md | 18 +++++++++++- .../rules/git/no-unsigned-commits.md | 17 +++++++++++ .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- 18 files changed, 137 insertions(+), 25 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 30678cfc8..135c32e63 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -25,6 +25,10 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Regularly scan the target artifact for vulnerabilities to ensure that it remains secure. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -33,8 +37,8 @@ Rule is scoped by product and target. | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| superset | `{'cve': {'max': 0, 'severity': 6}}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| superset | object | False | The superset of CVEs to check for, including the following format {cve: {max: , severity: }} | diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 3838ddfac..9ad8f4a85 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -22,6 +22,22 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. + + +## Description +This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's status against the Active status. + - If a token's status is not Active, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index ffca962e3..804cb1bbc 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -22,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Description +This rule verifies that there are no unused Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's last_used is null , the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index fb29318b9..348cb4ea8 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -8,12 +8,25 @@ title: Git Artifact Signed **Uses:** `git/artifact-signed@v2/rules` **Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify the Git artifact is signed. :::note This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). + +**Input Example:** + ```yaml +- uses: git/artifact-signed@v2/rules + with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* +``` + ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -31,6 +44,10 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Ensures that only Git artifacts with valid cryptographic signatures are deployed prevents source code tampering. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 49f182c2e..55f3e3ea8 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -25,6 +25,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Prevent unauthorized users from committing to the repository by restricting coding permissions. + + + +## Description +This rule verifies that only allowed users have committed to the repository. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. Checks each commit's author against the list of allowed user IDs. + - If a commit's author is not in the allowed list, the rule flags it as a violation. +3. Checks each committed file against the list of allowed files. + - If a committed file is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -33,9 +52,9 @@ Rule is scoped by product and target. | content_body_type | cyclonedx-json | | target_type | git | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| ids | [] | -| files | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. | +| files | array | False | The list of files that are allowed to be committed to the repository. | diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index f7f31be3c..08c1a4013 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -8,7 +8,7 @@ title: Required Git Evidence Exists **Uses:** `git/evidence-exists@v2/rules` **Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify required Git evidence exists. @@ -31,6 +31,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index c1d28e97b..0ae32fe92 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -8,7 +8,7 @@ title: Disallow Commits to Main Branch **Uses:** `git/no-commit-to-main@v2/rules` **Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) **Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify commits made directly to the main branch are disallowed. @@ -25,6 +25,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. + + +## Description +This rule ensures that no commits are made directly to the main or master branches. +It performs the following steps: + +1. Check SBOM target branch +2. If the target branch is the main or master branch, the rule looks for commit objects. +3. If commit objects are found, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index f978773cf..2466fc0e7 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -25,6 +25,23 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. + + +## Description +This rule ensures that all commits are signed. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation. + +**Evidence Requirements:** +- The Source SBOM evidence must be provided in the `cyclonedx-json` format. +- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. +- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index db8fa316b..77770fb70 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -8,7 +8,7 @@ title: NTIA SBOM Compliance Check **Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) -**Labels:** SBOM, Compliance, Image, Source +**Labels:** SBOM, Compliance, Image, Git Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 4bd8708aa..b0b218c94 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -8,7 +8,7 @@ title: Enforce Allowed SBOM Components **Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the artifact contains only allowed components. diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index d2dcdb4de..cdfc55d5d 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -8,7 +8,7 @@ title: Require SBOM Signature **Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint, Source +**Labels:** SBOM, Blueprint, Git Verify the SBOM is signed. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index d93594454..06dc5f146 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -8,7 +8,7 @@ title: Restrict Disallowed SBOM Licenses **Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 2f6539121..b714e7bf4 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -8,7 +8,7 @@ title: Restrict Disallowed Dependencies **Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint, Source +**Labels:** SBOM, Image, Blueprint, Git Verify the number of disallowed dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index fc187ad9a..4842faf98 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -8,7 +8,7 @@ title: Enforce SBOM License Completeness **Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify all dependencies in the artifact have a license. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 74b4159ef..1668a88b4 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -8,7 +8,7 @@ title: Enforce SBOM Freshness **Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the SBOM is not older than the specified duration. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index a300f3ea8..bebb97588 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -8,7 +8,7 @@ title: Require SBOM Existence **Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) -**Labels:** SBOM, Blueprint, Image, Source +**Labels:** SBOM, Blueprint, Image, Git Verify the SBOM exists as evidence. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 1e7f7fd1a..04536b0c4 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -8,7 +8,7 @@ title: Require Specified SBOM Licenses **Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the artifact includes all specified licenses. From 071ed76a5a0bdefadfbc849c9542f009174f6176 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 14:56:10 +0200 Subject: [PATCH 113/191] test gen docs --- .../rules/api/scribe-api-cve-product.md | 16 ++++++--- .../initiatives/rules/api/scribe-api-cve.md | 6 +++- .../initiatives/rules/git/artifact-signed.md | 4 +-- .../rules/git/coding-permissions.md | 4 +-- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 35 ++++++++++++++++--- .../k8s/namespace/white-listed-namespaces.md | 4 +-- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- 19 files changed, 67 insertions(+), 28 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index dc7731c5d..a600c2024 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -22,8 +22,16 @@ Rule requires the Scribe API to be enabled. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| superset | `{'cve': {'max': 0, 'severity': 6}}` | +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. + + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| cve | list | False | List of CVEs to check against the product components. | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 135c32e63..2194c477e 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -26,7 +26,11 @@ Rule is scoped by product and target. ::: ## Mitigation -Regularly scan the target artifact for vulnerabilities to ensure that it remains secure. +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 348cb4ea8..435ff24ea 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -13,7 +13,6 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** ```yaml @@ -27,6 +26,7 @@ This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/va - .*alpine.* ``` +This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -45,7 +45,7 @@ Rule is scoped by product and target. ::: ## Mitigation -Ensures that only Git artifacts with valid cryptographic signatures are deployed prevents source code tampering. +Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 55f3e3ea8..39788b348 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -8,7 +8,7 @@ title: Restrict Coding Permissions **Uses:** `git/coding-permissions@v2/rules` **Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) **Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify only allowed users committed to the repository. @@ -26,7 +26,7 @@ Rule is scoped by product and target. ::: ## Mitigation -Prevent unauthorized users from committing to the repository by restricting coding permissions. +Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 2ba35447f..a569d7e14 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,6 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** @@ -29,6 +28,7 @@ This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/ - port: "8080" protocol: "tcp" ``` +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index c3d2b246a..cae1ec121 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,6 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** @@ -28,6 +27,7 @@ This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/ skip_image_regex: - .*alpine.* ``` +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index d20360c9e..098ca6a06 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,6 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. **Input** `images_to_include` is a list of image repository names. @@ -28,6 +27,7 @@ This rule requires K8s Namespace Discovery Evidence. - docker.io/my_org/my_image2 ``` +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 804fd20aa..e4f05ad41 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,6 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. **Input Example:** @@ -25,6 +24,7 @@ This rule requires K8s Namespace Discovery Evidence. - gcr.io/* ``` +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 1fdf927ef..4f6bd44c9 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,6 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. **Input Example:** @@ -23,6 +22,7 @@ This rule requires K8s Namespace Discovery Evidence. threshold_date: "1970-01-01T00:00:00Z" ``` +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index dc4beae0a..a2ab53fbf 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,6 +13,16 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note + +**Input Example:** + +```yaml +- uses: k8s/namespace/verify-namespace-termination@v2/rules + with: + namespaces: + - ".*" +``` + This rule requires K8s Namespace Discovery Evidence. ::: :::tip @@ -22,6 +32,23 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. + + + +## Description +This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. +It performs the following steps: + +1. Iterates over the namespaces marked for termination in the cluster. +2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration. + - If a namespace's termination time exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +58,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| namespaces | ['.*'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| namespaces | array | False | A list of namespaces to verify (supports regex). | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index c52086a7b..feadd8cc7 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,6 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. **Input** `namespaces` is a list of allowed namespaces. @@ -28,6 +27,7 @@ This rule requires K8s Namespace Discovery Evidence. - kube-system ``` +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -65,5 +65,5 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| namespaces | array | True | A list of allowed namespaces. | +| namespaces | array | False | A list of allowed namespaces. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 5ef0bac76..f1afee203 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,6 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. **Input** `white_listed_pod` is a list of allowed pods. @@ -28,6 +27,7 @@ This rule requires K8s Namespace Discovery Evidence. - my-pod-2.* ``` +This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 6fd24b9f3..0f10bba43 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,6 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. **Input Example:** @@ -23,6 +22,7 @@ This rule requires K8s Pod Discovery Evidence. max_days: 10 ``` +This rule requires K8s Pod Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index a7b212653..c7e1a98cc 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,6 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. **Input Example:** @@ -27,6 +26,7 @@ This rule requires K8s Pod Discovery Evidence. - ".*" ``` +This rule requires K8s Pod Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 77770fb70..80dc23593 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,7 +14,6 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. @@ -41,6 +40,7 @@ valint bom my_company/my_image:latest \ name: "alice" ``` +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index b0b218c94..871004b57 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,6 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type @@ -27,6 +26,7 @@ Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items - operating-system ``` +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 1668a88b4..63f1161bc 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,6 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes a creation date to verify its freshness. @@ -25,6 +24,7 @@ Ensure that the SBOM includes a creation date to verify its freshness. max_days: 30 ``` +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 221e5a242..04c7bdc18 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,6 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes all required dependencies to meet compliance requirements. @@ -28,6 +27,7 @@ Ensure that the SBOM includes all required dependencies to meet compliance requi violations_limit: 0 ``` +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 04536b0c4..6ddd26c12 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,6 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. @@ -28,6 +27,7 @@ This rule accesses the Hugging Face API to validate the licenses. - "Apache-2.0" ``` +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From 798da84088a7fa488d9efdcaa936d47abc306713 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:27:53 +0200 Subject: [PATCH 114/191] test usage examples --- .../initiatives/rules/sbom/NTIA-compliance.md | 32 ++++++++++--------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 80dc23593..e0bd12821 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,7 +14,9 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. For example, @@ -24,23 +26,23 @@ valint bom my_company/my_image:latest \ --author-email bob@my_company.com \ --author-phone "123-456-7890" \ --supplier-email bob@my_company.com \ - --author-email "bob@my_company.com" --supplier-name "alice" \ - --supplier-url "https://my_company.com" --supplier-phone "123-456-7890" + --supplier-name "alice" \ + --supplier-url "https://my_company.com" \ + --supplier-phone "123-456-7890" ``` - -**Input Example:** - + +::: +:::note[Usage example] ```yaml -- uses: sbom/NTIA-compliance@v2/rules - with: - required_author: - name: "bom" - email: "bob@company.com" - required_supplier: - name: "alice" +uses: sbom/NTIA-compliance@v2/rules +with: + required_author: + name: "bom" + email: "bob@company.com" + required_supplier: + name: "alice" + ``` - -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From f2555572ca2ef55767abe65bab8f6382d00a06fb Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:36:21 +0200 Subject: [PATCH 115/191] Revert "test usage examples" This reverts commit 798da84088a7fa488d9efdcaa936d47abc306713. --- .../initiatives/rules/sbom/NTIA-compliance.md | 32 +++++++++---------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index e0bd12821..80dc23593 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,9 +14,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::note + Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. For example, @@ -26,23 +24,23 @@ valint bom my_company/my_image:latest \ --author-email bob@my_company.com \ --author-phone "123-456-7890" \ --supplier-email bob@my_company.com \ - --supplier-name "alice" \ - --supplier-url "https://my_company.com" \ - --supplier-phone "123-456-7890" + --author-email "bob@my_company.com" --supplier-name "alice" \ + --supplier-url "https://my_company.com" --supplier-phone "123-456-7890" ``` - -::: -:::note[Usage example] + +**Input Example:** + ```yaml -uses: sbom/NTIA-compliance@v2/rules -with: - required_author: - name: "bom" - email: "bob@company.com" - required_supplier: - name: "alice" - +- uses: sbom/NTIA-compliance@v2/rules + with: + required_author: + name: "bom" + email: "bob@company.com" + required_supplier: + name: "alice" ``` + +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From 80c85f78d634e3dd25bd0e6d180202b4d3253308 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:36:23 +0200 Subject: [PATCH 116/191] Revert "test gen docs" This reverts commit 071ed76a5a0bdefadfbc849c9542f009174f6176. --- .../rules/api/scribe-api-cve-product.md | 16 +++------ .../initiatives/rules/api/scribe-api-cve.md | 6 +--- .../initiatives/rules/git/artifact-signed.md | 4 +-- .../rules/git/coding-permissions.md | 4 +-- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 35 +++---------------- .../k8s/namespace/white-listed-namespaces.md | 4 +-- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- 19 files changed, 28 insertions(+), 67 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index a600c2024..dc7731c5d 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -22,16 +22,8 @@ Rule requires the Scribe API to be enabled. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Mitigation -Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. - - -## Description -This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. - - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| cve | list | False | List of CVEs to check against the product components. | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | `{'cve': {'max': 0, 'severity': 6}}` | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 2194c477e..135c32e63 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -26,11 +26,7 @@ Rule is scoped by product and target. ::: ## Mitigation -Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. - - -## Description -This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. +Regularly scan the target artifact for vulnerabilities to ensure that it remains secure. ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 435ff24ea..348cb4ea8 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -13,6 +13,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note +This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** ```yaml @@ -26,7 +27,6 @@ Verify the Git artifact is signed. - .*alpine.* ``` -This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -45,7 +45,7 @@ Rule is scoped by product and target. ::: ## Mitigation -Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. +Ensures that only Git artifacts with valid cryptographic signatures are deployed prevents source code tampering. ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 39788b348..55f3e3ea8 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -8,7 +8,7 @@ title: Restrict Coding Permissions **Uses:** `git/coding-permissions@v2/rules` **Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) **Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) -**Labels:** SBOM, Git +**Labels:** Git Verify only allowed users committed to the repository. @@ -26,7 +26,7 @@ Rule is scoped by product and target. ::: ## Mitigation -Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. +Prevent unauthorized users from committing to the repository by restricting coding permissions. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index a569d7e14..2ba35447f 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,6 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** @@ -28,7 +29,6 @@ It fails if any banned port is exposed or if no banned ports list is provided. - port: "8080" protocol: "tcp" ``` -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index cae1ec121..c3d2b246a 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,6 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note +This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). **Input Example:** @@ -27,7 +28,6 @@ Enforces that container images (target_type=container) are cryptographically sig skip_image_regex: - .*alpine.* ``` -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 098ca6a06..d20360c9e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,6 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note +This rule requires K8s Namespace Discovery Evidence. **Input** `images_to_include` is a list of image repository names. @@ -27,7 +28,6 @@ Verify only container images specified in the Allowed List run within the Kubern - docker.io/my_org/my_image2 ``` -This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index e4f05ad41..804fd20aa 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,6 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note +This rule requires K8s Namespace Discovery Evidence. **Input Example:** @@ -24,7 +25,6 @@ Verify container images in Kubernetes namespaces originate from registries in th - gcr.io/* ``` -This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 4f6bd44c9..1fdf927ef 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,6 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note +This rule requires K8s Namespace Discovery Evidence. **Input Example:** @@ -22,7 +23,6 @@ Verify Kubernetes namespaces adhere to a specified runtime duration to enforce l threshold_date: "1970-01-01T00:00:00Z" ``` -This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index a2ab53fbf..dc4beae0a 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,16 +13,6 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note - -**Input Example:** - -```yaml -- uses: k8s/namespace/verify-namespace-termination@v2/rules - with: - namespaces: - - ".*" -``` - This rule requires K8s Namespace Discovery Evidence. ::: :::tip @@ -32,23 +22,6 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Mitigation -Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. - - - -## Description -This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. -It performs the following steps: - -1. Iterates over the namespaces marked for termination in the cluster. -2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration. - - If a namespace's termination time exceeds the limit, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -58,8 +31,8 @@ It performs the following steps: | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| namespaces | array | False | A list of namespaces to verify (supports regex). | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| namespaces | ['.*'] | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index feadd8cc7..c52086a7b 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,6 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note +This rule requires K8s Namespace Discovery Evidence. **Input** `namespaces` is a list of allowed namespaces. @@ -27,7 +28,6 @@ Verify only namespaces specified in the Allowed List are allowed within the clus - kube-system ``` -This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -65,5 +65,5 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| namespaces | array | False | A list of allowed namespaces. | +| namespaces | array | True | A list of allowed namespaces. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index f1afee203..5ef0bac76 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,6 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note +This rule requires K8s Namespace Discovery Evidence. **Input** `white_listed_pod` is a list of allowed pods. @@ -27,7 +28,6 @@ Verify only pods explicitly listed in the Allowed List run within a Kubernetes n - my-pod-2.* ``` -This rule requires K8s Namespace Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 0f10bba43..6fd24b9f3 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,6 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note +This rule requires K8s Pod Discovery Evidence. **Input Example:** @@ -22,7 +23,6 @@ Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecyc max_days: 10 ``` -This rule requires K8s Pod Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index c7e1a98cc..a7b212653 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,6 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note +This rule requires K8s Pod Discovery Evidence. **Input Example:** @@ -26,7 +27,6 @@ Verify only pods explicitly listed in the Allowed List are allowed to run. - ".*" ``` -This rule requires K8s Pod Discovery Evidence. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 80dc23593..77770fb70 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,6 +14,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. @@ -40,7 +41,6 @@ valint bom my_company/my_image:latest \ name: "alice" ``` -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 871004b57..b0b218c94 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,6 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type @@ -26,7 +27,6 @@ Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items - operating-system ``` -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 63f1161bc..1668a88b4 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,6 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes a creation date to verify its freshness. @@ -24,7 +25,6 @@ Ensure that the SBOM includes a creation date to verify its freshness. max_days: 30 ``` -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 04c7bdc18..221e5a242 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,6 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes all required dependencies to meet compliance requirements. @@ -27,7 +28,6 @@ Ensure that the SBOM includes all required dependencies to meet compliance requi violations_limit: 0 ``` -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 6ddd26c12..04536b0c4 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,6 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note +This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. @@ -27,7 +28,6 @@ This rule accesses the Hugging Face API to validate the licenses. - "Apache-2.0" ``` -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From d2fd86d1be88b7071ce4627c9d2d0b26529b6b48 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:36:38 +0200 Subject: [PATCH 117/191] test usage examples --- .../initiatives/rules/sbom/NTIA-compliance.md | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 77770fb70..b788cf1b4 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,8 +14,9 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. For example, @@ -25,20 +26,23 @@ valint bom my_company/my_image:latest \ --author-email bob@my_company.com \ --author-phone "123-456-7890" \ --supplier-email bob@my_company.com \ - --author-email "bob@my_company.com" --supplier-name "alice" \ - --supplier-url "https://my_company.com" --supplier-phone "123-456-7890" + --supplier-name "alice" \ + --supplier-url "https://my_company.com" \ + --supplier-phone "123-456-7890" ``` - -**Input Example:** + +::: +:::note[Usage example] ```yaml -- uses: sbom/NTIA-compliance@v2/rules - with: - required_author: - name: "bom" - email: "bob@company.com" - required_supplier: - name: "alice" +uses: sbom/NTIA-compliance@v2/rules +with: + required_author: + name: "bom" + email: "bob@company.com" + required_supplier: + name: "alice" + ``` ::: From 0850a082a4e03f36a5d982336f3f273ef674ff37 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:38:47 +0200 Subject: [PATCH 118/191] Revert "test gen docs" This reverts commit d0c608d8c86ce3c159b165b9f77258d3bae3bc30. --- .../initiatives/rules/api/scribe-api-cve.md | 12 +++----- .../rules/api/scribe-api-published.md | 16 +++------- .../rules/dockerhub/token-expiration.md | 16 ---------- .../rules/dockerhub/token-not-used.md | 10 ------- .../initiatives/rules/git/artifact-signed.md | 19 +----------- .../rules/git/coding-permissions.md | 29 ++++--------------- .../initiatives/rules/git/evidence-exists.md | 7 +---- .../rules/git/no-commit-to-main.md | 18 +----------- .../rules/git/no-unsigned-commits.md | 17 ----------- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- 18 files changed, 25 insertions(+), 137 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 135c32e63..30678cfc8 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -25,10 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -Regularly scan the target artifact for vulnerabilities to ensure that it remains secure. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -37,8 +33,8 @@ Regularly scan the target artifact for vulnerabilities to ensure that it remains | content_body_type | cyclonedx-json | | target_type | container | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format {cve: {max: , severity: }} | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | `{'published': None}` | diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 9ad8f4a85..3838ddfac 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -22,22 +22,6 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Mitigation -Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. - - -## Description -This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub. -It performs the following steps: - -1. Iterates over the Dockerhub tokens in the project. -2. Checks each token's status against the Active status. - - If a token's status is not Active, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 804cb1bbc..ffca962e3 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -22,16 +22,6 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Description -This rule verifies that there are no unused Dockerhub. -It performs the following steps: - -1. Iterates over the Dockerhub tokens in the project. -2. Checks each token's last_used is null , the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 348cb4ea8..fb29318b9 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -8,25 +8,12 @@ title: Git Artifact Signed **Uses:** `git/artifact-signed@v2/rules` **Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) -**Labels:** SBOM, Git +**Labels:** Git Verify the Git artifact is signed. :::note This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -**Input Example:** - ```yaml -- uses: git/artifact-signed@v2/rules - with: - identity: - emails: - - bob@company.com - - alice@company.com - skip_image_regex: - - .*alpine.* -``` - ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -44,10 +31,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -Ensures that only Git artifacts with valid cryptographic signatures are deployed prevents source code tampering. - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 55f3e3ea8..49f182c2e 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -25,25 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -Prevent unauthorized users from committing to the repository by restricting coding permissions. - - - -## Description -This rule verifies that only allowed users have committed to the repository. -It performs the following steps: - -1. Iterates over the commits in the repository. -2. Checks each commit's author against the list of allowed user IDs. - - If a commit's author is not in the allowed list, the rule flags it as a violation. -3. Checks each committed file against the list of allowed files. - - If a committed file is not in the allowed list, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -52,9 +33,9 @@ It performs the following steps: | content_body_type | cyclonedx-json | | target_type | git | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. | -| files | array | False | The list of files that are allowed to be committed to the repository. | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| ids | [] | +| files | [] | diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 08c1a4013..f7f31be3c 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -8,7 +8,7 @@ title: Required Git Evidence Exists **Uses:** `git/evidence-exists@v2/rules` **Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) -**Labels:** SBOM, Git +**Labels:** Git Verify required Git evidence exists. @@ -31,11 +31,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. - - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 0ae32fe92..c1d28e97b 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -8,7 +8,7 @@ title: Disallow Commits to Main Branch **Uses:** `git/no-commit-to-main@v2/rules` **Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) **Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) -**Labels:** SBOM, Git +**Labels:** Git Verify commits made directly to the main branch are disallowed. @@ -25,22 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. - - -## Description -This rule ensures that no commits are made directly to the main or master branches. -It performs the following steps: - -1. Check SBOM target branch -2. If the target branch is the main or master branch, the rule looks for commit objects. -3. If commit objects are found, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index 2466fc0e7..f978773cf 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -25,23 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: -## Mitigation -Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. - - -## Description -This rule ensures that all commits are signed. -It performs the following steps: - -1. Iterates over the commits in the repository. -2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation. - -**Evidence Requirements:** -- The Source SBOM evidence must be provided in the `cyclonedx-json` format. -- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. -- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index b788cf1b4..d4e100ba4 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -8,7 +8,7 @@ title: NTIA SBOM Compliance Check **Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) -**Labels:** SBOM, Compliance, Image, Git +**Labels:** SBOM, Compliance, Image, Source Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index b0b218c94..4bd8708aa 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -8,7 +8,7 @@ title: Enforce Allowed SBOM Components **Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image, Source Verify the artifact contains only allowed components. diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index cdfc55d5d..d2dcdb4de 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -8,7 +8,7 @@ title: Require SBOM Signature **Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint, Git +**Labels:** SBOM, Blueprint, Source Verify the SBOM is signed. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 06dc5f146..d93594454 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -8,7 +8,7 @@ title: Restrict Disallowed SBOM Licenses **Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image, Source Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index b714e7bf4..2f6539121 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -8,7 +8,7 @@ title: Restrict Disallowed Dependencies **Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint, Git +**Labels:** SBOM, Image, Blueprint, Source Verify the number of disallowed dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 4842faf98..fc187ad9a 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -8,7 +8,7 @@ title: Enforce SBOM License Completeness **Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image, Source Verify all dependencies in the artifact have a license. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 1668a88b4..74b4159ef 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -8,7 +8,7 @@ title: Enforce SBOM Freshness **Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image, Source Verify the SBOM is not older than the specified duration. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index bebb97588..a300f3ea8 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -8,7 +8,7 @@ title: Require SBOM Existence **Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) -**Labels:** SBOM, Blueprint, Image, Git +**Labels:** SBOM, Blueprint, Image, Source Verify the SBOM exists as evidence. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 04536b0c4..1e7f7fd1a 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -8,7 +8,7 @@ title: Require Specified SBOM Licenses **Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image, Source Verify the artifact includes all specified licenses. From 26d0bf36280d81ba93cc612587d9727337cf8e6a Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:38:58 +0200 Subject: [PATCH 119/191] test usage examples --- docs/configuration/initiatives/rules/sbom/NTIA-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index d4e100ba4..b788cf1b4 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -8,7 +8,7 @@ title: NTIA SBOM Compliance Check **Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) -**Labels:** SBOM, Compliance, Image, Source +**Labels:** SBOM, Compliance, Image, Git Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. From d98ce4341b66d2187564b1cb29bc8b00c5eb550c Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 13 Mar 2025 15:45:37 +0200 Subject: [PATCH 120/191] test usage examples --- .../initiatives/rules/sbom/NTIA-compliance.md | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index b788cf1b4..3b7901c99 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -32,7 +32,17 @@ valint bom my_company/my_image:latest \ ``` ::: -:::note[Usage example] +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example ```yaml uses: sbom/NTIA-compliance@v2/rules @@ -45,17 +55,6 @@ with: ``` -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - ## Mitigation Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers. From 224837e5028920aae79484fb7b889439b90ed302 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:03:55 +0200 Subject: [PATCH 121/191] test gen docs --- .../rules/api/scribe-api-cve-product.md | 16 +- .../initiatives/rules/api/scribe-api-cve.md | 30 ++- .../rules/api/scribe-api-published.md | 28 ++- .../rules/bitbucket/project/allow-admins.md | 2 +- .../rules/bitbucket/project/allow-users.md | 2 +- .../bitbucket/project/exposed-credentials.md | 2 +- .../bitbucket/project/long-live-tokens.md | 2 +- .../bitbucket/repository/allow-admins.md | 2 +- .../rules/bitbucket/repository/allow-users.md | 2 +- .../bitbucket/repository/branch-protection.md | 2 +- .../rules/bitbucket/workspace/allow-admins.md | 2 +- .../rules/bitbucket/workspace/allow-users.md | 2 +- .../rules/dockerhub/token-expiration.md | 18 +- .../rules/dockerhub/token-not-used.md | 12 +- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 22 +- .../rules/git/coding-permissions.md | 33 ++- .../initiatives/rules/git/evidence-exists.md | 9 +- .../rules/git/no-commit-to-main.md | 20 +- .../rules/git/no-unsigned-commits.md | 19 +- .../initiatives/rules/github/org/2fa.md | 2 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/github/org/allow-users.md | 2 +- .../rules/github/org/create-private-repos.md | 2 +- .../rules/github/org/create-repos.md | 2 +- .../rules/github/org/dependabot-alerts.md | 2 +- .../org/dependabot-security-updates-sa.md | 2 +- .../github/org/dependabot-security-updates.md | 2 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/max-admins.md | 2 +- .../rules/github/org/old-secrets.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/repo-visibility.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/github/org/web-commit-signoff.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../github/repository/branch-verification.md | 2 +- .../github/repository/check-signed-commits.md | 2 +- .../repository/default-branch-protection.md | 2 +- .../rules/github/repository/dependabot.md | 2 +- .../repository/ephemeral-runners-only.md | 2 +- .../rules/github/repository/no-cache-usage.md | 2 +- .../rules/github/repository/no-org-secrets.md | 2 +- .../rules/github/repository/old-secrets.md | 2 +- .../github/repository/push-protection.md | 2 +- .../rules/github/repository/repo-private.md | 2 +- .../github/repository/secret-scanning.md | 2 +- .../rules/github/repository/signed-commits.md | 2 +- .../github/repository/validity-checks.md | 2 +- .../rules/github/repository/visibility.md | 2 +- .../github/repository/web-commit-signoff.md | 2 +- .../rules/gitlab/org/allow-admins.md | 2 +- .../rules/gitlab/org/allow-token-scopes.md | 2 +- .../rules/gitlab/org/allow-users.md | 2 +- .../rules/gitlab/org/blocked-users.md | 2 +- .../rules/gitlab/org/expiring-tokens.md | 2 +- .../rules/gitlab/org/forbid-token-scopes.md | 2 +- .../rules/gitlab/org/inactive-projects.md | 2 +- .../rules/gitlab/org/longlive-tokens.md | 2 +- .../rules/gitlab/org/max-admins.md | 2 +- .../rules/gitlab/org/projects-visibility.md | 2 +- .../rules/gitlab/org/unused-tokens.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/gitlab/project/abandoned-project.md | 2 +- .../gitlab/project/approvals-policy-check.md | 2 +- .../project/approvers-per-merge-request.md | 2 +- .../gitlab/project/author-email-regex.md | 2 +- .../rules/gitlab/project/check-cwe.md | 2 +- .../gitlab/project/check-signed-commits.md | 2 +- .../gitlab/project/co-approval-required.md | 2 +- .../project/commit-author-email-check.md | 2 +- .../project/commit-author-name-check.md | 2 +- .../gitlab/project/commit-committer-check.md | 2 +- .../gitlab/project/commit-message-check.md | 2 +- .../rules/gitlab/project/commits-validated.md | 2 +- .../gitlab/project/committer-email-check.md | 2 +- .../gitlab/project/committer-name-check.md | 2 +- .../gitlab/project/critical-severity-limit.md | 2 +- .../project/description-substring-check.md | 2 +- .../project/disallowed-banned-approvers.md | 2 +- .../gitlab/project/force-push-protection.md | 2 +- .../gitlab/project/medium-severity-limit.md | 2 +- .../rules/gitlab/project/member-check.md | 2 +- .../gitlab/project/merge-access-level.md | 2 +- .../project/merge-requests-author-approval.md | 2 +- ...ge-requests-disable-committers-approval.md | 2 +- .../gitlab/project/message-substring-check.md | 2 +- .../gitlab/project/prevent-secrets-check.md | 2 +- .../gitlab/project/protect-ci-secrets.md | 2 +- .../rules/gitlab/project/push-access-level.md | 2 +- .../rules/gitlab/project/push-rules-set.md | 2 +- .../gitlab/project/reject-unsigned-commits.md | 2 +- .../project/require-password-to-approve.md | 2 +- .../project/required-minimal-approvers.md | 2 +- .../gitlab/project/reset-pprovals-on-push.md | 2 +- .../rules/gitlab/project/sast-scan-pass.md | 2 +- .../rules/gitlab/project/sast-scanning.md | 2 +- .../rules/gitlab/project/secrets-scan-pass.md | 2 +- .../rules/gitlab/project/secrets-scanning.md | 2 +- .../project/selective-code-owner-removals.md | 2 +- .../rules/gitlab/project/visibility-check.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 26 +-- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 28 +-- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- docs/configuration/initiatives/rules/index.md | 204 ++++++++++++++++++ .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 2 +- .../rules/jenkins/instance/unused-users.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 27 ++- .../rules/k8s/namespace/allowed-registries.md | 23 +- .../namespace/verify-namespace-duration.md | 19 +- .../namespace/verify-namespace-termination.md | 36 +++- .../k8s/namespace/white-listed-namespaces.md | 18 +- .../rules/k8s/namespace/white-listed-pod.md | 26 +-- .../rules/k8s/pods/verify-pod-duration.md | 19 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 27 ++- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../rules/sbom/allowed-components.md | 30 +-- .../initiatives/rules/sbom/artifact-signed.md | 4 +- .../initiatives/rules/sbom/banned-licenses.md | 4 +- .../rules/sbom/blocklist-packages.md | 4 +- .../rules/sbom/complete-licenses.md | 4 +- .../initiatives/rules/sbom/fresh-sbom.md | 23 +- .../initiatives/rules/sbom/require-sbom.md | 4 +- .../rules/sbom/required-packages.md | 27 ++- .../rules/sbom/verify-huggingface-license.md | 31 ++- .../rules/slsa/banned-builder-deps.md | 2 +- .../initiatives/rules/slsa/build-time.md | 2 +- .../initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- .../initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- 176 files changed, 716 insertions(+), 367 deletions(-) create mode 100644 docs/configuration/initiatives/rules/index.md diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index dc7731c5d..a600c2024 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -22,8 +22,16 @@ Rule requires the Scribe API to be enabled. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| superset | `{'cve': {'max': 0, 'severity': 6}}` | +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. + + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| cve | list | False | List of CVEs to check against the product components. | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 30678cfc8..9fa9d6e80 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -12,6 +12,9 @@ title: Verify No Critical or High Vulnerabilities Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). +:::note +Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. +::: :::tip Rule requires the Scribe API to be enabled. ::: @@ -25,6 +28,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: api/scribe-api-cve@v2/rules +with: + superset: + cve: + max: 0 + severity: 6 +``` + +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -33,8 +55,8 @@ Rule is scoped by product and target. | content_body_type | cyclonedx-json | | target_type | container | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| superset | `{'cve': {'max': 0, 'severity': 6}}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| superset | object | False | The superset of CVEs to check for, including the following format {cve: {max: , severity: }} | diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 406324ca7..51f0406b2 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 6b14e246e..b62d0feb3 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 7c28fa7a5..16fe5d0ad 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -13,7 +13,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index f1ea8252d..8f8fd9623 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -13,7 +13,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index b73f73b45..e1d7a84c3 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 874d6c001..e166c227b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 29e5b12ef..de230fe7f 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 1ff8344c9..549d01398 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 87d9c1544..81b6ef662 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 3838ddfac..5146cfd98 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +22,22 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Mitigation +Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. + + +## Description +This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's status against the Active status. + - If a token's status is not Active, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index ffca962e3..bcd4df90a 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Description +This rule verifies that there are no unused Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's last_used is null , the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 1c07217b9..525b101fd 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -13,7 +13,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Signed Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index ed7c0b59a..60ef06759 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index adc2f5c52..119d13b24 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 62de3dec5..92e365d5f 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index fb29318b9..b9c5dc826 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -8,12 +8,12 @@ title: Git Artifact Signed **Uses:** `git/artifact-signed@v2/rules` **Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify the Git artifact is signed. :::note -This rule requires Signed [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Signed Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -31,6 +31,24 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: git/artifact-signed@v2/rules +with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* +``` + +## Mitigation +Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 49f182c2e..0de7e8f54 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -8,12 +8,12 @@ title: Restrict Coding Permissions **Uses:** `git/coding-permissions@v2/rules` **Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) **Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify only allowed users committed to the repository. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +25,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. + + + +## Description +This rule verifies that only allowed users have committed to the repository. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. Checks each commit's author against the list of allowed user IDs. + - If a commit's author is not in the allowed list, the rule flags it as a violation. +3. Checks each committed file against the list of allowed files. + - If a committed file is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -33,9 +52,9 @@ Rule is scoped by product and target. | content_body_type | cyclonedx-json | | target_type | git | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| ids | [] | -| files | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. | +| files | array | False | The list of files that are allowed to be committed to the repository. | diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index f7f31be3c..b22b6998c 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -8,12 +8,12 @@ title: Required Git Evidence Exists **Uses:** `git/evidence-exists@v2/rules` **Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify required Git evidence exists. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. @@ -31,6 +31,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. + + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index c1d28e97b..5cbdd1be6 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -8,12 +8,12 @@ title: Disallow Commits to Main Branch **Uses:** `git/no-commit-to-main@v2/rules` **Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) **Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) -**Labels:** Git +**Labels:** SBOM, Git Verify commits made directly to the main branch are disallowed. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +25,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. + + +## Description +This rule ensures that no commits are made directly to the main or master branches. +It performs the following steps: + +1. Check SBOM target branch +2. If the target branch is the main or master branch, the rule looks for commit objects. +3. If commit objects are found, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index f978773cf..6d5d7759c 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -25,6 +25,23 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Mitigation +Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. + + +## Description +This rule ensures that all commits are signed. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation. + +**Evidence Requirements:** +- The Source SBOM evidence must be provided in the `cyclonedx-json` format. +- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. +- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 5eda39198..bf7a3868d 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -13,7 +13,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 57cee45e4..d2b51b9c1 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -13,7 +13,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 2736fa0fd..787d0fa2b 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 93e85754a..0acd2886d 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index eaabeb5df..0f52d1bf0 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index e40a0fc0b..a87cf0280 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 273891728..ded316de4 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -13,7 +13,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index b32177204..7dc3276b2 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index ab4a596ca..c4bef2b2b 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index a05490a54..4a6950e39 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -13,7 +13,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index a6883d4e0..60cd3acda 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index ac6ba4db7..5acd98409 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 7885e1cef..98afcf2c9 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 501c76dbe..10e9ab7a7 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index b0ccc2510..055262acb 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -14,7 +14,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index be53e401a..b3c3f401c 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -13,7 +13,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 9ab913582..1f90f6e69 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 3e5071862..030427051 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 54ce28bc8..19f1f93b7 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index de2578f95..7a0d3acbd 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 7b48e3e95..09749c7b4 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 7cbb7b726..5d2ecd117 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index c0232ca9d..0d85d0826 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -13,7 +13,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 1c1bb4475..81aa91395 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 91e13d186..d840f52fd 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index fb0fc5d66..bee7de249 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -13,7 +13,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 75a07202a..d6903db6e 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -13,7 +13,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index efa95bfa1..b96d806a6 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -13,7 +13,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 1322b9ffa..34a726c72 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -13,7 +13,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 8098387ae..2771a4d25 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -13,7 +13,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index d3a48a516..cfafeb991 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -13,7 +13,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 34d5e5458..66e4f864e 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -13,7 +13,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 5d0d47a6e..25e4c0492 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 4f55ec642..3522a9b53 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 33fe7e69e..085e3e3f9 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -13,7 +13,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 1b42ba1ec..4d3f92e25 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -13,7 +13,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 5a827b9d4..292d18460 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 9c8f1d359..03073daa3 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 7e068f2df..2c1f2f4ca 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -13,7 +13,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 211c9fbac..6de10d5c8 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index b749c7fe6..d8eba9536 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -13,7 +13,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index 46440fb45..f40cfc750 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -13,7 +13,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 4ad5f6292..a27633102 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -13,7 +13,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 4058355ad..7615cc919 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -13,7 +13,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 43c55eba9..a1457309d 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -13,7 +13,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 768eaf342..8b4c63691 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index c2ac1f5b9..acd796208 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -13,7 +13,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 30936ae98..aae47c2bc 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -13,7 +13,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 70c32ae48..5aeb19514 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index e60103a2b..da3ec8391 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index d273fb71b..706668b1a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -13,7 +13,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index c406be23c..bc034027e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -13,7 +13,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index b2b2385e6..5a49ddd19 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -13,7 +13,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index a91734621..e49c0db4c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -13,7 +13,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 0d034d1f1..106e8c273 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -13,7 +13,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 58d8d416b..3561d047f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -13,7 +13,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 0befebd2e..a7bcfe865 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -13,7 +13,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index f4905465a..65b1842f2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -13,7 +13,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index b33750fe0..386a31717 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -13,7 +13,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 5395839fa..92c35ca03 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -13,7 +13,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 607ee95b3..1e8ffedcd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -13,7 +13,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index b86b69fee..723dfa631 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -13,7 +13,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index ced8323c1..9faee5f67 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 46132c432..6824f1542 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 14ed65a3e..cbb1d877b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index e6cdeaf9e..1e174e951 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -13,7 +13,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index ff15dff93..19baaa598 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -13,7 +13,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 6242517bd..5914e5e78 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -13,7 +13,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 76eb0cb21..f8c6a9a52 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index c20e2f791..e89f507df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -13,7 +13,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 55b310bbd..59e64d5dd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -13,7 +13,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 29f919741..fe147bc22 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -13,7 +13,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index fd7faa56c..9ae094144 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -13,7 +13,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 09642db8e..58eeb7960 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -13,7 +13,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 09e89ce28..2f77caa97 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -13,7 +13,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 400affd97..dd4b6b66b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -13,7 +13,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 23fb7915a..fd4a3ff62 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -13,7 +13,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 313fa3495..3519d04f2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -13,7 +13,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 752bc59e2..e7b3b9aa6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -13,7 +13,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 82d07759d..ab1e55637 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -13,7 +13,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 3a449a811..9522b2231 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -13,7 +13,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index b19b1c0b0..528c56975 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -13,7 +13,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 652158cb8..8add92175 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index d853587ce..a3df4593b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -13,7 +13,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 6f02553f2..fb4969c1a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 4dd6b1842..58c72be1b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -13,7 +13,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 69cdb4882..685952dd7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -13,7 +13,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 39f8550ad..b6f34d03b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -13,7 +13,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index d2ba6f4c1..255c68c7e 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 52bc01611..9865e69f2 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 2ba35447f..385559573 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,19 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -**Input Example:** - -```yaml -- uses: images/banned-ports@v2/rules - with: - banned_ports: - - port: "3000" - protocol: "tcp" - - port: "8080" - protocol: "tcp" -``` +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -40,6 +28,18 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/banned-ports@v2/rules +with: + banned_ports: + - port: "3000" + protocol: "tcp" + - port: "8080" + protocol: "tcp" +``` + ## Mitigation Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 9ad6c8f89..aab4b3435 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 19559c7e1..13ba61939 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index ca853f4e3..af6b9165f 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 5a53f837a..26db45be2 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 0d318bb37..f181f8339 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 9a4b4586f..e4960acb1 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index c3d2b246a..d8a6147eb 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,20 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -**Input Example:** - -```yaml -- uses: images/image-signed@v2/rules - with: - identity: - emails: - - bob@company.com - - alice@company.com - skip_image_regex: - - .*alpine.* -``` +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -39,6 +26,19 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: images/image-signed@v2/rules +with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* +``` + ## Mitigation Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index f3e24b7bc..034264226 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 512e11e3f..eb2bc0d9c 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 1c7aea3bc..dc28eb44f 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 03d3ea175..6998cf3bb 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/index.md b/docs/configuration/initiatives/rules/index.md new file mode 100644 index 000000000..d2a1fbcd7 --- /dev/null +++ b/docs/configuration/initiatives/rules/index.md @@ -0,0 +1,204 @@ +# Rule Index + +| Rule Name | Description | Evidence Type | +|-----------|-------------|---------------| +| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| NTIA SBOM Compliance Check | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require SBOM Existence | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary +including the component names and versions of valid base images, or lists the invalid ones. +This rule requires Dockerfile context; for example, run it with: +`valint my_image --base-image Dockerfile`. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Fresh Base Image | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Allowed Main Image Source | Ensures the main container image referenced in the SBOM is from an approved source. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Registry Connection HTTPS | Checks if the container's registry scheme is HTTPS + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Fresh Image | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require Signed Container Image | Enforces that container images (target_type=container) are cryptographically signed. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Forbid Large Images | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Restrict Build Scripts | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Require Healthcheck | Checks that the container image includes at least one healthcheck property. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Banned Ports | Ensures that the container image does not expose ports that are disallowed by organizational policy. +The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. +It fails if any banned port is exposed or if no banned ports list is provided. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Restrict Coding Permissions | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Git Artifact Signed | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | +| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| SARIF Update Needed | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Trivy Vulnerability Findings Check | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed +the defined severity threshold. + | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | +| Required Generic Evidence Exists | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Required Trivy Evidence Exists | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Generic Artifact Signed | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | +| Verify Exposed Credentials | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | +| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | +| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | +| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. | +| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. | +| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Repository Is Private | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | +| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Verify Project Activity | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | +| Disallow Unused Users | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. | +| Verify Inactive Users | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. | +| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | +| Verify that provenance is authenticated | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Verify build time | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | +| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Enforce 2FA | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| SBOM archived | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Limit admins | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Branch protected | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Code archived | PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Repo private | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | +| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 95408d2f6..3f4d5417c 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover). +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 1cb8ce014..9d0942d3a 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -13,7 +13,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index a90ce2599..c3b778faf 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -13,7 +13,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index d20360c9e..3810a13bc 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,21 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. - -**Input** -`images_to_include` is a list of image repository names. - -**Input Example:** - -```yaml -- uses: k8s/namespace/allowed-images@v2/rules - with: - images_to_include: - - docker.io/my_org/my_image1 - - docker.io/my_org/my_image2 -``` - +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,10 +22,21 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/allowed-images@v2/rules +with: + images_to_include: + - docker.io/my_org/my_image1 + - docker.io/my_org/my_image2 +``` + ## Mitigation Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. + ## Description This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 804fd20aa..2a9492aa5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,18 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. - -**Input Example:** - -```yaml -- uses: k8s/namespace/allowed-registries@v2/rules - with: - allowed_registries: - - docker.io/* - - gcr.io/* -``` - +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -33,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/allowed-registries@v2/rules +with: + allowed_registries: + - docker.io/* + - gcr.io/* +``` + ## Mitigation Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 1fdf927ef..13d9320a5 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,16 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. - -**Input Example:** - -```yaml -- uses: k8s/namespace/verify-namespace-duration@v2/rules - with: - threshold_date: "1970-01-01T00:00:00Z" -``` - +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -31,6 +22,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/verify-namespace-duration@v2/rules +with: + threshold_date: "1970-01-01T00:00:00Z" +``` + ## Mitigation Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index dc4beae0a..f3d3239de 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -22,6 +22,32 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/verify-namespace-termination@v2/rules +with: + namespaces: + - ".*" +``` + +## Mitigation +Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. + + + +## Description +This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. +It performs the following steps: + +1. Iterates over the namespaces marked for termination in the cluster. +2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration. + - If a namespace's termination time exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -31,8 +57,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=namespace
- platform=k8s | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| namespaces | ['.*'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| namespaces | array | False | A list of namespaces to verify (supports regex). | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index c52086a7b..59ef3ce57 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,21 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. - -**Input** -`namespaces` is a list of allowed namespaces. - -**Input Example:** - -```yaml -- uses: k8s/namespace/white-listed-namespaces@v2/rules - with: - namespaces: - - default - - kube-system -``` - +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -65,5 +51,5 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| namespaces | array | True | A list of allowed namespaces. | +| namespaces | array | False | A list of allowed namespaces. | diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 5ef0bac76..844cb5f4f 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,21 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. - -**Input** -`white_listed_pod` is a list of allowed pods. - -**Input Example:** - -```yaml -- uses: k8s/namespace/white-listed-pod@v2/rules - with: - white_listed_pod: - - my-pod-1.* - - my-pod-2.* -``` - +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/white-listed-pod@v2/rules +with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* +``` + ## Mitigation Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 6fd24b9f3..0b2d56ae8 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,16 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. - -**Input Example:** - -```yaml -- uses: k8s/pods/verify-pod-duration@v2/rules - with: - max_days: 10 -``` - +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -31,6 +22,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/pods/verify-pod-duration@v2/rules +with: + max_days: 30 +``` + ## Mitigation Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 90afee0b6..5db4c685a 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index a7b212653..8c9246650 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,20 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. - -**Input Example:** - -```yaml -- uses: k8s/pods/white-listed-pod@v2/rules - with: - white_listed_pod: - - my-pod-1.* - - my-pod-2.* - verify_namespaces: - - ".*" -``` - +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -35,6 +22,18 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/pods/white-listed-pod@v2/rules +with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* + verify_namespaces: + - ".*" +``` + ## Mitigation Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 27e869d1a..80e190328 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Signed Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 7567b9186..4b53a9ab8 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -13,7 +13,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires Signed SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 3eaef2c56..bbf45f729 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -13,7 +13,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 47ad48804..92d46f3cb 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 1c5436001..68e8d7405 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index ed2ef745e..999bd1e56 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 09bbace70..8b86015d8 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index c13ba8ee9..83f191240 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -16,7 +16,7 @@ the defined severity threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 6f028541e..df10b62bb 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index e83fa8d8a..18a3e2777 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 9b92a0ed0..41b542026 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 9d71c499c..5afa68734 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index b1caba364..5b96d7a50 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 6e3ff51e5..b4b2b4760 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -13,7 +13,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif). +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 4bd8708aa..7038b9587 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -8,25 +8,15 @@ title: Enforce Allowed SBOM Components **Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the artifact contains only allowed components. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type - -**Input Example:** - -```yaml -- uses: sbom/allowed-components@v2/rules - with: - types: - - library - - operating-system -``` - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::note +Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -38,6 +28,16 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/allowed-components@v2/rules +with: + types: + - library + - operating-system +``` + ## Mitigation Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain. diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index d2dcdb4de..360137f81 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -8,12 +8,12 @@ title: Require SBOM Signature **Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint, Source +**Labels:** SBOM, Blueprint, Git Verify the SBOM is signed. :::note -This rule requires Signed [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Signed SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index d93594454..a5092bc56 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -8,12 +8,12 @@ title: Restrict Disallowed SBOM Licenses **Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 2f6539121..647c6c882 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -8,12 +8,12 @@ title: Restrict Disallowed Dependencies **Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint, Source +**Labels:** SBOM, Image, Blueprint, Git Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index fc187ad9a..2930d7e0b 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -8,12 +8,12 @@ title: Enforce SBOM License Completeness **Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify all dependencies in the artifact have a license. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 74b4159ef..21e6a8631 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -8,23 +8,12 @@ title: Enforce SBOM Freshness **Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the SBOM is not older than the specified duration. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -Ensure that the SBOM includes a creation date to verify its freshness. - -**Input Example:** - -```yaml -- uses: sbom/fresh-sbom@v2/rules - with: - max_days: 30 -``` - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -36,6 +25,14 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/fresh-sbom@v2/rules +with: + max_days: 30 +``` + ## Mitigation Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index a300f3ea8..fddf26fb0 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -8,12 +8,12 @@ title: Require SBOM Existence **Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) -**Labels:** SBOM, Blueprint, Image, Source +**Labels:** SBOM, Blueprint, Image, Git Verify the SBOM exists as evidence. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 221e5a242..4427b6a92 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,21 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -Ensure that the SBOM includes all required dependencies to meet compliance requirements. - -**Input Example:** - -```yaml -- uses: sbom/required-packages@v2/rules - with: - required_pkgs: - - "pkg:maven/org.apache.commons/commons-lang3@3.9" - - "pkg:npm/lodash@4.17.15" - violations_limit: 0 -``` - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -39,6 +25,17 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/required-packages@v2/rules +with: + required_pkgs: + - "pkg:maven/org.apache.commons/commons-lang3@3.9" + - "pkg:npm/lodash@4.17.15" + violations_limit: 0 +``` + ## Mitigation Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 1e7f7fd1a..1ff527905 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -8,26 +8,15 @@ title: Require Specified SBOM Licenses **Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image, Source +**Labels:** SBOM, Image, Git Verify the artifact includes all specified licenses. :::note -This rule requires [SBOM](https://scribe-security.netlify.app/docs/valint/sbom). - -Ensure that the SBOM includes all specified licenses to meet compliance requirements. -This rule accesses the Hugging Face API to validate the licenses. - -**Input Example:** - -```yaml -- uses: sbom/verify-huggingface-license@v2/rules - with: - licenses: - - "MIT" - - "Apache-2.0" -``` - +This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::note +Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -39,6 +28,16 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/verify-huggingface-license@v2/rules +with: + licenses: + - "MIT" + - "Apache-2.0" +``` + ## Mitigation Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 88d953aed..4c9e24541 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index b0559398b..237dc67e3 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 6b137f8ff..fb8c7b126 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 9674bc2e3..c8651fc5f 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -14,7 +14,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 727c8e7b0..aa98740b1 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -14,7 +14,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires Signed SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 17ce53121..008ace0be 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 3519c403f..6b1b2e9e3 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa). +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 265adbc1e..a5e9828f4 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 8cde70cb1..fc4df69e0 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index a9922e619..070abc625 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 2b6068b92..81f34f244 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index e46c57e81..27dea480e 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 6af44c012..c152b847d 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 5c906d233..42f570387 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 1112259d6..e26ccb803 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires [Statement](https://scribe-security.netlify.app/docs/valint/generic). +This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From 44464688067b8f00f244ec3ce8d80b94cc0f4bc7 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:12:51 +0200 Subject: [PATCH 122/191] test gen docs --- docs/configuration/initiatives/index.md | 223 ++++++++++++++++++++++++ 1 file changed, 223 insertions(+) create mode 100644 docs/configuration/initiatives/index.md diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md new file mode 100644 index 000000000..b7b9c427c --- /dev/null +++ b/docs/configuration/initiatives/index.md @@ -0,0 +1,223 @@ +# Documentation Index + +## Initiatives + +| Name | Description | +|------|-------------| +| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. + | +| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: + - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, + addressing requirements from SR-4 and CM-8. + - Provenance data to support architectural traceability, as outlined in SA-8. +Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. + | +| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/bp1.md) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | + +## Rules + +| Rule Name | Description | Evidence Type | +|-----------|-------------|---------------| +| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| NTIA SBOM Compliance Check | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require SBOM Existence | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary +including the component names and versions of valid base images, or lists the invalid ones. +This rule requires Dockerfile context; for example, run it with: +`valint my_image --base-image Dockerfile`. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Fresh Base Image | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Allowed Main Image Source | Ensures the main container image referenced in the SBOM is from an approved source. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Registry Connection HTTPS | Checks if the container's registry scheme is HTTPS + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Fresh Image | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Signed Container Image | Enforces that container images (target_type=container) are cryptographically signed. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Forbid Large Images | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Build Scripts | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Healthcheck | Checks that the container image includes at least one healthcheck property. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Banned Ports | Ensures that the container image does not expose ports that are disallowed by organizational policy. +The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. +It fails if any banned port is exposed or if no banned ports list is provided. + | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Coding Permissions | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Git Artifact Signed | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| SARIF Update Needed | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Trivy Vulnerability Findings Check | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed +the defined severity threshold. + | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| Required Generic Evidence Exists | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Required Trivy Evidence Exists | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Generic Artifact Signed | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Verify Exposed Credentials | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repository Is Private | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Verify Project Activity | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Unused Users | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| Verify Inactive Users | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify that provenance is authenticated | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify build time | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Enforce 2FA | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| SBOM archived | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Limit admins | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Branch protected | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Code archived | PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Repo private | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From e7361e0774a42761bed8b1f76af2df676acdd99b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:20:08 +0200 Subject: [PATCH 123/191] test gen docs --- .../initiatives/rules/images/allowed-base-image.md | 10 ++++++++++ .../rules/images/allowed-image-source.md | 10 ++++++++++ .../initiatives/rules/images/banned-users.md | 9 +++++++++ .../rules/images/blocklist-build-scripts.md | 10 ++++++++++ .../initiatives/rules/images/forbid-large-images.md | 8 ++++++++ .../initiatives/rules/images/fresh-base-image.md | 8 ++++++++ .../initiatives/rules/images/fresh-image.md | 8 ++++++++ .../initiatives/rules/images/verify-labels-exist.md | 13 +++++++++++++ .../initiatives/rules/images/verify-labels.md | 9 +++++++++ .../initiatives/rules/sarif/report-iac-errors.md | 8 ++++++++ .../rules/sarif/trivy/report-trivy-iac-errors.md | 8 ++++++++ .../rules/sarif/trivy/verify-cve-severity.md | 8 ++++++++ .../rules/sarif/trivy/verify-trivy-attack-vector.md | 10 ++++++++++ .../initiatives/rules/sarif/verify-attack-vector.md | 10 ++++++++++ .../initiatives/rules/sbom/banned-licenses.md | 11 +++++++++++ 15 files changed, 140 insertions(+) diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 255c68c7e..abe83fd26 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -29,6 +29,16 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/allowed-base-image@v2/rules +with: + approved_sources: + - "docker.io/library/*" + - "docker.io/my_org/*" +``` + ## Mitigation Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 9865e69f2..2d7db1851 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -26,6 +26,16 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/allowed-image-source@v2/rules +with: + approved_sources: + - "docker.io/library/*" + - "docker.io/my_org/*" +``` + ## Mitigation Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index aab4b3435..08264a6c6 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -25,6 +25,15 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/banned-users@v2/rules +with: + users: + - root +``` + ## Mitigation Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 13ba61939..3637ccdb5 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -22,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: images/blocklist-build-scripts@v2/rules +with: + blocklist: + - "wget" + - "curl" +``` + ## Mitigation Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 26db45be2..98dfcab34 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -22,6 +22,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: images/forbid-large-images@v2/rules +with: + max_size: 77819980 +``` + ## Mitigation Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index f181f8339..c4128bf4e 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -26,6 +26,14 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/fresh-base-image@v2/rules +with: + max_days: 183 +``` + ## Mitigation Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index e4960acb1..258e50402 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -25,6 +25,14 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/fresh-image@v2/rules +with: + max_days: 183 +``` + ## Mitigation Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index dc28eb44f..9c7256396 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -22,6 +22,19 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: images/verify-labels-exist@v2/rules +with: + labels: + - "org.opencontainers.image.created" + - "org.opencontainers.image.revision" + - "org.opencontainers.image.title" + - "org.opencontainers.image.vendor" + - "org.opencontainers.image.version" +``` + ## Mitigation Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 6998cf3bb..c787eabdd 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -22,6 +22,15 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: images/verify-labels@v2/rules +with: + labels: + - "org.opencontainers.image.vendor=my_vendor" +``` + ## Mitigation Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 68e8d7405..8f5338a31 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -22,6 +22,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/report-iac-errors@v2/rules +with: + violations_threshold: 2 +``` + ## Mitigation Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 8b86015d8..3f5784f97 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -23,6 +23,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Usage example + +```yaml +uses: sarif/trivy/report-trivy-iac-errors@v2/rules +with: + violations_threshold: 2 +``` + ## Mitigation Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 83f191240..f897250e3 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -31,6 +31,14 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Usage example + +```yaml +uses: sarif/trivy/verify-cve-severity@v2/rules +with: + severity_threshold: 2 +``` + ## Mitigation Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index df10b62bb..b75f81df9 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -22,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Usage example + +```yaml +uses: sarif/trivy/verify-trivy-attack-vector@v2/rules +with: + attack_vectors: + - "stack buffer overflow" + violations_threshold: 2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 41b542026..0dec918e8 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -22,6 +22,16 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/verify-attack-vector@v2/rules +with: + attack_vectors: + - "stack buffer overflow" + violations_threshold: 2 +``` + ## Mitigation Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index a5092bc56..8b4ec59cf 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -25,6 +25,17 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/banned-licenses@v2/rules +with: + blocklist: + - "GPL-2.0" + - "GPL-3.0" + blocklisted_limit: 1 +``` + ## Mitigation Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses. From 223cfe7954762f390abda9a963c86b9cded48f74 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:24:29 +0200 Subject: [PATCH 124/191] test gen docs --- docs/configuration/initiatives/index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index b7b9c427c..effc92e24 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -32,7 +32,6 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary From db6ed40052b2dc0ae22c363503a7c5c6a9587373 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:26:57 +0200 Subject: [PATCH 125/191] test gen docs --- docs/configuration/initiatives/index.md | 1 + docs/configuration/initiatives/rules/api/scribe-api-cve.md | 2 +- .../configuration/initiatives/rules/api/scribe-api-published.md | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index effc92e24..b7b9c427c 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -32,6 +32,7 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 9fa9d6e80..ea7f4f767 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -58,5 +58,5 @@ This rule ensures that there are no critical or high severity vulnerabilities in ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format {cve: {max: , severity: }} | +| superset | object | False | The superset of CVEs to check for, including the following format {published: {flag: bool}} | From bda732715548e8db1c6da131d1cffce26e8c5271 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:30:34 +0200 Subject: [PATCH 126/191] test gen docs --- docs/configuration/initiatives/bp1.md | 6 +++--- docs/configuration/initiatives/index.md | 2 -- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 45e99f9e8..0627f0ddc 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -151,7 +151,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | ## [CT-8] Validate artifact digest @@ -214,7 +214,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | ## [CT-12] Validate artifact signatures and digests @@ -258,4 +258,4 @@ Production images should be validated to ensure that controls enforced during ea |---------|-----------|------------------| | [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | | [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index b7b9c427c..4a70b64c5 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -32,7 +32,6 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary @@ -61,7 +60,6 @@ It fails if any banned port is exposed or if no banned ports list is provided. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | From cc539b17fb06bf7f4a92ff8154bad2351f474ee1 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:33:37 +0200 Subject: [PATCH 127/191] test gen docs --- docs/configuration/initiatives/bp1.md | 6 +++--- docs/configuration/initiatives/index.md | 2 ++ docs/configuration/initiatives/rules/api/scribe-api-cve.md | 2 +- .../initiatives/rules/api/scribe-api-published.md | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 0627f0ddc..45e99f9e8 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -151,7 +151,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -214,7 +214,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -258,4 +258,4 @@ Production images should be validated to ensure that controls enforced during ea |---------|-----------|------------------| | [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | | [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| api/scribe-api-cve@v2 | api/scribe-api-cve@v2 | | +| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 4a70b64c5..b7b9c427c 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -32,6 +32,7 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary @@ -60,6 +61,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | | Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index ea7f4f767..5eda63552 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -58,5 +58,5 @@ This rule ensures that there are no critical or high severity vulnerabilities in ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format {cve: {max: int, severity: int}} | +| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index cef947bf2..fda0f7d67 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -51,5 +51,5 @@ This rule ensures that the product is published only after all critical or high ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format {published: {flag: bool}} | +| superset | object | False | The superset of CVEs to check for, including the following format [published: [flag: bool]] | From ba0ce670b69bb1567efe733ad0c8d8fa2068ebae Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:46:28 +0200 Subject: [PATCH 128/191] test gen docs --- docs/configuration/initiatives/index.md | 376 ++++++++++++------------ 1 file changed, 185 insertions(+), 191 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index b7b9c427c..d52d07775 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -5,15 +5,9 @@ | Name | Description | |------|-------------| | [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. - | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines.
| | [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, - addressing requirements from SR-4 and CM-8. - - Provenance data to support architectural traceability, as outlined in SA-8. -Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. - | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:
- A Software Bill of Materials (SBOM) to ensure component inventory and traceability,
addressing requirements from SR-4 and CM-8.
- Provenance data to support architectural traceability, as outlined in SA-8.
Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12.
| | [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/bp1.md) | Blueprint for secure pipelines - Gitlab | | [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | @@ -21,203 +15,203 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | NTIA SBOM Compliance Check | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require SBOM Existence | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require SBOM Existence | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require SBOM Signature | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Require Image Labels | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Fresh Base Image | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Allowed Main Image Source | Ensures the main container image referenced in the SBOM is from an approved source. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Registry Connection HTTPS | Checks if the container's registry scheme is HTTPS - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Fresh Image | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Fresh Image | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Signed Container Image | Enforces that container images (target_type=container) are cryptographically signed. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Forbid Large Images | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Build Scripts | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Forbid Large Images | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Build Scripts | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Require Healthcheck | Checks that the container image includes at least one healthcheck property. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | | Banned Ports | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Coding Permissions | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Git Artifact Signed | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| SARIF Update Needed | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | + | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Unsigned Commits | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Required Git Evidence Exists | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Restrict Coding Permissions | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Git Artifact Signed | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| SARIF Update Needed | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | | Trivy Vulnerability Findings Check | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. - | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| Required Generic Evidence Exists | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Required Trivy Evidence Exists | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Generic Artifact Signed | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Verify Exposed Credentials | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repository Is Private | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Verify Project Activity | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Unused Users | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| Verify Inactive Users | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify that provenance is authenticated | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify build time | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Enforce 2FA | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| SBOM archived | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Limit admins | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Branch protected | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | + | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| Required Generic Evidence Exists | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Required Trivy Evidence Exists | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Generic Artifact Signed | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| Verify Exposed Credentials | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repository Is Private | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Verify Project Activity | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| Disallow Unused Users | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| Verify Inactive Users | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| Verify that provenance is authenticated | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify build time | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Enforce 2FA | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| SBOM archived | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Limit admins | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Branch protected | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | | Code archived | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository - | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Repo private | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file + | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Repo private | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From a68903ec1b5960226d297927c4aaca5ec9cbf40d Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 17:59:54 +0200 Subject: [PATCH 129/191] test gen docs --- docs/configuration/initiatives/index.md | 395 ++++++++++++------------ 1 file changed, 189 insertions(+), 206 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index d52d07775..5be172d5c 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,214 +4,197 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines.
| -| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include:
- A Software Bill of Materials (SBOM) to ensure component inventory and traceability,
addressing requirements from SR-4 and CM-8.
- Provenance data to support architectural traceability, as outlined in SA-8.
Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12.
| -| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/bp1.md) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](docs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](docs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](docs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](docs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](docs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](docs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | ## Rules | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| NTIA SBOM Compliance Check | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. - | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require SBOM Existence | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require SBOM Signature | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Image Labels | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary -including the component names and versions of valid base images, or lists the invalid ones. -This rule requires Dockerfile context; for example, run it with: -`valint my_image --base-image Dockerfile`. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Fresh Base Image | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Allowed Main Image Source | Ensures the main container image referenced in the SBOM is from an approved source. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Registry Connection HTTPS | Checks if the container's registry scheme is HTTPS - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Fresh Image | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Signed Container Image | Enforces that container images (target_type=container) are cryptographically signed. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Forbid Large Images | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Build Scripts | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Require Healthcheck | Checks that the container image includes at least one healthcheck property. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Banned Ports | Ensures that the container image does not expose ports that are disallowed by organizational policy. -The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. -It fails if any banned port is exposed or if no banned ports list is provided. - | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Unsigned Commits | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Required Git Evidence Exists | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Restrict Coding Permissions | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Git Artifact Signed | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| SARIF Update Needed | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Trivy Vulnerability Findings Check | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed -the defined severity threshold. - | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| Required Generic Evidence Exists | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Required Trivy Evidence Exists | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Generic Artifact Signed | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| Verify Exposed Credentials | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repository Is Private | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Verify Project Activity | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| Disallow Unused Users | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| Verify Inactive Users | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| Verify that provenance is authenticated | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify build time | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Enforce 2FA | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| SBOM archived | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Limit admins | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Branch protected | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Code archived | PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository - | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Repo private | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Freshness](rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Specified SBOM Licenses](rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Dependencies](rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Existence](rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce Allowed SBOM Components](rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM License Completeness](rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Apply Scribe Template Policy](rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Scribe Published Policy](rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Image Labels](rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Container Shell Entrypoint](rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Base Image](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Base Image](rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Main Image Source](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Registry Connection HTTPS](rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Image](rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Signed Container Image](rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Forbid Large Images](rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Build Scripts](rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Healthcheck](rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Specific Users in SBOM](rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Image Labels](rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Banned Ports](rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify File Integrity](rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Unsigned Commits](rules/git/no-unsigned-commits.md) | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Required Git Evidence Exists](rules/git/evidence-exists.md) | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Commits to Main Branch](rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Coding Permissions](rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Git Artifact Signed](rules/git/artifact-signed.md) | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Rule Compliance in SARIF](rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Required Evidence in SARIF](rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Semgrep Rule in SARIF](rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Tool Evidence in SARIF](rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [SARIF Update Needed](rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Blocklist CVE Check](rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Vulnerability Findings Check](rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [K8s Jailbreak](rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Required Generic Evidence Exists](rules/generic/evidence-exists.md) | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Required Trivy Evidence Exists](rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Generic Artifact Signed](rules/generic/artifact-signed.md) | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Prevent Long-Lived Tokens](rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| [GitLab pipeline verify labels exist](rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify GitLab Pipeline Labels](rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify DockerHub Tokens are Active](rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Is Private](rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret scanning.](rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed Public Repositories](rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Description Substring](rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Message Substring](rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Container Images](rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods](rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify build time](rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Sign Selected Commits in GitLab](rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Set Push Rules in GitLab](rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Disallow Unsigned Commits In Time Range](rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protection enabled in GitHub repository](rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify Selected Commits Are Signed API](rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From a4f50a9207c2b244050f028bad3fa154669874d6 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:01:05 +0200 Subject: [PATCH 130/191] test gen docs --- docs/configuration/initiatives/index.md | 366 ++++++++++++------------ 1 file changed, 183 insertions(+), 183 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 5be172d5c..98f3d3653 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -15,186 +15,186 @@ | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Freshness](rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Specified SBOM Licenses](rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Dependencies](rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Existence](rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce Allowed SBOM Components](rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM License Completeness](rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Apply Scribe Template Policy](rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Scribe Published Policy](rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Image Labels](rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Container Shell Entrypoint](rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Base Image](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Base Image](rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Main Image Source](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Registry Connection HTTPS](rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Image](rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Signed Container Image](rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Forbid Large Images](rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Build Scripts](rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Healthcheck](rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Specific Users in SBOM](rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Image Labels](rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Banned Ports](rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify File Integrity](rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Unsigned Commits](rules/git/no-unsigned-commits.md) | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Required Git Evidence Exists](rules/git/evidence-exists.md) | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Commits to Main Branch](rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Coding Permissions](rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Git Artifact Signed](rules/git/artifact-signed.md) | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Rule Compliance in SARIF](rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Required Evidence in SARIF](rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Semgrep Rule in SARIF](rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Tool Evidence in SARIF](rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [SARIF Update Needed](rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Blocklist CVE Check](rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Vulnerability Findings Check](rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [K8s Jailbreak](rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Required Generic Evidence Exists](rules/generic/evidence-exists.md) | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Required Trivy Evidence Exists](rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Generic Artifact Signed](rules/generic/artifact-signed.md) | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Prevent Long-Lived Tokens](rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| [GitLab pipeline verify labels exist](rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify GitLab Pipeline Labels](rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify DockerHub Tokens are Active](rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Is Private](rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret scanning.](rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed Public Repositories](rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Description Substring](rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Message Substring](rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Container Images](rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods](rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify build time](rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Sign Selected Commits in GitLab](rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Set Push Rules in GitLab](rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Disallow Unsigned Commits In Time Range](rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protection enabled in GitHub repository](rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify Selected Commits Are Signed API](rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Freshness](rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Specified SBOM Licenses](rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Dependencies](rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Existence](rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce Allowed SBOM Components](rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM License Completeness](rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Apply Scribe Template Policy](rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Scribe Published Policy](rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Image Labels](rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Container Shell Entrypoint](rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Base Image](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Base Image](rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Main Image Source](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Registry Connection HTTPS](rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Image](rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Signed Container Image](rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Forbid Large Images](rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Build Scripts](rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Healthcheck](rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Specific Users in SBOM](rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Image Labels](rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Banned Ports](rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify File Integrity](rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Unsigned Commits](rules/git/no-unsigned-commits.md) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Required Git Evidence Exists](rules/git/evidence-exists.md) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Commits to Main Branch](rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Coding Permissions](rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Git Artifact Signed](rules/git/artifact-signed.md) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Rule Compliance in SARIF](rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Required Evidence in SARIF](rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Semgrep Rule in SARIF](rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Tool Evidence in SARIF](rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [SARIF Update Needed](rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Blocklist CVE Check](rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Vulnerability Findings Check](rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [K8s Jailbreak](rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Required Generic Evidence Exists](rules/generic/evidence-exists.md) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Required Trivy Evidence Exists](rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Generic Artifact Signed](rules/generic/artifact-signed.md) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Prevent Long-Lived Tokens](rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [GitLab pipeline verify labels exist](rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify GitLab Pipeline Labels](rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify DockerHub Tokens are Active](rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Is Private](rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret scanning.](rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed Public Repositories](rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Description Substring](rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Message Substring](rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Container Images](rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods](rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify build time](rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Sign Selected Commits in GitLab](rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Set Push Rules in GitLab](rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Disallow Unsigned Commits In Time Range](rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protection enabled in GitHub repository](rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify Selected Commits Are Signed API](rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From 052ac5d8c7cc4c83ca79dbab2a4036c6e28543b1 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:03:26 +0200 Subject: [PATCH 131/191] test gen docs --- docs/configuration/initiatives/index.md | 378 ++++++++++++------------ 1 file changed, 189 insertions(+), 189 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 98f3d3653..b13fd5329 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,197 +4,197 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](docs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](docs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](docs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](docs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](docs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](docs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | ## Rules | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Freshness](rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Specified SBOM Licenses](rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Dependencies](rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Existence](rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce Allowed SBOM Components](rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM License Completeness](rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Apply Scribe Template Policy](rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Scribe Published Policy](rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Image Labels](rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Container Shell Entrypoint](rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Base Image](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Base Image](rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Main Image Source](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Registry Connection HTTPS](rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Image](rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Signed Container Image](rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Forbid Large Images](rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Build Scripts](rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Healthcheck](rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Specific Users in SBOM](rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Image Labels](rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Banned Ports](rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify File Integrity](rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Unsigned Commits](rules/git/no-unsigned-commits.md) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Required Git Evidence Exists](rules/git/evidence-exists.md) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Commits to Main Branch](rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Coding Permissions](rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Git Artifact Signed](rules/git/artifact-signed.md) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Rule Compliance in SARIF](rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Required Evidence in SARIF](rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Semgrep Rule in SARIF](rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Tool Evidence in SARIF](rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [SARIF Update Needed](rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Blocklist CVE Check](rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Vulnerability Findings Check](rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [K8s Jailbreak](rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Required Generic Evidence Exists](rules/generic/evidence-exists.md) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Required Trivy Evidence Exists](rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Generic Artifact Signed](rules/generic/artifact-signed.md) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Prevent Long-Lived Tokens](rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [GitLab pipeline verify labels exist](rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify GitLab Pipeline Labels](rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify DockerHub Tokens are Active](rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Is Private](rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret scanning.](rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed Public Repositories](rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Description Substring](rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Message Substring](rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Container Images](rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods](rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify build time](rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Sign Selected Commits in GitLab](rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Set Push Rules in GitLab](rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Disallow Unsigned Commits In Time Range](rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protection enabled in GitHub repository](rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify Selected Commits Are Signed API](rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Existence](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Signature](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Scribe Published Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Signed Container Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Forbid Large Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Banned Ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify File Integrity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Git Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [SARIF Update Needed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [K8s Jailbreak](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret scanning.](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Description Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Message Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Container Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify build time](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Enforce 2FA](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [SBOM archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Limit admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protected](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Code archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Require signoff on web commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Repo private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Image-verifiable](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From 7e0426ed44cb633f9eae911ed8b16660a73fa689 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:04:15 +0200 Subject: [PATCH 132/191] test gen docs --- docs/configuration/initiatives/index.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index b13fd5329..d52053d99 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,12 +4,12 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiativesdocs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | ## Rules From ce5bcfa204da1bf3f3f8abda956d51070bd489a0 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:10:54 +0200 Subject: [PATCH 133/191] test gen docs --- docs/configuration/initiatives/index.md | 378 ++++++++++++------------ 1 file changed, 189 insertions(+), 189 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index d52053d99..6a1f94665 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,197 +4,197 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/slsa.l1.md) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/slsa.l2.md) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/bp1.md) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/docs/initiative/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | ## Rules | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Existence](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Signature](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Scribe Published Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Signed Container Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Forbid Large Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Banned Ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify File Integrity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Git Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [SARIF Update Needed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [K8s Jailbreak](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret scanning.](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Description Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Message Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Container Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify build time](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Enforce 2FA](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [SBOM archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Limit admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protected](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Code archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Require signoff on web commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Repo private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Image-verifiable](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Existence](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require SBOM Signature](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Scribe Published Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Fresh Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Signed Container Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Forbid Large Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Require Healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Banned Ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify File Integrity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Git Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [SARIF Update Needed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [K8s Jailbreak](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | +| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | +| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret scanning.](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Description Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Check Message Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Container Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Allowed Pods](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify build time](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Enforce 2FA](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [SBOM archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Limit admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protected](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Code archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Require signoff on web commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Repo private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Image-verifiable](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | +| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file From 2e3b9eeeb2418c18aa1755b0f2a54c6cdb3ae1de Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:11:49 +0200 Subject: [PATCH 134/191] test gen docs --- docs/configuration/initiatives/bp1.md | 24 +- docs/configuration/initiatives/index.md | 378 +++++++++--------- .../rules/bitbucket/project/allow-admins.md | 2 +- .../rules/bitbucket/project/allow-users.md | 2 +- .../bitbucket/project/exposed-credentials.md | 2 +- .../bitbucket/project/long-live-tokens.md | 2 +- .../bitbucket/repository/allow-admins.md | 2 +- .../rules/bitbucket/repository/allow-users.md | 2 +- .../bitbucket/repository/branch-protection.md | 2 +- .../rules/bitbucket/workspace/allow-admins.md | 2 +- .../rules/bitbucket/workspace/allow-users.md | 2 +- .../rules/dockerhub/token-expiration.md | 2 +- .../rules/dockerhub/token-not-used.md | 2 +- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 2 +- .../rules/git/coding-permissions.md | 2 +- .../initiatives/rules/git/evidence-exists.md | 2 +- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../initiatives/rules/github/org/2fa.md | 2 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/github/org/allow-users.md | 2 +- .../rules/github/org/create-private-repos.md | 2 +- .../rules/github/org/create-repos.md | 2 +- .../rules/github/org/dependabot-alerts.md | 2 +- .../org/dependabot-security-updates-sa.md | 2 +- .../github/org/dependabot-security-updates.md | 2 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/max-admins.md | 2 +- .../rules/github/org/old-secrets.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/repo-visibility.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/github/org/web-commit-signoff.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../github/repository/branch-verification.md | 2 +- .../github/repository/check-signed-commits.md | 2 +- .../repository/default-branch-protection.md | 2 +- .../rules/github/repository/dependabot.md | 2 +- .../repository/ephemeral-runners-only.md | 2 +- .../rules/github/repository/no-cache-usage.md | 2 +- .../rules/github/repository/no-org-secrets.md | 2 +- .../rules/github/repository/old-secrets.md | 2 +- .../github/repository/push-protection.md | 2 +- .../rules/github/repository/repo-private.md | 2 +- .../github/repository/secret-scanning.md | 2 +- .../rules/github/repository/signed-commits.md | 2 +- .../github/repository/validity-checks.md | 2 +- .../rules/github/repository/visibility.md | 2 +- .../github/repository/web-commit-signoff.md | 2 +- .../rules/gitlab/org/allow-admins.md | 2 +- .../rules/gitlab/org/allow-token-scopes.md | 2 +- .../rules/gitlab/org/allow-users.md | 2 +- .../rules/gitlab/org/blocked-users.md | 2 +- .../rules/gitlab/org/expiring-tokens.md | 2 +- .../rules/gitlab/org/forbid-token-scopes.md | 2 +- .../rules/gitlab/org/inactive-projects.md | 2 +- .../rules/gitlab/org/longlive-tokens.md | 2 +- .../rules/gitlab/org/max-admins.md | 2 +- .../rules/gitlab/org/projects-visibility.md | 2 +- .../rules/gitlab/org/unused-tokens.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/gitlab/project/abandoned-project.md | 2 +- .../gitlab/project/approvals-policy-check.md | 2 +- .../project/approvers-per-merge-request.md | 2 +- .../gitlab/project/author-email-regex.md | 2 +- .../rules/gitlab/project/check-cwe.md | 2 +- .../gitlab/project/check-signed-commits.md | 2 +- .../gitlab/project/co-approval-required.md | 2 +- .../project/commit-author-email-check.md | 2 +- .../project/commit-author-name-check.md | 2 +- .../gitlab/project/commit-committer-check.md | 2 +- .../gitlab/project/commit-message-check.md | 2 +- .../rules/gitlab/project/commits-validated.md | 2 +- .../gitlab/project/committer-email-check.md | 2 +- .../gitlab/project/committer-name-check.md | 2 +- .../gitlab/project/critical-severity-limit.md | 2 +- .../project/description-substring-check.md | 2 +- .../project/disallowed-banned-approvers.md | 2 +- .../gitlab/project/force-push-protection.md | 2 +- .../gitlab/project/medium-severity-limit.md | 2 +- .../rules/gitlab/project/member-check.md | 2 +- .../gitlab/project/merge-access-level.md | 2 +- .../project/merge-requests-author-approval.md | 2 +- ...ge-requests-disable-committers-approval.md | 2 +- .../gitlab/project/message-substring-check.md | 2 +- .../gitlab/project/prevent-secrets-check.md | 2 +- .../gitlab/project/protect-ci-secrets.md | 2 +- .../rules/gitlab/project/push-access-level.md | 2 +- .../rules/gitlab/project/push-rules-set.md | 2 +- .../gitlab/project/reject-unsigned-commits.md | 2 +- .../project/require-password-to-approve.md | 2 +- .../project/required-minimal-approvers.md | 2 +- .../gitlab/project/reset-pprovals-on-push.md | 2 +- .../rules/gitlab/project/sast-scan-pass.md | 2 +- .../rules/gitlab/project/sast-scanning.md | 2 +- .../rules/gitlab/project/secrets-scan-pass.md | 2 +- .../rules/gitlab/project/secrets-scanning.md | 2 +- .../project/selective-code-owner-removals.md | 2 +- .../rules/gitlab/project/visibility-check.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 2 +- .../rules/jenkins/instance/unused-users.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 2 +- .../k8s/namespace/white-listed-namespaces.md | 2 +- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- .../rules/slsa/banned-builder-deps.md | 2 +- .../initiatives/rules/slsa/build-time.md | 2 +- .../initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- .../initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 +- docs/configuration/initiatives/sp-800-190.md | 24 +- docs/configuration/initiatives/sp-800-53.md | 12 +- docs/configuration/initiatives/ssdf.md | 16 +- 180 files changed, 403 insertions(+), 403 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 45e99f9e8..14356dc18 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -62,7 +62,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -83,8 +83,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -105,7 +105,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -126,7 +126,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -151,7 +151,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -193,7 +193,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -214,7 +214,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -235,7 +235,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -256,6 +256,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 6a1f94665..4d971e11e 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,197 +4,197 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | ## Rules | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Existence](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require SBOM Signature](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Scribe Published Policy](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Base Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Fresh Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Signed Container Image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Forbid Large Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Require Healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Image Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Banned Ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify File Integrity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Git Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/docs/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [SARIF Update Needed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [K8s Jailbreak](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/docs/valint/sarif) | -| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover) | -| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret scanning.](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Description Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Check Message Substring](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Container Images](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Allowed Pods](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify build time](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Enforce 2FA](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [SBOM archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Limit admins](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protected](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Code archived](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Require signoff on web commits](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Repo private](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Image-verifiable](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | -| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/docs/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Existence](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Signature](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Scribe Published Policy](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require Image Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Allowed Base Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Fresh Base Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Fresh Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require Signed Container Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Forbid Large Images](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Require Healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Verify Image Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Banned Ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Verify File Integrity](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Git Artifact Signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [SARIF Update Needed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [K8s Jailbreak](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | +| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | +| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | +| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | +| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | +| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | +| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | +| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret scanning.](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check Description Substring](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check Message Substring](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Container Images](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Pods](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify build time](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Enforce 2FA](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [SBOM archived](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Limit admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Branch protected](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Code archived](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Require signoff on web commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Repo private](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Image-verifiable](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/valint/generic) | +| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/valint/generic) | \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 51f0406b2..d285df38a 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index b62d0feb3..15af43d05 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 16fe5d0ad..9b37f3784 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -13,7 +13,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 8f8fd9623..819ef7f59 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -13,7 +13,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index e1d7a84c3..7b2495832 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index e166c227b..c8d3a3195 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index de230fe7f..7fd8e80f5 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 549d01398..a4c88050f 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 81b6ef662..905cca599 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 5146cfd98..9d5899d37 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index bcd4df90a..2b0877314 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 525b101fd..93ee82e4e 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -13,7 +13,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Signed Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 60ef06759..0147b8141 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 119d13b24..cd09ec361 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 92e365d5f..5c6f5aa8b 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index b9c5dc826..5c578813b 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -13,7 +13,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 0de7e8f54..d0ddc0ab0 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index b22b6998c..59489c60d 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 5cbdd1be6..aa7d7d1ac 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index 6d5d7759c..b23300f11 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index bf7a3868d..052376fee 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -13,7 +13,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index d2b51b9c1..7f5c4e2b0 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -13,7 +13,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 787d0fa2b..e5f20d2c1 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 0acd2886d..c285b7986 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 0f52d1bf0..6f6ff0733 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index a87cf0280..639b62aed 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index ded316de4..0749e7a6a 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -13,7 +13,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 7dc3276b2..c688c5d2f 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index c4bef2b2b..56ace842e 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 4a6950e39..8e48e8965 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -13,7 +13,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 60cd3acda..aa2e69833 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 5acd98409..b0e4e368e 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 98afcf2c9..0fa49b4f9 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 10e9ab7a7..a3723d68d 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 055262acb..8950c2935 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -14,7 +14,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index b3c3f401c..fd09bce85 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -13,7 +13,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 1f90f6e69..483f098b6 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 030427051..998cf1d37 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 19f1f93b7..9d48f2cdf 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 7a0d3acbd..5582c40f9 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 09749c7b4..a6b7381e8 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 5d2ecd117..5a0439559 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 0d85d0826..0cc1bc4a6 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -13,7 +13,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 81aa91395..375bfa1dd 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index d840f52fd..17781b19a 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index bee7de249..1f2564713 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -13,7 +13,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index d6903db6e..67b1a8130 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -13,7 +13,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index b96d806a6..d725f3df8 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -13,7 +13,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 34a726c72..868896ddd 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -13,7 +13,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 2771a4d25..8d210e71c 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -13,7 +13,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index cfafeb991..366ceb0ba 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -13,7 +13,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 66e4f864e..dfbae4558 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -13,7 +13,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 25e4c0492..a30046182 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 3522a9b53..d3766e71f 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 085e3e3f9..d2a5f96ad 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -13,7 +13,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 4d3f92e25..85e903ed0 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -13,7 +13,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 292d18460..0b5759a36 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 03073daa3..fbf5b6972 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 2c1f2f4ca..55a9e66f5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -13,7 +13,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 6de10d5c8..dbaac5462 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index d8eba9536..c854cf1b2 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -13,7 +13,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index f40cfc750..55d0436e9 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -13,7 +13,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index a27633102..567b0d6a7 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -13,7 +13,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 7615cc919..bc798bb94 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -13,7 +13,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index a1457309d..371c1c9c4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -13,7 +13,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 8b4c63691..f3f8917b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index acd796208..56e67dea4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -13,7 +13,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index aae47c2bc..76760a449 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -13,7 +13,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 5aeb19514..c677ea3b5 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index da3ec8391..5f566053e 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 706668b1a..57626f6b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -13,7 +13,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index bc034027e..b2f1ffa1c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -13,7 +13,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 5a49ddd19..6c6fca867 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -13,7 +13,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index e49c0db4c..01d4451e5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -13,7 +13,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 106e8c273..c3376ca11 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -13,7 +13,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 3561d047f..015218884 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -13,7 +13,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index a7bcfe865..3ab43e32c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -13,7 +13,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 65b1842f2..063ebb5d5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -13,7 +13,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 386a31717..b47b73d1d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -13,7 +13,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 92c35ca03..899b64ed5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -13,7 +13,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 1e8ffedcd..0315a0f7a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -13,7 +13,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 723dfa631..a2c1ab5bd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -13,7 +13,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 9faee5f67..68f045349 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 6824f1542..c3025b05c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index cbb1d877b..48b6bd82f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index 1e174e951..2bc9c3102 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -13,7 +13,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 19baaa598..f59b0ecdb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -13,7 +13,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 5914e5e78..037c280b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -13,7 +13,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index f8c6a9a52..5b05a3979 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index e89f507df..5de866567 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -13,7 +13,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 59e64d5dd..3b3b006a9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -13,7 +13,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index fe147bc22..5d8a12bef 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -13,7 +13,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 9ae094144..b8af11347 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -13,7 +13,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 58eeb7960..192aea572 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -13,7 +13,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 2f77caa97..d88c9633b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -13,7 +13,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index dd4b6b66b..b8de6aabd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -13,7 +13,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index fd4a3ff62..34f6689f4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -13,7 +13,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 3519d04f2..90cfe35a9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -13,7 +13,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index e7b3b9aa6..a076e569a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -13,7 +13,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index ab1e55637..cde1277cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -13,7 +13,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 9522b2231..9d8b513b0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -13,7 +13,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 528c56975..f6ae8dd6a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -13,7 +13,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 8add92175..58aa6dced 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index a3df4593b..b05f7009f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -13,7 +13,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index fb4969c1a..dc38340af 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 58c72be1b..fb738e6a0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -13,7 +13,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 685952dd7..15e277d85 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -13,7 +13,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index b6f34d03b..6569f3fd7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -13,7 +13,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index abe83fd26..a9a6a76b0 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 2d7db1851..46c0d7130 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 385559573..e1a239882 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 08264a6c6..0ebb4573b 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 3637ccdb5..1fbbfa6b7 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index af6b9165f..a869a7340 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 98dfcab34..f3f62dff5 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index c4128bf4e..d3ccc6d99 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 258e50402..891f176f3 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index d8a6147eb..b748b0120 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 034264226..63b6a70fa 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index eb2bc0d9c..1ae6a997c 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 9c7256396..732fa49f5 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index c787eabdd..c253c306d 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 3f4d5417c..8bf080713 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 9d0942d3a..e707e144b 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -13,7 +13,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index c3b778faf..d74cfe65a 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -13,7 +13,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 3810a13bc..8dafffc2f 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 2a9492aa5..cb7127059 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 13d9320a5..cef6f251c 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index f3d3239de..eca5b8e11 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 59ef3ce57..d6826a061 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 844cb5f4f..7723f52ed 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 0b2d56ae8..41f59be48 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 5db4c685a..d75993888 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 8c9246650..33faa5064 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index 80e190328..e6be9ef92 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 4b53a9ab8..1eecae50d 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -13,7 +13,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires Signed SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index bbf45f729..1909ff4c0 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -13,7 +13,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 92d46f3cb..e220be463 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 8f5338a31..5872401dc 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 999bd1e56..1c7322f3c 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 3f5784f97..fac7aaa28 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index f897250e3..276882722 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -16,7 +16,7 @@ the defined severity threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index b75f81df9..f49f1fc7e 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 18a3e2777..497ae94d2 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 0dec918e8..4b43443df 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 5afa68734..8382657be 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 5b96d7a50..cdce7aef6 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index b4b2b4760..7e2e181f9 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -13,7 +13,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 3b7901c99..3b889efcf 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,7 +14,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 7038b9587..ec3cd2126 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 360137f81..a41cec37b 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -13,7 +13,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 8b4ec59cf..cd88d68dc 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 647c6c882..c93df5922 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 2930d7e0b..d124ec037 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 21e6a8631..8525eda66 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index fddf26fb0..4f1c632ac 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -13,7 +13,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 4427b6a92..d56648926 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 1ff527905..f6ff996cc 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 4c9e24541..c758c9406 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 237dc67e3..bf24d6e90 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index fb8c7b126..e23b08099 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index c8651fc5f..7d2404547 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -14,7 +14,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index aa98740b1..ba1feeaae 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -14,7 +14,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires Signed SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 008ace0be..b24b63265 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 6b1b2e9e3..5002058b3 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index a5e9828f4..fdfee36de 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index fc4df69e0..1a1f67c0e 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 070abc625..3300d812f 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 81f34f244..a0f6ec543 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 27dea480e..83928c98c 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index c152b847d..5342bf53d 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 42f570387..1a0ed8fe5 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index e26ccb803..362870bcb 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 01ef16f39..36d801043 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -45,4 +45,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index a9f31f96f..927f60fd5 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -45,5 +45,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 12b060a93..cf99c6064 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -48,23 +48,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -81,9 +81,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 033b710fc..8e4fb3962 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -51,10 +51,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -70,7 +70,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -85,5 +85,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 60b72e3b1..be5c34990 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -51,8 +51,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## SSDF-ORG @@ -67,9 +67,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## SSDF-REPO @@ -84,8 +84,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 91a4a3ec99243e1d42659edd241352a6f062fe72 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:13:36 +0200 Subject: [PATCH 135/191] test gen docs --- docs/configuration/initiatives/bp1.md | 24 +- docs/configuration/initiatives/index.md | 378 +++++++++--------- .../rules/bitbucket/project/allow-admins.md | 2 +- .../rules/bitbucket/project/allow-users.md | 2 +- .../bitbucket/project/exposed-credentials.md | 2 +- .../bitbucket/project/long-live-tokens.md | 2 +- .../bitbucket/repository/allow-admins.md | 2 +- .../rules/bitbucket/repository/allow-users.md | 2 +- .../bitbucket/repository/branch-protection.md | 2 +- .../rules/bitbucket/workspace/allow-admins.md | 2 +- .../rules/bitbucket/workspace/allow-users.md | 2 +- .../rules/dockerhub/token-expiration.md | 2 +- .../rules/dockerhub/token-not-used.md | 2 +- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 2 +- .../rules/git/coding-permissions.md | 2 +- .../initiatives/rules/git/evidence-exists.md | 2 +- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../initiatives/rules/github/org/2fa.md | 2 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/github/org/allow-users.md | 2 +- .../rules/github/org/create-private-repos.md | 2 +- .../rules/github/org/create-repos.md | 2 +- .../rules/github/org/dependabot-alerts.md | 2 +- .../org/dependabot-security-updates-sa.md | 2 +- .../github/org/dependabot-security-updates.md | 2 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/max-admins.md | 2 +- .../rules/github/org/old-secrets.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/repo-visibility.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/github/org/web-commit-signoff.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../github/repository/branch-verification.md | 2 +- .../github/repository/check-signed-commits.md | 2 +- .../repository/default-branch-protection.md | 2 +- .../rules/github/repository/dependabot.md | 2 +- .../repository/ephemeral-runners-only.md | 2 +- .../rules/github/repository/no-cache-usage.md | 2 +- .../rules/github/repository/no-org-secrets.md | 2 +- .../rules/github/repository/old-secrets.md | 2 +- .../github/repository/push-protection.md | 2 +- .../rules/github/repository/repo-private.md | 2 +- .../github/repository/secret-scanning.md | 2 +- .../rules/github/repository/signed-commits.md | 2 +- .../github/repository/validity-checks.md | 2 +- .../rules/github/repository/visibility.md | 2 +- .../github/repository/web-commit-signoff.md | 2 +- .../rules/gitlab/org/allow-admins.md | 2 +- .../rules/gitlab/org/allow-token-scopes.md | 2 +- .../rules/gitlab/org/allow-users.md | 2 +- .../rules/gitlab/org/blocked-users.md | 2 +- .../rules/gitlab/org/expiring-tokens.md | 2 +- .../rules/gitlab/org/forbid-token-scopes.md | 2 +- .../rules/gitlab/org/inactive-projects.md | 2 +- .../rules/gitlab/org/longlive-tokens.md | 2 +- .../rules/gitlab/org/max-admins.md | 2 +- .../rules/gitlab/org/projects-visibility.md | 2 +- .../rules/gitlab/org/unused-tokens.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/gitlab/project/abandoned-project.md | 2 +- .../gitlab/project/approvals-policy-check.md | 2 +- .../project/approvers-per-merge-request.md | 2 +- .../gitlab/project/author-email-regex.md | 2 +- .../rules/gitlab/project/check-cwe.md | 2 +- .../gitlab/project/check-signed-commits.md | 2 +- .../gitlab/project/co-approval-required.md | 2 +- .../project/commit-author-email-check.md | 2 +- .../project/commit-author-name-check.md | 2 +- .../gitlab/project/commit-committer-check.md | 2 +- .../gitlab/project/commit-message-check.md | 2 +- .../rules/gitlab/project/commits-validated.md | 2 +- .../gitlab/project/committer-email-check.md | 2 +- .../gitlab/project/committer-name-check.md | 2 +- .../gitlab/project/critical-severity-limit.md | 2 +- .../project/description-substring-check.md | 2 +- .../project/disallowed-banned-approvers.md | 2 +- .../gitlab/project/force-push-protection.md | 2 +- .../gitlab/project/medium-severity-limit.md | 2 +- .../rules/gitlab/project/member-check.md | 2 +- .../gitlab/project/merge-access-level.md | 2 +- .../project/merge-requests-author-approval.md | 2 +- ...ge-requests-disable-committers-approval.md | 2 +- .../gitlab/project/message-substring-check.md | 2 +- .../gitlab/project/prevent-secrets-check.md | 2 +- .../gitlab/project/protect-ci-secrets.md | 2 +- .../rules/gitlab/project/push-access-level.md | 2 +- .../rules/gitlab/project/push-rules-set.md | 2 +- .../gitlab/project/reject-unsigned-commits.md | 2 +- .../project/require-password-to-approve.md | 2 +- .../project/required-minimal-approvers.md | 2 +- .../gitlab/project/reset-pprovals-on-push.md | 2 +- .../rules/gitlab/project/sast-scan-pass.md | 2 +- .../rules/gitlab/project/sast-scanning.md | 2 +- .../rules/gitlab/project/secrets-scan-pass.md | 2 +- .../rules/gitlab/project/secrets-scanning.md | 2 +- .../project/selective-code-owner-removals.md | 2 +- .../rules/gitlab/project/visibility-check.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 2 +- .../rules/jenkins/instance/unused-users.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 2 +- .../k8s/namespace/white-listed-namespaces.md | 2 +- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- .../rules/slsa/banned-builder-deps.md | 2 +- .../initiatives/rules/slsa/build-time.md | 2 +- .../initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- .../initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 +- docs/configuration/initiatives/sp-800-190.md | 24 +- docs/configuration/initiatives/sp-800-53.md | 12 +- docs/configuration/initiatives/ssdf.md | 16 +- 180 files changed, 403 insertions(+), 403 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 14356dc18..65d8e12d5 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -62,7 +62,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [gitlab-org-max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CT-2] Only accept commits signed with a developer GPG key @@ -83,8 +83,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [gitlab-project-disallow-unsigned-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CT-3] Automation access keys expire automatically @@ -105,7 +105,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [gitlab-org-token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CT-4] Reduce automation access to read-only @@ -126,7 +126,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [gitlab-org-disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CT-6] Any critical or high severity vulnerability breaks the build @@ -151,7 +151,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-8] Validate artifact digest @@ -193,7 +193,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [gitlab-project-merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CT-11] Available container images don’t have any high or critical vulnerabilities @@ -214,7 +214,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CT-12] Validate artifact signatures and digests @@ -235,7 +235,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CT-13] Scan deployed images in production @@ -256,6 +256,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 4d971e11e..3ba1a296b 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -4,197 +4,197 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | +| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | ## Rules | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM Freshness](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require Specified SBOM Licenses](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM Dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [NTIA SBOM Compliance Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Existence](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Enforce Allowed SBOM Components](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM License Completeness](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Signature](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Apply Scribe Template Policy](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Scribe Published Policy](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require Image Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Disallow Container Shell Entrypoint](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Allowed Base Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Fresh Base Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Allowed Main Image Source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Registry Connection HTTPS](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Fresh Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require Signed Container Image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Forbid Large Images](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Restrict Build Scripts](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Require Healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Disallow Specific Users in SBOM](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Verify Image Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Banned Ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Verify File Integrity](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Restrict Disallowed Dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Disallow Unsigned Commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Required Git Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Disallow Commits to Main Branch](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Restrict Coding Permissions](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Git Artifact Signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://scribe-security.netlify.app/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Rule Compliance in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Required Evidence in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Semgrep Rule in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Tool Evidence in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [SARIF Update Needed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Trivy Blocklist CVE Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Trivy Vulnerability Findings Check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [K8s Jailbreak](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://scribe-security.netlify.app/valint/sarif) | -| [Required Generic Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | -| [Required Trivy Evidence Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | -| [Generic Artifact Signed](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://scribe-security.netlify.app/valint/generic) | -| [Prevent Long-Lived Tokens](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | -| [GitLab pipeline verify labels exist](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | -| [Verify GitLab Pipeline Labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://scribe-security.netlify.app/platforms/discover) | -| [Verify DockerHub Tokens are Active](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repository Is Private](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret scanning.](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed Public Repositories](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check Description Substring](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check Message Substring](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Container Images](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify build time](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://scribe-security.netlify.app/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Sign Selected Commits in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Set Push Rules in GitLab](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Enforce 2FA](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [SBOM archived](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Limit admins](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Branch protected](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Code archived](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Require signoff on web commits](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Repo private](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Image-verifiable](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Disallow Unsigned Commits In Time Range](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Branch protection enabled in GitHub repository](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://scribe-security.netlify.app/valint/generic) | -| [Verify Selected Commits Are Signed API](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://scribe-security.netlify.app/valint/generic) | \ No newline at end of file +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) | +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index d285df38a..934bbbca8 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 15af43d05..dbb386d93 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 9b37f3784..37aea5ed6 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -13,7 +13,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 819ef7f59..99a423104 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -13,7 +13,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 7b2495832..8cbf7fb47 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index c8d3a3195..7a22799b1 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 7fd8e80f5..825dfc978 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index a4c88050f..5d8a857ef 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 905cca599..0e43f2b70 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 9d5899d37..b01b31533 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 2b0877314..3ded9c542 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 93ee82e4e..2917b47ef 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -13,7 +13,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 0147b8141..22221a0fe 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index cd09ec361..39afd1720 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 5c6f5aa8b..73b40dd7d 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Generic Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 5c578813b..2f1aa7b81 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -13,7 +13,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index d0ddc0ab0..4f9444ff5 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 59489c60d..7348f614a 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index aa7d7d1ac..fc197b904 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index b23300f11..def24f262 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 052376fee..2a8488cf6 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -13,7 +13,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 7f5c4e2b0..6ed759530 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -13,7 +13,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index e5f20d2c1..89599f795 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index c285b7986..988cf73ec 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 6f6ff0733..209fd14b5 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 639b62aed..64ce2379c 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 0749e7a6a..42e3a6efa 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -13,7 +13,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index c688c5d2f..22f3adb35 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 56ace842e..7956e64d2 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 8e48e8965..910faa028 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -13,7 +13,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index aa2e69833..85b2b2b69 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index b0e4e368e..54b24f34d 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 0fa49b4f9..c2a6daea7 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index a3723d68d..dc2bffe5d 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 8950c2935..33ff8c5f6 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -14,7 +14,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index fd09bce85..44d6a2217 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -13,7 +13,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 483f098b6..32bfe2a76 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 998cf1d37..261afff50 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 9d48f2cdf..78fda54b1 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 5582c40f9..4c22fd1e4 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index a6b7381e8..673c12709 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 5a0439559..b894a20a9 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 0cc1bc4a6..a405b1b16 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -13,7 +13,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 375bfa1dd..f5fd720a2 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 17781b19a..fdfd24a1b 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 1f2564713..9492af752 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -13,7 +13,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 67b1a8130..ba1382e7e 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -13,7 +13,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index d725f3df8..3f8fe057f 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -13,7 +13,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 868896ddd..c9cf95629 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -13,7 +13,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 8d210e71c..5d2f5fd06 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -13,7 +13,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 366ceb0ba..d863b1b53 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -13,7 +13,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index dfbae4558..ed82a1378 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -13,7 +13,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index a30046182..6667f2a99 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index d3766e71f..d28625af9 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index d2a5f96ad..7ab444790 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -13,7 +13,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 85e903ed0..bb2134616 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -13,7 +13,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 0b5759a36..99d0d29d9 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index fbf5b6972..47334c1ed 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 55a9e66f5..807bf8507 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -13,7 +13,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index dbaac5462..2081bf272 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index c854cf1b2..7db84cdc0 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -13,7 +13,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index 55d0436e9..dd4ee66ea 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -13,7 +13,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 567b0d6a7..87deffc1e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -13,7 +13,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index bc798bb94..af4e48288 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -13,7 +13,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 371c1c9c4..f40f63ed3 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -13,7 +13,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index f3f8917b6..527965a58 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 56e67dea4..9d1c66c97 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -13,7 +13,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 76760a449..a5ebc847d 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -13,7 +13,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index c677ea3b5..9df82e5c5 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index 5f566053e..dbd3bf258 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 57626f6b8..df85b81e2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -13,7 +13,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index b2f1ffa1c..efc49aae7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -13,7 +13,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 6c6fca867..52f269abd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -13,7 +13,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index 01d4451e5..3b4b06223 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -13,7 +13,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index c3376ca11..d60b4377b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -13,7 +13,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 015218884..539c25e11 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -13,7 +13,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 3ab43e32c..13263990b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -13,7 +13,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 063ebb5d5..493e80d0c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -13,7 +13,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index b47b73d1d..253b6359c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -13,7 +13,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 899b64ed5..43bf3f371 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -13,7 +13,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 0315a0f7a..86418c640 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -13,7 +13,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index a2c1ab5bd..3e4588c99 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -13,7 +13,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 68f045349..b25f2f9bc 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index c3025b05c..61a671818 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 48b6bd82f..a1f26cb13 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index 2bc9c3102..e9f46ed8a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -13,7 +13,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index f59b0ecdb..84551fdec 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -13,7 +13,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 037c280b8..206a299c2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -13,7 +13,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 5b05a3979..d4adead00 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 5de866567..d8092c8cd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -13,7 +13,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 3b3b006a9..e39c71110 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -13,7 +13,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 5d8a12bef..faa1a0cb7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -13,7 +13,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index b8af11347..298bd272d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -13,7 +13,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 192aea572..d36e50548 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -13,7 +13,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index d88c9633b..7df8bf61c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -13,7 +13,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index b8de6aabd..1162289a1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -13,7 +13,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 34f6689f4..34f462a1c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -13,7 +13,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 90cfe35a9..ff581119e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -13,7 +13,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index a076e569a..4d8d745c8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -13,7 +13,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index cde1277cb..0bcbea9e7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -13,7 +13,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 9d8b513b0..446d41f0a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -13,7 +13,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index f6ae8dd6a..2cede0d5c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -13,7 +13,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 58aa6dced..4f945318a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index b05f7009f..35fef07cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -13,7 +13,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index dc38340af..8cd54fb8e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index fb738e6a0..b6f9323ef 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -13,7 +13,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 15e277d85..10e339523 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -13,7 +13,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 6569f3fd7..56ba542ea 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -13,7 +13,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index a9a6a76b0..c3d388068 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 46c0d7130..602abe860 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index e1a239882..37ad6ed31 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -16,7 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 0ebb4573b..b0ac82c5e 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 1fbbfa6b7..5506692dc 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index a869a7340..8ead1a091 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index f3f62dff5..4cac5c3dc 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index d3ccc6d99..efea01d97 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 891f176f3..019c85073 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index b748b0120..e14d1b397 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -14,7 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 63b6a70fa..5a07f96ff 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 1ae6a997c..7240bd0fd 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 732fa49f5..853cafa03 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index c253c306d..965c1ff95 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 8bf080713..b1f7925b5 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index e707e144b..8220a73bc 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -13,7 +13,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index d74cfe65a..d9d7e37d6 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -13,7 +13,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 8dafffc2f..021754215 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index cb7127059..7f21e779d 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index cef6f251c..790853f93 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index eca5b8e11..2e7c91285 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index d6826a061..ba5b79c8d 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 7723f52ed..f25805e33 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 41f59be48..80168c2cf 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index d75993888..e92c72314 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 33faa5064..42c13d9f5 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index e6be9ef92..aa7ab9a2a 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 1eecae50d..b3f366e6c 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -13,7 +13,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 1909ff4c0..0152a2397 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -13,7 +13,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index e220be463..a64e7d4ec 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index 5872401dc..ff5091e83 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 1c7322f3c..6c3d45eb6 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index fac7aaa28..b308b98c0 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 276882722..023c90fa1 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -16,7 +16,7 @@ the defined severity threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index f49f1fc7e..72a3eac65 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 497ae94d2..43f6ee033 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 4b43443df..8589ad963 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 8382657be..fce291346 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index cdce7aef6..8bf560212 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 7e2e181f9..feef1846e 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -13,7 +13,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 3b889efcf..eaf1aafb9 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -14,7 +14,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index ec3cd2126..7ba337691 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index a41cec37b..7f3625136 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -13,7 +13,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index cd88d68dc..70f54874e 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index c93df5922..6b82d82a6 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index d124ec037..4dd076f7e 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 8525eda66..6473f58a2 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 4f1c632ac..6a4c1c43c 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -13,7 +13,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index d56648926..846c40697 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index f6ff996cc..099a6bfa4 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. See [here](https://scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index c758c9406..a3faf9a4b 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index bf24d6e90..a2571e4fb 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index e23b08099..54174b058 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 7d2404547..e7ac74d2e 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -14,7 +14,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index ba1feeaae..c5ae4854a 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -14,7 +14,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index b24b63265..eb893329c 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 5002058b3..6f473f3ab 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. See [here](https://scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index fdfee36de..fe5305fbf 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 1a1f67c0e..654867b98 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 3300d812f..e4c8fcac6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index a0f6ec543..45592d4a8 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 83928c98c..4a1cdc2d1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 5342bf53d..fea0b86b9 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 1a0ed8fe5..45732acb1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 362870bcb..ea77fc9bc 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires Statement. See [here](https://scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 36d801043..05c938eff 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -45,4 +45,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 927f60fd5..a4debb87e 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -45,5 +45,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index cf99c6064..c69918607 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -48,23 +48,23 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. +| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. +| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. +| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. +| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. +| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. +| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. +| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. +| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -81,9 +81,9 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. +| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. +| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. +| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 8e4fb3962..f0dddaf2b 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -51,10 +51,10 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: +| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. +| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement (SA-8) @@ -70,7 +70,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement (SA-12) @@ -85,5 +85,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index be5c34990..9c0a66d9e 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -51,8 +51,8 @@ Mitigates the risk of deploying untrusted or compromised container images by enf | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [PS.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | ## SSDF-ORG @@ -67,9 +67,9 @@ Reduces risks of unauthorized access and changes by ensuring strong organization | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [PS.1.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | ## SSDF-REPO @@ -84,8 +84,8 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 42bfeb157641faa05423500407ef2221b7184abe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 13 Mar 2025 18:18:35 +0200 Subject: [PATCH 136/191] test gen docs --- docs/configuration/initiatives/index.md | 38 ++++++++++++------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 3ba1a296b..90ed05bc4 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -16,16 +16,16 @@ | Rule Name | Description | Evidence Type | |-----------|-------------|---------------| | [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbo) | Verify the SBOM is not older than the specified duration. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | Verify the SBOM exists as evidence. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | Verify the SBOM is signed. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-publishe) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | @@ -33,29 +33,29 @@ | [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ultievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signe) | Verify the Git artifact is signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | +| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | | [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signe) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-neede) | Verify no security packages require updates. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | @@ -64,7 +64,7 @@ | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | | [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signe) | Verify required evidence is signed. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | | [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | | [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | @@ -77,8 +77,8 @@ | [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | | [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | | [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ockerhub/token-not-use) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | | [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | | [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | | [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | @@ -134,7 +134,7 @@ | [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-require) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | @@ -149,7 +149,7 @@ | [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validate) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | | [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | @@ -172,11 +172,11 @@ | [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | | [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | | [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-po) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | | [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-po) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | Verify the artifact is signed. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | +| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | +| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | | [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | | [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | | [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | @@ -187,10 +187,10 @@ | [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | PS.3.2 Archive SBOM | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | | [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | From 35f48604d9984eb1ae4ed22544d07848aac517a2 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 09:58:54 +0200 Subject: [PATCH 137/191] test gen docs --- docs/configuration/initiatives/index.md | 481 +++++++++++++++--------- 1 file changed, 296 insertions(+), 185 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 90ed05bc4..ba1766169 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -13,188 +13,299 @@ ## Rules -| Rule Name | Description | Evidence Type | -|-----------|-------------|---------------| -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) | -| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) | -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) | -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) | -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) | -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) | -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) | -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) | -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) | -| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) | -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) | \ No newline at end of file +### SBOM +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | +| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | +| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | + +### Image SBOM +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +### Git SBOM +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | +| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | +| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | + +### SARIF Evidence +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | +| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | +| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | + +### Generic Statement +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | +| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | +| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | + +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Github Organization Discovery Evidence +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | + +### Github Repository Discovery Evidence +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | + +### Gitlab Organization Discovery Evidence +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | +| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | + +### Gitlab Project Discovery Evidence +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | +| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | +| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + +### K8s Namespace Discovery Evidence +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | +| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | + +### K8s Pod Discovery Evidence +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | + +### SLSA Provenance +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) + +| Rule Name | Description | +|-----------|-------------| +| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | +| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | + +### Statement +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | +| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | From 7bb270edf4a33ca64e2c3ba7c09b0cab915e160e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 10:44:39 +0200 Subject: [PATCH 138/191] test gen docs --- docs/configuration/initiatives/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index ba1766169..be94f5b02 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -167,7 +167,7 @@ ### Github Repository Discovery Evidence **Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) -| Rule Name | Description | +|
Rule Name
|
Description
| |-----------|-------------| | [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | | [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | From cd50511b042fefad26b0bdcd0dd644ccfcab43df Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:03:58 +0200 Subject: [PATCH 139/191] test gen docs --- docs/configuration/initiatives/index.md | 3 +- .../v2/initiatives/_category_.json | 4 + docs/configuration/v2/initiatives/bp1.md | 261 +++++++++++++++ docs/configuration/v2/initiatives/index.md | 311 ++++++++++++++++++ .../v2/initiatives/rules/_category_.json | 4 + .../v2/initiatives/rules/api/_category_.json | 4 + .../rules/api/scribe-api-cve-product.md | 37 +++ .../initiatives/rules/api/scribe-api-cve.md | 62 ++++ .../rules/api/scribe-api-published.md | 55 ++++ .../v2/initiatives/rules/api/scribe-api.md | 35 ++ .../rules/bitbucket/_category_.json | 4 + .../rules/bitbucket/project/_category_.json | 4 + .../rules/bitbucket/project/allow-admins.md | 37 +++ .../rules/bitbucket/project/allow-users.md | 37 +++ .../bitbucket/project/exposed-credentials.md | 33 ++ .../bitbucket/project/long-live-tokens.md | 37 +++ .../bitbucket/repository/_category_.json | 4 + .../bitbucket/repository/allow-admins.md | 38 +++ .../rules/bitbucket/repository/allow-users.md | 38 +++ .../bitbucket/repository/branch-protection.md | 38 +++ .../rules/bitbucket/workspace/_category_.json | 4 + .../rules/bitbucket/workspace/allow-admins.md | 38 +++ .../rules/bitbucket/workspace/allow-users.md | 38 +++ .../rules/dockerhub/_category_.json | 4 + .../rules/dockerhub/token-expiration.md | 49 +++ .../rules/dockerhub/token-not-used.md | 43 +++ .../initiatives/rules/generic/_category_.json | 4 + .../rules/generic/artifact-signed.md | 38 +++ .../rules/generic/evidence-exists.md | 37 +++ .../rules/generic/k8s-jailbreak.md | 32 ++ .../initiatives/rules/generic/trivy-exists.md | 30 ++ .../v2/initiatives/rules/git/_category_.json | 4 + .../initiatives/rules/git/artifact-signed.md | 64 ++++ .../rules/git/coding-permissions.md | 60 ++++ .../initiatives/rules/git/evidence-exists.md | 46 +++ .../rules/git/no-commit-to-main.md | 51 +++ .../rules/git/no-unsigned-commits.md | 52 +++ .../initiatives/rules/github/_category_.json | 4 + .../rules/github/api/_category_.json | 4 + .../rules/github/api/branch-protection.md | 30 ++ .../rules/github/api/signed-commits-list.md | 29 ++ .../rules/github/api/signed-commits-range.md | 31 ++ .../v2/initiatives/rules/github/org/2fa.md | 58 ++++ .../rules/github/org/_category_.json | 4 + .../rules/github/org/advanced-security.md | 38 +++ .../rules/github/org/allow-admins.md | 38 +++ .../rules/github/org/allow-users.md | 38 +++ .../rules/github/org/create-private-repos.md | 38 +++ .../rules/github/org/create-repos.md | 38 +++ .../rules/github/org/dependabot-alerts.md | 38 +++ .../org/dependabot-security-updates-sa.md | 33 ++ .../github/org/dependabot-security-updates.md | 38 +++ .../rules/github/org/dependency-graph.md | 38 +++ .../rules/github/org/max-admins.md | 38 +++ .../rules/github/org/old-secrets.md | 38 +++ .../rules/github/org/pp-custom-link.md | 38 +++ .../rules/github/org/push-protection-sa.md | 33 ++ .../rules/github/org/push-protection.md | 39 +++ .../rules/github/org/repo-visibility.md | 38 +++ .../rules/github/org/secret-scanning-sa.md | 33 ++ .../rules/github/org/secret-scanning.md | 38 +++ .../rules/github/org/validity-checks-sa.md | 33 ++ .../rules/github/org/validity-checks.md | 38 +++ .../rules/github/org/web-commit-signoff.md | 33 ++ .../rules/github/repository/_category_.json | 4 + .../github/repository/branch-protection.md | 39 +++ .../github/repository/branch-verification.md | 38 +++ .../github/repository/check-signed-commits.md | 33 ++ .../repository/default-branch-protection.md | 33 ++ .../rules/github/repository/dependabot.md | 33 ++ .../repository/ephemeral-runners-only.md | 33 ++ .../rules/github/repository/no-cache-usage.md | 33 ++ .../rules/github/repository/no-org-secrets.md | 33 ++ .../rules/github/repository/old-secrets.md | 38 +++ .../github/repository/push-protection.md | 33 ++ .../rules/github/repository/repo-private.md | 33 ++ .../github/repository/secret-scanning.md | 33 ++ .../rules/github/repository/signed-commits.md | 33 ++ .../github/repository/validity-checks.md | 33 ++ .../rules/github/repository/visibility.md | 38 +++ .../github/repository/web-commit-signoff.md | 33 ++ .../initiatives/rules/gitlab/_category_.json | 4 + .../rules/gitlab/api/_category_.json | 4 + .../rules/gitlab/api/push-rules.md | 28 ++ .../rules/gitlab/api/signed-commits-list.md | 28 ++ .../rules/gitlab/api/signed-commits-range.md | 29 ++ .../rules/gitlab/org/_category_.json | 4 + .../rules/gitlab/org/allow-admins.md | 38 +++ .../rules/gitlab/org/allow-token-scopes.md | 38 +++ .../rules/gitlab/org/allow-users.md | 38 +++ .../rules/gitlab/org/blocked-users.md | 38 +++ .../rules/gitlab/org/expiring-tokens.md | 38 +++ .../rules/gitlab/org/forbid-token-scopes.md | 38 +++ .../rules/gitlab/org/inactive-projects.md | 38 +++ .../rules/gitlab/org/longlive-tokens.md | 38 +++ .../rules/gitlab/org/max-admins.md | 38 +++ .../rules/gitlab/org/projects-visibility.md | 38 +++ .../rules/gitlab/org/unused-tokens.md | 38 +++ .../rules/gitlab/pipeline/_category_.json | 4 + .../gitlab/pipeline/verify-labels-exist.md | 38 +++ .../rules/gitlab/pipeline/verify-labels.md | 38 +++ .../rules/gitlab/project/_category_.json | 4 + .../rules/gitlab/project/abandoned-project.md | 38 +++ .../gitlab/project/approvals-policy-check.md | 39 +++ .../project/approvers-per-merge-request.md | 38 +++ .../gitlab/project/author-email-regex.md | 38 +++ .../rules/gitlab/project/check-cwe.md | 38 +++ .../gitlab/project/check-signed-commits.md | 33 ++ .../gitlab/project/co-approval-required.md | 38 +++ .../project/commit-author-email-check.md | 38 +++ .../project/commit-author-name-check.md | 38 +++ .../gitlab/project/commit-committer-check.md | 33 ++ .../gitlab/project/commit-message-check.md | 38 +++ .../rules/gitlab/project/commits-validated.md | 33 ++ .../gitlab/project/committer-email-check.md | 38 +++ .../gitlab/project/committer-name-check.md | 38 +++ .../gitlab/project/critical-severity-limit.md | 38 +++ .../project/description-substring-check.md | 38 +++ .../project/disallowed-banned-approvers.md | 38 +++ .../gitlab/project/force-push-protection.md | 38 +++ .../gitlab/project/medium-severity-limit.md | 38 +++ .../rules/gitlab/project/member-check.md | 33 ++ .../gitlab/project/merge-access-level.md | 39 +++ .../project/merge-requests-author-approval.md | 38 +++ ...ge-requests-disable-committers-approval.md | 38 +++ .../gitlab/project/message-substring-check.md | 38 +++ .../gitlab/project/prevent-secrets-check.md | 33 ++ .../gitlab/project/protect-ci-secrets.md | 38 +++ .../rules/gitlab/project/push-access-level.md | 39 +++ .../rules/gitlab/project/push-rules-set.md | 33 ++ .../gitlab/project/reject-unsigned-commits.md | 33 ++ .../project/require-password-to-approve.md | 38 +++ .../project/required-minimal-approvers.md | 33 ++ .../gitlab/project/reset-pprovals-on-push.md | 38 +++ .../rules/gitlab/project/sast-scan-pass.md | 33 ++ .../rules/gitlab/project/sast-scanning.md | 33 ++ .../rules/gitlab/project/secrets-scan-pass.md | 33 ++ .../rules/gitlab/project/secrets-scanning.md | 33 ++ .../project/selective-code-owner-removals.md | 38 +++ .../rules/gitlab/project/visibility-check.md | 38 +++ .../initiatives/rules/images/_category_.json | 4 + .../rules/images/allowed-base-image.md | 73 ++++ .../rules/images/allowed-image-source.md | 70 ++++ .../initiatives/rules/images/banned-ports.md | 75 +++++ .../initiatives/rules/images/banned-users.md | 68 ++++ .../rules/images/blocklist-build-scripts.md | 57 ++++ .../rules/images/blocklist-user.md | 38 +++ .../rules/images/enforce-https-registry.md | 48 +++ .../rules/images/forbid-large-images.md | 64 ++++ .../rules/images/fresh-base-image.md | 65 ++++ .../initiatives/rules/images/fresh-image.md | 65 ++++ .../initiatives/rules/images/image-signed.md | 73 ++++ .../rules/images/require-healthcheck.md | 52 +++ .../rules/images/restrict-shell-entrypoint.md | 46 +++ .../rules/images/verify-labels-exist.md | 69 ++++ .../initiatives/rules/images/verify-labels.md | 65 ++++ .../initiatives/rules/jenkins/_category_.json | 4 + .../rules/jenkins/folder/_category_.json | 4 + .../jenkins/folder/exposed-credentials.md | 33 ++ .../rules/jenkins/instance/_category_.json | 4 + .../rules/jenkins/instance/inactive-users.md | 37 +++ .../rules/jenkins/instance/unused-users.md | 32 ++ .../v2/initiatives/rules/k8s/_category_.json | 4 + .../rules/k8s/namespace/_category_.json | 4 + .../rules/k8s/namespace/allowed-images.md | 65 ++++ .../rules/k8s/namespace/allowed-registries.md | 65 ++++ .../namespace/verify-namespace-duration.md | 63 ++++ .../namespace/verify-namespace-termination.md | 64 ++++ .../k8s/namespace/white-listed-namespaces.md | 55 ++++ .../rules/k8s/namespace/white-listed-pod.md | 65 ++++ .../rules/k8s/pods/_category_.json | 4 + .../rules/k8s/pods/verify-pod-duration.md | 63 ++++ .../rules/k8s/pods/verify-pod-termination.md | 49 +++ .../rules/k8s/pods/white-listed-pod.md | 68 ++++ .../rules/multievidence/_category_.json | 4 + .../rules/multievidence/files_integrity.md | 38 +++ .../initiatives/rules/sarif/_category_.json | 4 + .../rules/sarif/artifact-signed.md | 55 ++++ .../rules/sarif/evidence-exists.md | 43 +++ .../rules/sarif/patcheck/_category_.json | 4 + .../rules/sarif/patcheck/updates-needed.md | 32 ++ .../rules/sarif/report-iac-errors.md | 62 ++++ .../rules/sarif/trivy/_category_.json | 4 + .../rules/sarif/trivy/blocklist-cve.md | 64 ++++ .../sarif/trivy/report-trivy-iac-errors.md | 65 ++++ .../rules/sarif/trivy/verify-cve-severity.md | 77 +++++ .../sarif/trivy/verify-trivy-attack-vector.md | 50 +++ .../rules/sarif/trivy/verify-trivy-report.md | 66 ++++ .../rules/sarif/verify-attack-vector.md | 73 ++++ .../initiatives/rules/sarif/verify-sarif.md | 65 ++++ .../rules/sarif/verify-semgrep-report.md | 63 ++++ .../rules/sarif/verify-tool-evidence.md | 54 +++ .../initiatives/rules/sbom/NTIA-compliance.md | 89 +++++ .../v2/initiatives/rules/sbom/_category_.json | 4 + .../rules/sbom/allowed-components.md | 72 ++++ .../initiatives/rules/sbom/artifact-signed.md | 45 +++ .../initiatives/rules/sbom/banned-licenses.md | 70 ++++ .../rules/sbom/blocklist-packages.md | 41 +++ .../rules/sbom/complete-licenses.md | 52 +++ .../v2/initiatives/rules/sbom/fresh-sbom.md | 65 ++++ .../v2/initiatives/rules/sbom/require-sbom.md | 56 ++++ .../rules/sbom/required-packages.md | 69 ++++ .../rules/sbom/verify-huggingface-license.md | 71 ++++ .../v2/initiatives/rules/slsa/_category_.json | 4 + .../rules/slsa/banned-builder-deps.md | 36 ++ .../v2/initiatives/rules/slsa/build-time.md | 38 +++ .../v2/initiatives/rules/slsa/field-exists.md | 37 +++ .../rules/slsa/l1-provenance-exists.md | 45 +++ .../rules/slsa/l2-provenance-authenticated.md | 51 +++ .../initiatives/rules/slsa/verify-builder.md | 37 +++ .../rules/slsa/verify-byproducts.md | 36 ++ .../v2/initiatives/rules/ssdf/_category_.json | 4 + .../v2/initiatives/rules/ssdf/ps-1-2fa.md | 48 +++ .../rules/ssdf/ps-1-branch-protection.md | 33 ++ .../rules/ssdf/ps-1-limit-admins.md | 33 ++ .../rules/ssdf/ps-1-repo-private.md | 33 ++ .../rules/ssdf/ps-1-web-commit-signoff.md | 33 ++ .../rules/ssdf/ps-2-image-verifiable.md | 33 ++ .../rules/ssdf/ps-3.1-code-archived.md | 38 +++ .../rules/ssdf/ps-3.2-archived-sbom.md | 28 ++ docs/configuration/v2/initiatives/slsa.l1.md | 48 +++ docs/configuration/v2/initiatives/slsa.l2.md | 49 +++ .../v2/initiatives/sp-800-190.md | 89 +++++ .../configuration/v2/initiatives/sp-800-53.md | 89 +++++ docs/configuration/v2/initiatives/ssdf.md | 91 +++++ 225 files changed, 9079 insertions(+), 1 deletion(-) create mode 100644 docs/configuration/v2/initiatives/_category_.json create mode 100644 docs/configuration/v2/initiatives/bp1.md create mode 100644 docs/configuration/v2/initiatives/index.md create mode 100644 docs/configuration/v2/initiatives/rules/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/api/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md create mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md create mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-published.md create mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md create mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md create mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md create mode 100644 docs/configuration/v2/initiatives/rules/generic/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/generic/artifact-signed.md create mode 100644 docs/configuration/v2/initiatives/rules/generic/evidence-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md create mode 100644 docs/configuration/v2/initiatives/rules/generic/trivy-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/git/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/git/artifact-signed.md create mode 100644 docs/configuration/v2/initiatives/rules/git/coding-permissions.md create mode 100644 docs/configuration/v2/initiatives/rules/git/evidence-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md create mode 100644 docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md create mode 100644 docs/configuration/v2/initiatives/rules/github/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/github/api/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/github/api/branch-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md create mode 100644 docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/2fa.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/github/org/advanced-security.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/allow-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/allow-users.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/create-repos.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/max-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/old-secrets.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/push-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/validity-checks.md create mode 100644 docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/dependabot.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/push-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/repo-private.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/visibility.md create mode 100644 docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md create mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md create mode 100644 docs/configuration/v2/initiatives/rules/images/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/images/allowed-base-image.md create mode 100644 docs/configuration/v2/initiatives/rules/images/allowed-image-source.md create mode 100644 docs/configuration/v2/initiatives/rules/images/banned-ports.md create mode 100644 docs/configuration/v2/initiatives/rules/images/banned-users.md create mode 100644 docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md create mode 100644 docs/configuration/v2/initiatives/rules/images/blocklist-user.md create mode 100644 docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md create mode 100644 docs/configuration/v2/initiatives/rules/images/forbid-large-images.md create mode 100644 docs/configuration/v2/initiatives/rules/images/fresh-base-image.md create mode 100644 docs/configuration/v2/initiatives/rules/images/fresh-image.md create mode 100644 docs/configuration/v2/initiatives/rules/images/image-signed.md create mode 100644 docs/configuration/v2/initiatives/rules/images/require-healthcheck.md create mode 100644 docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md create mode 100644 docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md create mode 100644 docs/configuration/v2/initiatives/rules/images/verify-labels.md create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md create mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md create mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md create mode 100644 docs/configuration/v2/initiatives/rules/multievidence/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md create mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/sbom/allowed-components.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/require-sbom.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/required-packages.md create mode 100644 docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/build-time.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/field-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/verify-builder.md create mode 100644 docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/_category_.json create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md create mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md create mode 100644 docs/configuration/v2/initiatives/slsa.l1.md create mode 100644 docs/configuration/v2/initiatives/slsa.l2.md create mode 100644 docs/configuration/v2/initiatives/sp-800-190.md create mode 100644 docs/configuration/v2/initiatives/sp-800-53.md create mode 100644 docs/configuration/v2/initiatives/ssdf.md diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index be94f5b02..decf202cc 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -2,6 +2,7 @@ ## Initiatives + | Name | Description | |------|-------------| | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | @@ -167,7 +168,7 @@ ### Github Repository Discovery Evidence **Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) -|
Rule Name
|
Description
| +| Rule Name | Description | |-----------|-------------| | [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | | [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | diff --git a/docs/configuration/v2/initiatives/_category_.json b/docs/configuration/v2/initiatives/_category_.json new file mode 100644 index 000000000..6cd81f819 --- /dev/null +++ b/docs/configuration/v2/initiatives/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Reference: Policies and Configuration Guide", + "position": 999 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/bp1.md b/docs/configuration/v2/initiatives/bp1.md new file mode 100644 index 000000000..65d8e12d5 --- /dev/null +++ b/docs/configuration/v2/initiatives/bp1.md @@ -0,0 +1,261 @@ +--- +sidebar_label: Blueprint for Secure Pipelines +title: Blueprint for Secure Pipelines +--- +# Blueprint for Secure Pipelines +**Type:** Initiative +**ID:** `blueprint-securesoftwarepipeline` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/bp1.yaml) +**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline + +Blueprint for secure pipelines - Gitlab + +## **Description** + +This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [CT-1](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [CT-3](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [CT-4](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [CT-6](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [CT-8](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [CT-9](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [CT-11](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [CT-12](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [CT-13](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | True | + +--- + +# Detailed Controls + +## [CT-1] Restrict administrative access to CI/CD tools + +Restrict administrative access to CI/CD tools + + +### Mitigation +Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. + +### **Description** + +It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls. + +Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication. + +> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | + +## [CT-2] Only accept commits signed with a developer GPG key + +The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab + + +### Mitigation +Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. + +### **Description** + +Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers. + +> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-project-disallow-unsigned-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [gitlab-project-signed-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | + +## [CT-3] Automation access keys expire automatically + +Automation access keys expire automatically + + +### Mitigation +Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. + +### **Description** + +Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised. + +> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | + +## [CT-4] Reduce automation access to read-only + +Reduce automation access to read-only + + +### Mitigation +Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. + +### **Description** + +CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. + +> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-org-disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | + +## [CT-6] Any critical or high severity vulnerability breaks the build + +Any critical or high severity vulnerability breaks the build + + +### Mitigation +Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. + +### **Description** + +Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged. + +> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored. + +Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process. + +> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CT-8] Validate artifact digest + +Validate artifact digest + + +### Mitigation +Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. + +### **Description** + +Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised. + +> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| sbom/evidence-exists@v2 | sbom/evidence-exists@v2 | | + +## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + +Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + + +### Mitigation +Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. + +### **Description** + +Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight. + +> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [gitlab-project-merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | + +## [CT-11] Available container images don’t have any high or critical vulnerabilities + +Available container images don’t have any high or critical vulnerabilities + + +### Mitigation +Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. + +### **Description** + +Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities. + +> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CT-12] Validate artifact signatures and digests + +Validate artifact signatures and digests + + +### Mitigation +Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. + +### **Description** + +Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment. + +> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | + +## [CT-13] Scan deployed images in production + +Scan deployed images in production + + +### Mitigation +Continuously monitor and scan production images to ensure ongoing compliance with security standards. + +### **Description** + +Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production. + +> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/v2/initiatives/index.md b/docs/configuration/v2/initiatives/index.md new file mode 100644 index 000000000..ba1766169 --- /dev/null +++ b/docs/configuration/v2/initiatives/index.md @@ -0,0 +1,311 @@ +# Documentation Index + +## Initiatives + +| Name | Description | +|------|-------------| +| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | + +## Rules + +### SBOM +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | +| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | +| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | + +### Image SBOM +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +### Git SBOM +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | +| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | +| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | + +### SARIF Evidence +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | +| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | +| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | + +### Generic Statement +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | +| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | +| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | + +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Github Organization Discovery Evidence +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | + +### Github Repository Discovery Evidence +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | + +### Gitlab Organization Discovery Evidence +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | +| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | + +### Gitlab Project Discovery Evidence +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | +| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | +| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + +### K8s Namespace Discovery Evidence +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | +| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | + +### K8s Pod Discovery Evidence +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | + +### SLSA Provenance +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) + +| Rule Name | Description | +|-----------|-------------| +| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | +| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | + +### Statement +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | +| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | diff --git a/docs/configuration/v2/initiatives/rules/_category_.json b/docs/configuration/v2/initiatives/rules/_category_.json new file mode 100644 index 000000000..46c5e5953 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Rule Configuration", + "position": 999 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/api/_category_.json b/docs/configuration/v2/initiatives/rules/api/_category_.json new file mode 100644 index 000000000..01fdec181 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Scribe API", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md new file mode 100644 index 000000000..a600c2024 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Verify No Critical or High Vulnerabilities in Product +title: Verify No Critical or High Vulnerabilities in Product +--- +# Verify No Critical or High Vulnerabilities in Product +**Type:** Rule +**ID:** `scribe-cve-product` +**Uses:** `api/scribe-api-cve-product@v2/rules` +**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) +**Labels:** SCA, Blueprint, Scribe + +Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. + + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| cve | list | False | List of CVEs to check against the product components. | + diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md new file mode 100644 index 000000000..5eda63552 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md @@ -0,0 +1,62 @@ +--- +sidebar_label: Verify No Critical or High Vulnerabilities +title: Verify No Critical or High Vulnerabilities +--- +# Verify No Critical or High Vulnerabilities +**Type:** Rule +**ID:** `scribe-cve` +**Uses:** `api/scribe-api-cve@v2/rules` +**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) +**Labels:** SCA, Blueprint, Scribe + +Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). + +:::note +Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: api/scribe-api-cve@v2/rules +with: + superset: + cve: + max: 0 + severity: 6 +``` + +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] | + diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md new file mode 100644 index 000000000..fda0f7d67 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md @@ -0,0 +1,55 @@ +--- +sidebar_label: Scribe Published Policy +title: Scribe Published Policy +--- +# Scribe Published Policy +**Type:** Rule +**ID:** `scribe-published-policy` +**Uses:** `api/scribe-api-published@v2/rules` +**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml) +**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego) +**Labels:** Scribe + +Verify image Scribe Publish flag is set for container image. + +:::note +Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. +::: +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: api/scribe-api-published@v2/rules +with: + superset: + published: true +``` + +## Mitigation +Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. + + +## Description +This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| superset | object | False | The superset of CVEs to check for, including the following format [published: [flag: bool]] | + diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api.md b/docs/configuration/v2/initiatives/rules/api/scribe-api.md new file mode 100644 index 000000000..ad81d49f1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api.md @@ -0,0 +1,35 @@ +--- +sidebar_label: Apply Scribe Template Policy +title: Apply Scribe Template Policy +--- +# Apply Scribe Template Policy +**Type:** Rule +**ID:** `scribe-template` +**Uses:** `api/scribe-api@v2/rules` +**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) +**Labels:** Scribe + +Verify XX using the Scribe API template rule. + +:::tip +Rule requires the Scribe API to be enabled. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| predicate_type | https://cyclonedx.org/bom | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | None | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json new file mode 100644 index 000000000..e6515f2ae --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Bitbucket", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json new file mode 100644 index 000000000..a88c9e5b1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Project", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md new file mode 100644 index 000000000..934bbbca8 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Allowed Project Admins +title: Allowed Project Admins +--- +# Allowed Project Admins +**Type:** Rule +**ID:** `bb-project-allowed-project-admins` +**Uses:** `bitbucket/project/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego) + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. + +:::note +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md new file mode 100644 index 000000000..dbb386d93 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Allowed Project Users +title: Allowed Project Users +--- +# Allowed Project Users +**Type:** Rule +**ID:** `bb-project-allowed-project-users` +**Uses:** `bitbucket/project/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego) + +Verify only users specified in the Allowed List have user access to the Bitbucket project. + +:::note +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md new file mode 100644 index 000000000..37aea5ed6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Prevent Credential Exposure +title: Prevent Credential Exposure +--- +# Prevent Credential Exposure +**Type:** Rule +**ID:** `bb-project-exposed-credentials` +**Uses:** `bitbucket/project/exposed-credentials@v2/rules` +**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego) +**Labels:** Bitbucket, Project + +Verify access to the Bitbucket project is blocked if exposed credentials are detected. + +:::note +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md new file mode 100644 index 000000000..99a423104 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Prevent Long-Lived Tokens +title: Prevent Long-Lived Tokens +--- +# Prevent Long-Lived Tokens +**Type:** Rule +**ID:** `bb-project-long-live-tokens` +**Uses:** `bitbucket/project/long-live-tokens@v2/rules` +**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml) +**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego) +**Labels:** Bitbucket, Project + +Verify Bitbucket API tokens expire before the maximum time to live. + +:::note +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_days | 30 | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json new file mode 100644 index 000000000..e93f68442 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Repository", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md new file mode 100644 index 000000000..8cbf7fb47 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Repository Admins +title: Allowed Repository Admins +--- +# Allowed Repository Admins +**Type:** Rule +**ID:** `bb-repo-allowed-repository-admins` +**Uses:** `bitbucket/repository/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego) +**Labels:** Bitbucket, Repository + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. + +:::note +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md new file mode 100644 index 000000000..7a22799b1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Repository Users +title: Allowed Repository Users +--- +# Allowed Repository Users +**Type:** Rule +**ID:** `bb-repo-allowed-repository-users` +**Uses:** `bitbucket/repository/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego) +**Labels:** Bitbucket, Repository + +Verify only users specified in the Allowed List have user access to the Bitbucket repository. + +:::note +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md new file mode 100644 index 000000000..825dfc978 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Default Branch Protection Setting Is Configured +title: Verify Default Branch Protection Setting Is Configured +--- +# Verify Default Branch Protection Setting Is Configured +**Type:** Rule +**ID:** `bb-repo-branch-protection` +**Uses:** `bitbucket/repository/branch-protection@v2/rules` +**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego) +**Labels:** Bitbucket, Repository + +Verify the default branch protection is enabled in the Bitbucket repository. + +:::note +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branches | ['main'] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json new file mode 100644 index 000000000..ed893c2ea --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Workspace", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md new file mode 100644 index 000000000..5d8a857ef --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Workspace Admins +title: Allowed Workspace Admins +--- +# Allowed Workspace Admins +**Type:** Rule +**ID:** `bb-workspace-allowed-workspace-admins` +**Uses:** `bitbucket/workspace/allow-admins@v2/rules` +**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego) +**Labels:** Bitbucket, Workspace + +Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. + +:::note +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=workspace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | + diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md new file mode 100644 index 000000000..0e43f2b70 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Workspace Users +title: Allowed Workspace Users +--- +# Allowed Workspace Users +**Type:** Rule +**ID:** `bb-workspace-allowed-workspace-users` +**Uses:** `bitbucket/workspace/allow-users@v2/rules` +**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego) +**Labels:** Bitbucket, Workspace + +Verify only users specified in the Allowed List have user access to the Bitbucket workspace. + +:::note +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=bitbucket
- asset_type=workspace | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json b/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json new file mode 100644 index 000000000..7c6237a25 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Dockerhub", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md new file mode 100644 index 000000000..b01b31533 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md @@ -0,0 +1,49 @@ +--- +sidebar_label: Verify DockerHub Tokens are Active +title: Verify DockerHub Tokens are Active +--- +# Verify DockerHub Tokens are Active +**Type:** Rule +**ID:** `dockerhub-token-expiration` +**Uses:** `dockerhub/token-expiration@v2/rules` +**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml) +**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego) +**Labels:** Dockerhub + +Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. + +:::note +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. + + +## Description +This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's status against the Active status. + - If a token's status is not Active, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project
- platform=dockerhub | + diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md new file mode 100644 index 000000000..3ded9c542 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md @@ -0,0 +1,43 @@ +--- +sidebar_label: Verify no unused Dockerhub +title: Verify no unused Dockerhub +--- +# Verify no unused Dockerhub +**Type:** Rule +**ID:** `dockerhub-token-not-used` +**Uses:** `dockerhub/token-not-used@v2/rules` +**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml) +**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego) +**Labels:** Dockerhub + +Verify that there are no unused Dockerhub. + +:::note +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Description +This rule verifies that there are no unused Dockerhub. +It performs the following steps: + +1. Iterates over the Dockerhub tokens in the project. +2. Checks each token's last_used is null , the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=project
- platform=dockerhub | + diff --git a/docs/configuration/v2/initiatives/rules/generic/_category_.json b/docs/configuration/v2/initiatives/rules/generic/_category_.json new file mode 100644 index 000000000..ab9d35851 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/generic/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Generic", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md new file mode 100644 index 000000000..2917b47ef --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Generic Artifact Signed +title: Generic Artifact Signed +--- +# Generic Artifact Signed +**Type:** Rule +**ID:** `generic-artifact-signed` +**Uses:** `generic/artifact-signed@v2/rules` +**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego) +**Labels:** 3rd-party + +Verify required evidence is signed. + +:::note +This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | + diff --git a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md new file mode 100644 index 000000000..22221a0fe --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Required Generic Evidence Exists +title: Required Generic Evidence Exists +--- +# Required Generic Evidence Exists +**Type:** Rule +**ID:** `generic-required-evidence` +**Uses:** `generic/evidence-exists@v2/rules` +**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego) +**Labels:** 3rd-party + +Verify required evidence exists. + +:::note +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | + diff --git a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md new file mode 100644 index 000000000..39afd1720 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md @@ -0,0 +1,32 @@ +--- +sidebar_label: K8s Jailbreak +title: K8s Jailbreak +--- +# K8s Jailbreak +**Type:** Rule +**ID:** `k8s-jailbreak` +**Uses:** `generic/k8s-jailbreak@v2/rules` +**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml) +**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego) +**Labels:** K8s + +Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| target_type | data | + diff --git a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md new file mode 100644 index 000000000..73b40dd7d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md @@ -0,0 +1,30 @@ +--- +sidebar_label: Required Trivy Evidence Exists +title: Required Trivy Evidence Exists +--- +# Required Trivy Evidence Exists +**Type:** Rule +**ID:** `required-trivy-evidence` +**Uses:** `generic/trivy-exists@v2/rules` +**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml) +**Labels:** 3rd-party + +Verify required Trivy evidence exists + +:::note +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | generic | +| target_type | data | +| predicate_type | https://aquasecurity.github.io/trivy/v0.42/docs/configuration/reporting/#json | + diff --git a/docs/configuration/v2/initiatives/rules/git/_category_.json b/docs/configuration/v2/initiatives/rules/git/_category_.json new file mode 100644 index 000000000..2a7a53690 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Git", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md new file mode 100644 index 000000000..2f1aa7b81 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md @@ -0,0 +1,64 @@ +--- +sidebar_label: Git Artifact Signed +title: Git Artifact Signed +--- +# Git Artifact Signed +**Type:** Rule +**ID:** `git-artifact-signed` +**Uses:** `git/artifact-signed@v2/rules` +**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) +**Labels:** SBOM, Git + +Verify the Git artifact is signed. + +:::note +This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: git/artifact-signed@v2/rules +with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* +``` + +## Mitigation +Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. + + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | True | +| content_body_type | cyclonedx-json | +| target_type | git | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md new file mode 100644 index 000000000..4f9444ff5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md @@ -0,0 +1,60 @@ +--- +sidebar_label: Restrict Coding Permissions +title: Restrict Coding Permissions +--- +# Restrict Coding Permissions +**Type:** Rule +**ID:** `git-coding-permissions` +**Uses:** `git/coding-permissions@v2/rules` +**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) +**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) +**Labels:** SBOM, Git + +Verify only allowed users committed to the repository. + +:::note +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. + + + +## Description +This rule verifies that only allowed users have committed to the repository. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. Checks each commit's author against the list of allowed user IDs. + - If a commit's author is not in the allowed list, the rule flags it as a violation. +3. Checks each committed file against the list of allowed files. + - If a committed file is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. | +| files | array | False | The list of files that are allowed to be committed to the repository. | + diff --git a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md new file mode 100644 index 000000000..7348f614a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md @@ -0,0 +1,46 @@ +--- +sidebar_label: Required Git Evidence Exists +title: Required Git Evidence Exists +--- +# Required Git Evidence Exists +**Type:** Rule +**ID:** `required-git-evidence` +**Uses:** `git/evidence-exists@v2/rules` +**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) +**Labels:** SBOM, Git + +Verify required Git evidence exists. + +:::note +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. + + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md new file mode 100644 index 000000000..fc197b904 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md @@ -0,0 +1,51 @@ +--- +sidebar_label: Disallow Commits to Main Branch +title: Disallow Commits to Main Branch +--- +# Disallow Commits to Main Branch +**Type:** Rule +**ID:** `git-disallow-commits-to-main` +**Uses:** `git/no-commit-to-main@v2/rules` +**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) +**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) +**Labels:** SBOM, Git + +Verify commits made directly to the main branch are disallowed. + +:::note +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. + + +## Description +This rule ensures that no commits are made directly to the main or master branches. +It performs the following steps: + +1. Check SBOM target branch +2. If the target branch is the main or master branch, the rule looks for commit objects. +3. If commit objects are found, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md new file mode 100644 index 000000000..def24f262 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md @@ -0,0 +1,52 @@ +--- +sidebar_label: Disallow Unsigned Commits +title: Disallow Unsigned Commits +--- +# Disallow Unsigned Commits +**Type:** Rule +**ID:** `git-disallow-unsigned-commits` +**Uses:** `git/no-unsigned-commits@v2/rules` +**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml) +**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego) +**Labels:** Git + +Verify all commits are signed. + +:::note +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. + + +## Description +This rule ensures that all commits are signed. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation. + +**Evidence Requirements:** +- The Source SBOM evidence must be provided in the `cyclonedx-json` format. +- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. +- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | git | + diff --git a/docs/configuration/v2/initiatives/rules/github/_category_.json b/docs/configuration/v2/initiatives/rules/github/_category_.json new file mode 100644 index 000000000..174a64f21 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "GitHub", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/api/_category_.json b/docs/configuration/v2/initiatives/rules/github/api/_category_.json new file mode 100644 index 000000000..e753985fa --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "GitHub API", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md new file mode 100644 index 000000000..e0b2d2e0a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md @@ -0,0 +1,30 @@ +--- +sidebar_label: Branch protection enabled in GitHub repository +title: Branch protection enabled in GitHub repository +--- +# Branch protection enabled in GitHub repository +**Type:** Rule +**ID:** `github-api-branch-protection` +**Uses:** `github/api/branch-protection@v2/rules` +**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego) +**Labels:** GitHub + +Verify GitHub branch protection rules + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| api_token | `{{ .Args.Token }}` | +| owner | `{{ .Args.Owner }}` | +| repo | `{{ .Args.Repo }}` | +| branch | `{{ .Args.Branch }}` | +| branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` | + diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md new file mode 100644 index 000000000..498569af5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md @@ -0,0 +1,29 @@ +--- +sidebar_label: Verify Selected Commits Are Signed API +title: Verify Selected Commits Are Signed API +--- +# Verify Selected Commits Are Signed API +**Type:** Rule +**ID:** `github-api-signed-commits-list` +**Uses:** `github/api/signed-commits-list@v2/rules` +**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego) +**Labels:** GitHub, API + +Verify selected commits are signed in the GitHub organization. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_id_list | [] | +| access_token | | +| owner | | +| repo | | + diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md new file mode 100644 index 000000000..5ef9ddcab --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md @@ -0,0 +1,31 @@ +--- +sidebar_label: Disallow Unsigned Commits In Time Range +title: Disallow Unsigned Commits In Time Range +--- +# Disallow Unsigned Commits In Time Range +**Type:** Rule +**ID:** `signed-commits-range` +**Uses:** `github/api/signed-commits-range@v2/rules` +**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego) +**Labels:** GitHub + +Verify commits in the specified time range are signed. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| access_token | | +| owner | | +| repo | | +| since | None | +| until | None | +| sha | None | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/2fa.md b/docs/configuration/v2/initiatives/rules/github/org/2fa.md new file mode 100644 index 000000000..2a8488cf6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/2fa.md @@ -0,0 +1,58 @@ +--- +sidebar_label: Verify two_factor_requirement_enabled setting +title: Verify two_factor_requirement_enabled setting +--- +# Verify two_factor_requirement_enabled setting +**Type:** Rule +**ID:** `github-org-2fa` +**Uses:** `github/org/2fa@v2/rules` +**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) +**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) +**Labels:** GitHub, Organization + +Verify `two_factor_requirement` is enabled in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. + + + +## Description +This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. +It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the +`organization_details.two_factor_requirement_enabled` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match +the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional +layer of security against unauthorized access. + +### **Evidence Requirements** +- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. +- The data should come from a trusted source (e.g., a GitHub organization scan). +- The evidence must clearly indicate whether 2FA is enabled. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/_category_.json b/docs/configuration/v2/initiatives/rules/github/org/_category_.json new file mode 100644 index 000000000..1ce17e465 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Org", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md new file mode 100644 index 000000000..6ed759530 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify advanced security setting is enabled +title: Verify advanced security setting is enabled +--- +# Verify advanced security setting is enabled +**Type:** Rule +**ID:** `github-org-advanced-security` +**Uses:** `github/org/advanced-security@v2/rules` +**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) +**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) +**Labels:** GitHub, Organization + +Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md new file mode 100644 index 000000000..89599f795 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed GitHub Organization Admins +title: Allowed GitHub Organization Admins +--- +# Allowed GitHub Organization Admins +**Type:** Rule +**ID:** `github-orgallowed-admins` +**Uses:** `github/org/allow-admins@v2/rules` +**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) +**Labels:** GitHub, Organization + +Verify only users in the Allowed List have admin privileges in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md new file mode 100644 index 000000000..988cf73ec --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed GitHub Organization Users +title: Allowed GitHub Organization Users +--- +# Allowed GitHub Organization Users +**Type:** Rule +**ID:** `github-org-allowed-users` +**Uses:** `github/org/allow-users@v2/rules` +**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego) +**Labels:** GitHub, Organization + +Verify only users in the Allowed List have user access to the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md new file mode 100644 index 000000000..209fd14b5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify members_can_create_private_repositories setting +title: Verify members_can_create_private_repositories setting +--- +# Verify members_can_create_private_repositories setting +**Type:** Rule +**ID:** `github-org-create-private-repos` +**Uses:** `github/org/create-private-repos@v2/rules` +**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) +**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) +**Labels:** GitHub, Organization + +Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md new file mode 100644 index 000000000..64ce2379c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify members_can_create_repositories setting +title: Verify members_can_create_repositories setting +--- +# Verify members_can_create_repositories setting +**Type:** Rule +**ID:** `github-org-create-repos` +**Uses:** `github/org/create-repos@v2/rules` +**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) +**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) +**Labels:** GitHub, Organization + +Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md new file mode 100644 index 000000000..42e3a6efa --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify dependabot_alerts_enabled_for_new_repositories setting +title: Verify dependabot_alerts_enabled_for_new_repositories setting +--- +# Verify dependabot_alerts_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependabot-alerts` +**Uses:** `github/org/dependabot-alerts@v2/rules` +**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml) +**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego) +**Labels:** GitHub, Organization + +Verify Dependabot alerts for new repositories are enabled in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md new file mode 100644 index 000000000..22f3adb35 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify dependabot_security_updates setting in security_and_analysis +title: Verify dependabot_security_updates setting in security_and_analysis +--- +# Verify dependabot_security_updates setting in security_and_analysis +**Type:** Rule +**ID:** `github-org-dependabot-security-updates-sa` +**Uses:** `github/org/dependabot-security-updates-sa@v2/rules` +**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) +**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego) +**Labels:** GitHub, Organization + +Verify Dependabot security updates are configured in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md new file mode 100644 index 000000000..7956e64d2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting +title: Verify dependabot_security_updates_enabled_for_new_repositories setting +--- +# Verify dependabot_security_updates_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependabot-security-updates` +**Uses:** `github/org/dependabot-security-updates@v2/rules` +**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) +**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego) +**Labels:** GitHub, Organization + +Verify Dependabot security updates for new repositories are configured in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md new file mode 100644 index 000000000..910faa028 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting +title: Verify dependency_graph_enabled_for_new_repositories setting +--- +# Verify dependency_graph_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-dependency-graph` +**Uses:** `github/org/dependency-graph@v2/rules` +**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) +**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) +**Labels:** GitHub, Organization + +Verify `dependency_graph` is enabled for new repositories in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md new file mode 100644 index 000000000..85b2b2b69 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Limit Admin Number in GitHub Organization +title: Limit Admin Number in GitHub Organization +--- +# Limit Admin Number in GitHub Organization +**Type:** Rule +**ID:** `github-org-max-admins` +**Uses:** `github/org/max-admins@v2/rules` +**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) +**Labels:** Blueprint, GitHub, Organization + +Verify the maximum number of GitHub organization admins is restricted. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md new file mode 100644 index 000000000..54b24f34d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify GitHub Organization Secrets Are Not Too Old +title: Verify GitHub Organization Secrets Are Not Too Old +--- +# Verify GitHub Organization Secrets Are Not Too Old +**Type:** Rule +**ID:** `github-org-old-secrets` +**Uses:** `github/org/old-secrets@v2/rules` +**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego) +**Labels:** GitHub, Organization + +Verify secrets in the GitHub organization are not older than the specified threshold. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_secret_age | 12 | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md new file mode 100644 index 000000000..c2a6daea7 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +--- +# Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +**Type:** Rule +**ID:** `github-org-pp-custom-link` +**Uses:** `github/org/pp-custom-link@v2/rules` +**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) +**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md new file mode 100644 index 000000000..dc2bffe5d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection Setting +title: Verify Secret_Scanning_Push_Protection Setting +--- +# Verify Secret_Scanning_Push_Protection Setting +**Type:** Rule +**ID:** `github-org-push-protection-sa` +**Uses:** `github/org/push-protection-sa@v2/rules` +**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) +**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection` is configured in the GitHub repository. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md new file mode 100644 index 000000000..33ff8c5f6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md @@ -0,0 +1,39 @@ +--- +sidebar_label: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories + Setting +title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +--- +# Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +**Type:** Rule +**ID:** `github-org-push-protection` +**Uses:** `github/org/push-protection@v2/rules` +**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md new file mode 100644 index 000000000..44d6a2217 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Repo Visibility Setting +title: Verify Repo Visibility Setting +--- +# Verify Repo Visibility Setting +**Type:** Rule +**ID:** `github-org-repo-visibility` +**Uses:** `github/org/repo-visibility@v2/rules` +**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) +**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) +**Labels:** GitHub, Organization + +Verify only repositories in the Allowed List are public in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_repo_names | [] | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md new file mode 100644 index 000000000..32bfe2a76 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Secret_Scanning Setting in Security_And_Analysis +title: Verify Secret_Scanning Setting in Security_And_Analysis +--- +# Verify Secret_Scanning Setting in Security_And_Analysis +**Type:** Rule +**ID:** `github-org-secret-scanning-sa` +**Uses:** `github/org/secret-scanning-sa@v2/rules` +**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) +**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning` is configured in the GitHub repository. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md new file mode 100644 index 000000000..261afff50 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify secret_scanning_enabled_for_new_repositories setting +title: Verify secret_scanning_enabled_for_new_repositories setting +--- +# Verify secret_scanning_enabled_for_new_repositories setting +**Type:** Rule +**ID:** `github-org-secret-scanning` +**Uses:** `github/org/secret-scanning@v2/rules` +**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning` is enabled for new repositories in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md new file mode 100644 index 000000000..78fda54b1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +--- +# Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +**Type:** Rule +**ID:** `github-org-validity-checks-sa` +**Uses:** `github/org/validity-checks-sa@v2/rules` +**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) +**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_validity_checks` is configured in the GitHub organization. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md new file mode 100644 index 000000000..4c22fd1e4 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Secret_Scanning_Validity_Checks_Enabled Setting +title: Verify Secret_Scanning_Validity_Checks_Enabled Setting +--- +# Verify Secret_Scanning_Validity_Checks_Enabled Setting +**Type:** Rule +**ID:** `github-org-validity-checks` +**Uses:** `github/org/validity-checks@v2/rules` +**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) +**Labels:** GitHub, Organization + +Verify `secret_scanning_validity_checks` is configured in the GitHub repository. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md new file mode 100644 index 000000000..673c12709 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify GitHub Organization Requires Signoff on Web Commits +title: Verify GitHub Organization Requires Signoff on Web Commits +--- +# Verify GitHub Organization Requires Signoff on Web Commits +**Type:** Rule +**ID:** `github-org-web-commit-signoff` +**Uses:** `github/org/web-commit-signoff@v2/rules` +**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) +**Labels:** GitHub, Organization + +Verify contributors sign commits through the GitHub web interface. + +:::note +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=organization | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/_category_.json b/docs/configuration/v2/initiatives/rules/github/repository/_category_.json new file mode 100644 index 000000000..e93f68442 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Repository", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md new file mode 100644 index 000000000..b894a20a9 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md @@ -0,0 +1,39 @@ +--- +sidebar_label: Verify Branch Protection Setting +title: Verify Branch Protection Setting +--- +# Verify Branch Protection Setting +**Type:** Rule +**ID:** `github-repo-branch-protection` +**Uses:** `github/repository/branch-protection@v2/rules` +**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml) +**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego) +**Labels:** GitHub, Repository + +Verify branch protection is configured in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_protected | True | +| branches | ['main', 'master'] | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md new file mode 100644 index 000000000..a405b1b16 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Branch Verification Setting +title: Verify Branch Verification Setting +--- +# Verify Branch Verification Setting +**Type:** Rule +**ID:** `github-repo-branch-verification` +**Uses:** `github/repository/branch-verification@v2/rules` +**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml) +**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego) +**Labels:** GitHub, Repository + +Verify branch verification in the GitHub repository matches the value defined in the configuration file. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_verified | False | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md new file mode 100644 index 000000000..f5fd720a2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify All Commits Are Signed in Repository +title: Verify All Commits Are Signed in Repository +--- +# Verify All Commits Are Signed in Repository +**Type:** Rule +**ID:** `github-repo-signed-commits` +**Uses:** `github/repository/check-signed-commits@v2/rules` +**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego) +**Labels:** GitHub, Repository + +Verify all commits in the GitHub repository are signed. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md new file mode 100644 index 000000000..fdfd24a1b --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Default Branch Protection +title: Verify Default Branch Protection +--- +# Verify Default Branch Protection +**Type:** Rule +**ID:** `github-repo-default-branch-protection` +**Uses:** `github/repository/default-branch-protection@v2/rules` +**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml) +**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego) +**Labels:** GitHub, Repository + +Verify the default branch protection is configured in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md new file mode 100644 index 000000000..9492af752 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Dependabot security updates setting +title: Verify Dependabot security updates setting +--- +# Verify Dependabot security updates setting +**Type:** Rule +**ID:** `github-repo-dependabot` +**Uses:** `github/repository/dependabot@v2/rules` +**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) +**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego) +**Labels:** GitHub, Repository + +Verify Dependabot security updates are configured in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md new file mode 100644 index 000000000..ba1382e7e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Only Ephemeral Runners Exist in Repository +title: Verify Only Ephemeral Runners Exist in Repository +--- +# Verify Only Ephemeral Runners Exist in Repository +**Type:** Rule +**ID:** `github-repo-ephemeral-runners-only` +**Uses:** `github/repository/ephemeral-runners-only@v2/rules` +**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml) +**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego) +**Labels:** GitHub, Repository + +Verify self-hosted runners are disallowed in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md new file mode 100644 index 000000000..3f8fe057f --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify No Cache Usage Exists in Repository +title: Verify No Cache Usage Exists in Repository +--- +# Verify No Cache Usage Exists in Repository +**Type:** Rule +**ID:** `github-repo-no-cache-usage` +**Uses:** `github/repository/no-cache-usage@v2/rules` +**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml) +**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego) +**Labels:** GitHub, Repository + +Verify the GitHub repository has no cache usage. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md new file mode 100644 index 000000000..c9cf95629 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify No Organization Secrets Exist in Repository +title: Verify No Organization Secrets Exist in Repository +--- +# Verify No Organization Secrets Exist in Repository +**Type:** Rule +**ID:** `github-repo-no-org-secrets` +**Uses:** `github/repository/no-org-secrets@v2/rules` +**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml) +**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego) +**Labels:** GitHub, Repository + +Verify no organization secrets exist in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md new file mode 100644 index 000000000..5d2f5fd06 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify No Old Secrets Exist in Repository +title: Verify No Old Secrets Exist in Repository +--- +# Verify No Old Secrets Exist in Repository +**Type:** Rule +**ID:** `github-repo-old-secrets` +**Uses:** `github/repository/old-secrets@v2/rules` +**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml) +**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego) +**Labels:** GitHub, Repository + +Verify secrets in the GitHub repository are not older than the specified threshold. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_secret_age | 12 | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md new file mode 100644 index 000000000..d863b1b53 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Push Protection Setting +title: Verify Push Protection Setting +--- +# Verify Push Protection Setting +**Type:** Rule +**ID:** `github-repo-push-protection` +**Uses:** `github/repository/push-protection@v2/rules` +**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml) +**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) +**Labels:** GitHub, Repository + +Verify `secret_scanning_push_protection` is configured in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md new file mode 100644 index 000000000..ed82a1378 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Repository Is Private +title: Verify Repository Is Private +--- +# Verify Repository Is Private +**Type:** Rule +**ID:** `github-repo-private` +**Uses:** `github/repository/repo-private@v2/rules` +**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml) +**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego) +**Labels:** GitHub, Repository + +Verify the GitHub repository is private. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md new file mode 100644 index 000000000..6667f2a99 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify secret_scanning setting +title: Verify secret_scanning setting +--- +# Verify secret_scanning setting +**Type:** Rule +**ID:** `github-repo-secret-scanning` +**Uses:** `github/repository/secret-scanning@v2/rules` +**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml) +**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) +**Labels:** GitHub, Repository + +Verify `secret_scanning` is configured in the GitHub repository. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md new file mode 100644 index 000000000..d28625af9 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify All Commits Are Signed in Repository +title: Verify All Commits Are Signed in Repository +--- +# Verify All Commits Are Signed in Repository +**Type:** Rule +**ID:** `github-repo-signed-commits` +**Uses:** `github/repository/signed-commits@v2/rules` +**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml) +**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego) +**Labels:** GitHub, Repository + +Verify all commits are signed in a repository attestation. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md new file mode 100644 index 000000000..7ab444790 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify secret scanning. +title: Verify secret scanning. +--- +# Verify secret scanning. +**Type:** Rule +**ID:** `github-repo-validity-checks` +**Uses:** `github/repository/validity-checks@v2/rules` +**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml) +**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) +**Labels:** GitHub, Repository + +Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md new file mode 100644 index 000000000..bb2134616 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Public Repositories +title: Allowed Public Repositories +--- +# Allowed Public Repositories +**Type:** Rule +**ID:** `github-repo-visibility` +**Uses:** `github/repository/visibility@v2/rules` +**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml) +**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego) +**Labels:** GitHub, Repository + +Verify only GitHub repositories in the Allowed List are public. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_repo_names | [] | + diff --git a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md new file mode 100644 index 000000000..99d0d29d9 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Repository Requires Commit Signoff +title: Verify Repository Requires Commit Signoff +--- +# Verify Repository Requires Commit Signoff +**Type:** Rule +**ID:** `github-repo-web-commit-signoff` +**Uses:** `github/repository/web-commit-signoff@v2/rules` +**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml) +**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego) +**Labels:** GitHub, Repository + +Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. + +:::note +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/_category_.json new file mode 100644 index 000000000..d41c80a07 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Gitlab", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json new file mode 100644 index 000000000..1cd6c97e0 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Gitlab API", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md new file mode 100644 index 000000000..0775d11ca --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md @@ -0,0 +1,28 @@ +--- +sidebar_label: Set Push Rules in GitLab +title: Set Push Rules in GitLab +--- +# Set Push Rules in GitLab +**Type:** Rule +**ID:** `gitlab-api-push-rules` +**Uses:** `gitlab/api/push-rules@v2/rules` +**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml) +**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego) +**Labels:** Gitlab, API + +Verify GitLab push rules are configured via the API. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| api_token | `{{ .Args.Token }}` | +| project | `{{ .Args.Project }}` | +| push_rule | `{'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None}` | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md new file mode 100644 index 000000000..14681c39d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md @@ -0,0 +1,28 @@ +--- +sidebar_label: Sign Selected Commits in GitLab +title: Sign Selected Commits in GitLab +--- +# Sign Selected Commits in GitLab +**Type:** Rule +**ID:** `gitlab-api-signed-commits-list` +**Uses:** `gitlab/api/signed-commits-list@v2/rules` +**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml) +**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego) +**Labels:** Gitlab, API + +Verify the selected commits are signed in the GitLab organization. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_id_list | [] | +| private_token | | +| project_id | | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md new file mode 100644 index 000000000..cfbac0ea1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md @@ -0,0 +1,29 @@ +--- +sidebar_label: Sign Selected Commit Range in GitLab +title: Sign Selected Commit Range in GitLab +--- +# Sign Selected Commit Range in GitLab +**Type:** Rule +**ID:** `gitlab-api-signed-commits-range` +**Uses:** `gitlab/api/signed-commits-range@v2/rules` +**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) +**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) +**Labels:** Gitlab, API + +Verify the selected range of commits is signed via the GitLab API. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| since | | +| until | | +| project_id | | +| private_token | | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json new file mode 100644 index 000000000..1ce17e465 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Org", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md new file mode 100644 index 000000000..47334c1ed --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Admins in GitLab Organization +title: Allowed Admins in GitLab Organization +--- +# Allowed Admins in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-admins` +**Uses:** `gitlab/org/allow-admins@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml) +**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego) +**Labels:** Gitlab, Organization + +Verify only users in the Allowed List have admin privileges in the GitLab organization. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_admins | [] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md new file mode 100644 index 000000000..807bf8507 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Restrict Token Scopes in GitLab +title: Restrict Token Scopes in GitLab +--- +# Restrict Token Scopes in GitLab +**Type:** Rule +**ID:** `gitlab-org-allowed-token-scope` +**Uses:** `gitlab/org/allow-token-scopes@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml) +**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego) +**Labels:** Gitlab, Organization + +Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_token_scopes | ['api', 'read_api', 'read_repository', 'read_registry'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md new file mode 100644 index 000000000..2081bf272 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Users in GitLab Organization +title: Allowed Users in GitLab Organization +--- +# Allowed Users in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-users` +**Uses:** `gitlab/org/allow-users@v2/rules` +**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml) +**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego) +**Labels:** Gitlab, Organization + +Verify only users in the Allowed List have access to the GitLab organization. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md new file mode 100644 index 000000000..7db84cdc0 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Block Users in GitLab Organization +title: Block Users in GitLab Organization +--- +# Block Users in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-blocked-users` +**Uses:** `gitlab/org/blocked-users@v2/rules` +**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml) +**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego) +**Labels:** Gitlab, Organization + +Verify no users in the GitLab organization are on the block list. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocked_users | [] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md new file mode 100644 index 000000000..dd4ee66ea --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Prevent Token Expiration in GitLab Organization +title: Prevent Token Expiration in GitLab Organization +--- +# Prevent Token Expiration in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-token-about-to-expire` +**Uses:** `gitlab/org/expiring-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml) +**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego) +**Labels:** Gitlab, Organization + +Verify no GitLab organization tokens are about to expire. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| exiring_in_days | 30 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md new file mode 100644 index 000000000..87deffc1e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Forbid Token Scopes in GitLab Organization +title: Forbid Token Scopes in GitLab Organization +--- +# Forbid Token Scopes in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-disallowed-token-scope` +**Uses:** `gitlab/org/forbid-token-scopes@v2/rules` +**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml) +**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego) +**Labels:** Blueprint, Gitlab, Organization + +Verify no GitLab organization tokens have disallowed scopes. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| project_scopes | ['write_api', 'write_repository'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md new file mode 100644 index 000000000..af4e48288 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Ensure Active Projects in GitLab Organization +title: Ensure Active Projects in GitLab Organization +--- +# Ensure Active Projects in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-inactive-projects` +**Uses:** `gitlab/org/inactive-projects@v2/rules` +**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml) +**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego) +**Labels:** Gitlab, Organization + +Verify no GitLab organization projects are inactive. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 90 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md new file mode 100644 index 000000000..f40f63ed3 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Forbid Long-Lived Tokens in GitLab Organization +title: Forbid Long-Lived Tokens in GitLab Organization +--- +# Forbid Long-Lived Tokens in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-token-excessive-lifespan` +**Uses:** `gitlab/org/longlive-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml) +**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego) +**Labels:** Blueprint, Gitlab, Organization + +Verify no GitLab organization tokens have an excessively long lifespan. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| exiring_in_days | 365 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md new file mode 100644 index 000000000..527965a58 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Limit Admins in GitLab Organization +title: Limit Admins in GitLab Organization +--- +# Limit Admins in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-max-admins` +**Uses:** `gitlab/org/max-admins@v2/rules` +**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml) +**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego) +**Labels:** Blueprint, GitLab, Organization + +Verify the maximum number of admins for the GitLab project is restricted. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md new file mode 100644 index 000000000..9d1c66c97 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Restrict Public Visibility in GitLab Organization +title: Restrict Public Visibility in GitLab Organization +--- +# Restrict Public Visibility in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-allowed-visible-projects` +**Uses:** `gitlab/org/projects-visibility@v2/rules` +**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml) +**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego) +**Labels:** Gitlab, Organization + +Verify only allowed projects in the GitLab organization have public visibility. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_public | ['Learn GitLab', 'Scribe Gitlab Test'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md new file mode 100644 index 000000000..a5ebc847d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Forbid Unused Tokens in GitLab Organization +title: Forbid Unused Tokens in GitLab Organization +--- +# Forbid Unused Tokens in GitLab Organization +**Type:** Rule +**ID:** `gitlab-org-unused-tokens` +**Uses:** `gitlab/org/unused-tokens@v2/rules` +**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml) +**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego) +**Labels:** Gitlab, Organization + +Verify there are no unused GitLab organization tokens. + +:::note +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=organization | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| unused_for_days | 90 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json new file mode 100644 index 000000000..a57065cbf --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Pipeline", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md new file mode 100644 index 000000000..9df82e5c5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -0,0 +1,38 @@ +--- +sidebar_label: GitLab pipeline verify labels exist +title: GitLab pipeline verify labels exist +--- +# GitLab pipeline verify labels exist +**Type:** Rule +**ID:** `gitlab-pipeline-verify-labels-exist` +**Uses:** `gitlab/pipeline/verify-labels-exist@v2/rules` +**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego) +**Labels:** Gitlab, Pipeline + +Verify the pipeline has all required label keys and values. + +:::note +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pipeline | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | ['app.kubernetes.io/instance'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md new file mode 100644 index 000000000..dbd3bf258 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify GitLab Pipeline Labels +title: Verify GitLab Pipeline Labels +--- +# Verify GitLab Pipeline Labels +**Type:** Rule +**ID:** `gitlab-pipeline-verify-labels` +**Uses:** `gitlab/pipeline/verify-labels@v2/rules` +**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego) +**Labels:** Gitlab, Pipeline + +Verify the pipeline includes all required label keys and values. + +:::note +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pipeline | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| labels | `{'app.kubernetes.io/instance': 'defaul1t'}` | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json new file mode 100644 index 000000000..a88c9e5b1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Project", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md new file mode 100644 index 000000000..df85b81e2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Project Activity +title: Verify Project Activity +--- +# Verify Project Activity +**Type:** Rule +**ID:** `gitlab-project-abandoned-project` +**Uses:** `gitlab/project/abandoned-project@v2/rules` +**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml) +**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project is active for a specified duration. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 30 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md new file mode 100644 index 000000000..efc49aae7 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -0,0 +1,39 @@ +--- +sidebar_label: Merge approval policy check for GitLab project +title: Merge approval policy check for GitLab project +--- +# Merge approval policy check for GitLab project +**Type:** Rule +**ID:** `gitlab-project-merge-approval` +**Uses:** `gitlab/project/approvals-policy-check@v2/rules` +**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml) +**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego) +**Labels:** Blueprint, Gitlab, Project + +Verify the project's merge approval policy complies with requirements. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| name | All Members | +| approvals_required_min | 2 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md new file mode 100644 index 000000000..52f269abd --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Restrict Approvers Per Merge Request +title: Restrict Approvers Per Merge Request +--- +# Restrict Approvers Per Merge Request +**Type:** Rule +**ID:** `gitlab-project-approvers-per-merge-request` +**Uses:** `gitlab/project/approvers-per-merge-request@v2/rules` +**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml) +**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) +**Labels:** Gitlab, Project + +Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| disable_overriding_approvers_per_merge_request | False | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md new file mode 100644 index 000000000..3b4b06223 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Set Author Email Regex in GitLab Project +title: Set Author Email Regex in GitLab Project +--- +# Set Author Email Regex in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-author-email-regex` +**Uses:** `gitlab/project/author-email-regex@v2/rules` +**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml) +**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego) +**Labels:** Gitlab, Project + +Verify the `author_email_regex` for the GitLab project is set to the specified value. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| author_email_regex | | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md new file mode 100644 index 000000000..d60b4377b --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Check CWE Compliance +title: Check CWE Compliance +--- +# Check CWE Compliance +**Type:** Rule +**ID:** `gitlab-project-check-cwe` +**Uses:** `gitlab/project/check-cwe@v2/rules` +**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml) +**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego) +**Labels:** Gitlab, Project + +Verify that specified CWEs were not detected in the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| cwe_value | 89 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md new file mode 100644 index 000000000..539c25e11 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Ensure All Commits Are Signed in GitLab Project +title: Ensure All Commits Are Signed in GitLab Project +--- +# Ensure All Commits Are Signed in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-signed-commits` +**Uses:** `gitlab/project/check-signed-commits@v2/rules` +**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml) +**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego) +**Labels:** Gitlab, Project + +Verify all commits in the GitLab project are signed. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md new file mode 100644 index 000000000..13263990b --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Require Code Owner Approval in GitLab Project +title: Require Code Owner Approval in GitLab Project +--- +# Require Code Owner Approval in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-code-owner-approval` +**Uses:** `gitlab/project/co-approval-required@v2/rules` +**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml) +**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego) +**Labels:** Gitlab, Project + +Verify code owner approval is required for specific branches in the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md new file mode 100644 index 000000000..493e80d0c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Restrict Commit Authors in GitLab Project +title: Restrict Commit Authors in GitLab Project +--- +# Restrict Commit Authors in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-commit-authors` +**Uses:** `gitlab/project/commit-author-email-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml) +**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego) +**Labels:** Gitlab, Project + +Verify only GitLab project users in the Allowed List have commit author permissions. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_authors | ['mail@example.com'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md new file mode 100644 index 000000000..253b6359c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Commit Authors in GitLab Project +title: Allowed Commit Authors in GitLab Project +--- +# Allowed Commit Authors in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-commit-author-names` +**Uses:** `gitlab/project/commit-author-name-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml) +**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List author commits in the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_authors | ['examplename'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md new file mode 100644 index 000000000..43bf3f371 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Enable Commit Committer Check in GitLab Project +title: Enable Commit Committer Check in GitLab Project +--- +# Enable Commit Committer Check in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-commit_committer_check` +**Uses:** `gitlab/project/commit-committer-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml) +**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego) +**Labels:** Gitlab, Project + +Verify `commit_committer_check` is enabled for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md new file mode 100644 index 000000000..86418c640 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify Commit Message Format +title: Verify Commit Message Format +--- +# Verify Commit Message Format +**Type:** Rule +**ID:** `gitlab-project-verify-commit_message_check` +**Uses:** `gitlab/project/commit-message-check@v2/rules` +**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml) +**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego) +**Labels:** Gitlab, Project + +Verify that commit messages in the GitLab project adhere to the specified format template. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| commit_message_regex | .*JIRA-\d+.* | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md new file mode 100644 index 000000000..3e4588c99 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Validate All Commits in GitLab Project +title: Validate All Commits in GitLab Project +--- +# Validate All Commits in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-all-commits-validated` +**Uses:** `gitlab/project/commits-validated@v2/rules` +**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml) +**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego) +**Labels:** Gitlab, Project + +Verify all commits in the GitLab project are validated. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md new file mode 100644 index 000000000..b25f2f9bc --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Committer Emails in GitLab Project +title: Allowed Committer Emails in GitLab Project +--- +# Allowed Committer Emails in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-committer-emails` +**Uses:** `gitlab/project/committer-email-check@v2/rules` +**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml) +**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List use committer email addresses in the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_committers | ['mail@example.com'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md new file mode 100644 index 000000000..61a671818 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Allowed Committer Names in GitLab Project +title: Allowed Committer Names in GitLab Project +--- +# Allowed Committer Names in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-allowed-committer-names` +**Uses:** `gitlab/project/committer-name-check@v2/rules` +**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml) +**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego) +**Labels:** Gitlab, Project + +Verify only users in the Allowed List commit by name in the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allowed_committers | ['somename'] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md new file mode 100644 index 000000000..a1f26cb13 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Enforce Critical Severity Limit +title: Enforce Critical Severity Limit +--- +# Enforce Critical Severity Limit +**Type:** Rule +**ID:** `gitlab-project-critical-severity-limit` +**Uses:** `gitlab/project/critical-severity-limit@v2/rules` +**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml) +**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego) +**Labels:** Gitlab, Project + +Verify the maximum allowed critical severity alerts for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_allowed_vulnerability_count | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md new file mode 100644 index 000000000..e9f46ed8a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Check Description Substring +title: Check Description Substring +--- +# Check Description Substring +**Type:** Rule +**ID:** `gitlab-project-description-substring-check` +**Uses:** `gitlab/project/description-substring-check@v2/rules` +**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml) +**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego) +**Labels:** Gitlab, Project + +Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)insdput | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md new file mode 100644 index 000000000..84551fdec --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Disallow Banned Approvers +title: Disallow Banned Approvers +--- +# Disallow Banned Approvers +**Type:** Rule +**ID:** `gitlab-project-disallowed-banned-approvers` +**Uses:** `gitlab/project/disallowed-banned-approvers@v2/rules` +**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) +**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego) +**Labels:** Gitlab, Project + +Verify approvers in the GitLab project are not on the banned list. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| banned_list | [] | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md new file mode 100644 index 000000000..206a299c2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Disallow Force Push in GitLab Project +title: Disallow Force Push in GitLab Project +--- +# Disallow Force Push in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-disallow-force-push` +**Uses:** `gitlab/project/force-push-protection@v2/rules` +**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml) +**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego) +**Labels:** Gitlab, Project + +Verify force pushes in the GitLab project are disallowed to maintain repository integrity. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md new file mode 100644 index 000000000..d4adead00 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Enforce Medium Severity Limit +title: Enforce Medium Severity Limit +--- +# Enforce Medium Severity Limit +**Type:** Rule +**ID:** `gitlab-project-medium-severity-limit` +**Uses:** `gitlab/project/medium-severity-limit@v2/rules` +**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml) +**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego) +**Labels:** Gitlab, Project + +Verify the maximum allowed medium severity alerts for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_allowed_specific_severity | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md new file mode 100644 index 000000000..d8092c8cd --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Enable Member Check for GitLab Project +title: Enable Member Check for GitLab Project +--- +# Enable Member Check for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-member_check` +**Uses:** `gitlab/project/member-check@v2/rules` +**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml) +**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego) +**Labels:** Gitlab, Project + +Verify `member_check` is enabled for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md new file mode 100644 index 000000000..e39c71110 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md @@ -0,0 +1,39 @@ +--- +sidebar_label: Enforce Merge Access Level Policy for GitLab Project +title: Enforce Merge Access Level Policy for GitLab Project +--- +# Enforce Merge Access Level Policy for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-merge-access-level` +**Uses:** `gitlab/project/merge-access-level@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml) +**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's merge access level complies with requirements. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | +| access_level_description | Maintainers | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md new file mode 100644 index 000000000..faa1a0cb7 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Disable Author Approval for Merge Requests in GitLab +title: Disable Author Approval for Merge Requests in GitLab +--- +# Disable Author Approval for Merge Requests in GitLab +**Type:** Rule +**ID:** `gitlab-project-merge-requests-author-approval` +**Uses:** `gitlab/project/merge-requests-author-approval@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml) +**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) +**Labels:** Gitlab, Project + +Verify the binary field `merge_requests_author_approval` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| merge_requests_author_approval | True | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md new file mode 100644 index 000000000..298bd272d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Disable Committers' Approval for Merge Requests in GitLab +title: Disable Committers' Approval for Merge Requests in GitLab +--- +# Disable Committers' Approval for Merge Requests in GitLab +**Type:** Rule +**ID:** `gitlab-project-merge-requests-disable-committers-approval` +**Uses:** `gitlab/project/merge-requests-disable-committers-approval@v2/rules` +**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) +**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) +**Labels:** Gitlab, Project + +Verify `merge_requests_disable_committers_approval` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| merge_requests_disable_committers_approval | False | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md new file mode 100644 index 000000000..d36e50548 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Check Message Substring +title: Check Message Substring +--- +# Check Message Substring +**Type:** Rule +**ID:** `gitlab-project-message-substring-check` +**Uses:** `gitlab/project/message-substring-check@v2/rules` +**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml) +**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego) +**Labels:** Gitlab, Project + +Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)dghd | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md new file mode 100644 index 000000000..7df8bf61c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Enable Secrets Prevention in GitLab Project +title: Enable Secrets Prevention in GitLab Project +--- +# Enable Secrets Prevention in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-prevent_secrets` +**Uses:** `gitlab/project/prevent-secrets-check@v2/rules` +**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml) +**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego) +**Labels:** Gitlab, Project + +Verify `prevent_secrets` is enabled for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md new file mode 100644 index 000000000..1162289a1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Protect CI Secrets in GitLab Project +title: Protect CI Secrets in GitLab Project +--- +# Protect CI Secrets in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-protect-ci-secrets` +**Uses:** `gitlab/project/protect-ci-secrets@v2/rules` +**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml) +**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego) +**Labels:** Gitlab, Project + +Verify secrets in the GitLab project are not shared. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| pattern | (?i)(token|secret) | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md new file mode 100644 index 000000000..34f462a1c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md @@ -0,0 +1,39 @@ +--- +sidebar_label: Set Push Access Level in GitLab Project +title: Set Push Access Level in GitLab Project +--- +# Set Push Access Level in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-push-access-level` +**Uses:** `gitlab/project/push-access-level@v2/rules` +**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml) +**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's push access level policy complies with requirements. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| branch | main | +| access_level_description | Maintainers | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md new file mode 100644 index 000000000..ff581119e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Set Push Rules for GitLab Project +title: Set Push Rules for GitLab Project +--- +# Set Push Rules for GitLab Project +**Type:** Rule +**ID:** `gitlab-project-verify-push_rules` +**Uses:** `gitlab/project/push-rules-set@v2/rules` +**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml) +**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego) +**Labels:** Gitlab, Project + +Verify push rules are set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md new file mode 100644 index 000000000..4d8d745c8 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Reject Unsigned Commits in GitLab Project +title: Reject Unsigned Commits in GitLab Project +--- +# Reject Unsigned Commits in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-disallow-unsigned-commits` +**Uses:** `gitlab/project/reject-unsigned-commits@v2/rules` +**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml) +**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego) +**Labels:** Blueprint, Gitlab, Project + +Verify `reject_unsigned_commits` is enabled for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md new file mode 100644 index 000000000..0bcbea9e7 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Require Password for Approvals in GitLab Project +title: Require Password for Approvals in GitLab Project +--- +# Require Password for Approvals in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-require-password-to-approve` +**Uses:** `gitlab/project/require-password-to-approve@v2/rules` +**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml) +**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego) +**Labels:** Gitlab, Project + +Verify the binary field `require_password_to_approve` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| require_password_to_approve | True | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md new file mode 100644 index 000000000..446d41f0a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Require Minimal Approvers in GitLab Project +title: Require Minimal Approvers in GitLab Project +--- +# Require Minimal Approvers in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-required-minimal-approvers` +**Uses:** `gitlab/project/required-minimal-approvers@v2/rules` +**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml) +**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego) +**Labels:** Gitlab, Project + +Verify the required number of approvers for the GitLab project is met. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md new file mode 100644 index 000000000..2cede0d5c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Reset Approvals on Push in GitLab Project +title: Reset Approvals on Push in GitLab Project +--- +# Reset Approvals on Push in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-reset-pprovals-on-push` +**Uses:** `gitlab/project/reset-pprovals-on-push@v2/rules` +**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) +**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego) +**Labels:** Gitlab, Project + +Verify `reset_approvals_on_push` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| reset_approvals_on_push | True | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md new file mode 100644 index 000000000..4f945318a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Ensure SAST Scanning Passes +title: Ensure SAST Scanning Passes +--- +# Ensure SAST Scanning Passes +**Type:** Rule +**ID:** `gitlab-project-sast-scan-pass` +**Uses:** `gitlab/project/sast-scan-pass@v2/rules` +**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml) +**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego) +**Labels:** Gitlab, Project + +Verify SAST scanning is successful for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md new file mode 100644 index 000000000..35fef07cb --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Run SAST Scanning in GitLab Project +title: Run SAST Scanning in GitLab Project +--- +# Run SAST Scanning in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-sast-scanning` +**Uses:** `gitlab/project/sast-scanning@v2/rules` +**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml) +**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego) +**Labels:** Gitlab, Project + +Verify SAST scanning is performed for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md new file mode 100644 index 000000000..8cd54fb8e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Ensure Secrets Scanning Passes +title: Ensure Secrets Scanning Passes +--- +# Ensure Secrets Scanning Passes +**Type:** Rule +**ID:** `gitlab-project-secrets-scan-pass` +**Uses:** `gitlab/project/secrets-scan-pass@v2/rules` +**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml) +**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego) +**Labels:** Gitlab, Project + +Verify secrets scanning is successful for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md new file mode 100644 index 000000000..b6f9323ef --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Run Secrets Scanning in GitLab Project +title: Run Secrets Scanning in GitLab Project +--- +# Run Secrets Scanning in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-secrets-scanning` +**Uses:** `gitlab/project/secrets-scanning@v2/rules` +**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml) +**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego) +**Labels:** Gitlab, Project + +Verify secrets scanning is performed for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md new file mode 100644 index 000000000..10e339523 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Restrict Selective Code Owner Removals in GitLab +title: Restrict Selective Code Owner Removals in GitLab +--- +# Restrict Selective Code Owner Removals in GitLab +**Type:** Rule +**ID:** `gitlab-project-selective-code-owner-removals` +**Uses:** `gitlab/project/selective-code-owner-removals@v2/rules` +**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml) +**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego) +**Labels:** Gitlab, Project + +Verify `selective_code_owner_removals` is set for the GitLab project. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| selective_code_owner_removals | True | + diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md new file mode 100644 index 000000000..56ba542ea --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Set Visibility Level in GitLab Project +title: Set Visibility Level in GitLab Project +--- +# Set Visibility Level in GitLab Project +**Type:** Rule +**ID:** `gitlab-project-project-visibility-level` +**Uses:** `gitlab/project/visibility-check@v2/rules` +**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml) +**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego) +**Labels:** Gitlab, Project + +Verify the GitLab project's visibility matches the required level. + +:::note +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=gitlab
- asset_type=project | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| visibility | private | + diff --git a/docs/configuration/v2/initiatives/rules/images/_category_.json b/docs/configuration/v2/initiatives/rules/images/_category_.json new file mode 100644 index 000000000..fb18a4fc4 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Images", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md new file mode 100644 index 000000000..c3d388068 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md @@ -0,0 +1,73 @@ +--- +sidebar_label: Allowed Base Image +title: Allowed Base Image +--- +# Allowed Base Image +**Type:** Rule +**ID:** `images-allowed-base-image` +**Uses:** `images/allowed-base-image@v2/rules` +**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml) +**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) +**Labels:** SBOM, Images + +Verifies that every base image is from an approved source. The rule returns a summary +including the component names and versions of valid base images, or lists the invalid ones. +This rule requires Dockerfile context; for example, run it with: +`valint my_image --base-image Dockerfile`. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/allowed-base-image@v2/rules +with: + approved_sources: + - "docker.io/library/*" + - "docker.io/my_org/*" +``` + +## Mitigation +Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. + + + +## Description +This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images. +A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true". +For each detected base image, the rule verifies that its name matches one of the approved source patterns defined in the configuration +(via `with.approved_sources`). If a base image does not match any of the approved patterns, it is flagged as invalid. If no base image data +is found, a violation is recorded indicating that the necessary base image information is missing. + +**Evidence Requirements:** + +- The SBOM evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array containing properties that identify base images. +- The approved source patterns must be specified in the `with.approved_sources` parameter. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| approved_sources | array | False | A list of approved base image pattern. | + diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md new file mode 100644 index 000000000..602abe860 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md @@ -0,0 +1,70 @@ +--- +sidebar_label: Allowed Main Image Source +title: Allowed Main Image Source +--- +# Allowed Main Image Source +**Type:** Rule +**ID:** `images-allowed-image-source` +**Uses:** `images/allowed-image-source@v2/rules` +**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml) +**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego) +**Labels:** SBOM, Images + +Ensures the main container image referenced in the SBOM is from an approved source. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/allowed-image-source@v2/rules +with: + approved_sources: + - "docker.io/library/*" + - "docker.io/my_org/*" +``` + +## Mitigation +Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. + + + +## Description +This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source. +It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`). +The matching is performed using a case-insensitive, anchored regex. + +- If one or more approved source patterns are provided and the image name matches at least one pattern, the image is considered compliant. +- If the image name does not match any approved source, or if no approved source patterns are provided, a violation is recorded. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields. +- The approved source patterns must be specified in `with.approved_sources`. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| approved_sources | array | False | A list of approved Image source patterns. | + diff --git a/docs/configuration/v2/initiatives/rules/images/banned-ports.md b/docs/configuration/v2/initiatives/rules/images/banned-ports.md new file mode 100644 index 000000000..37ad6ed31 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/banned-ports.md @@ -0,0 +1,75 @@ +--- +sidebar_label: Banned Ports +title: Banned Ports +--- +# Banned Ports +**Type:** Rule +**ID:** `images-banned-ports` +**Uses:** `images/banned-ports@v2/rules` +**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml) +**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) +**Labels:** SBOM, Images + +Ensures that the container image does not expose ports that are disallowed by organizational policy. +The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. +It fails if any banned port is exposed or if no banned ports list is provided. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/banned-ports@v2/rules +with: + banned_ports: + - port: "3000" + protocol: "tcp" + - port: "8080" + protocol: "tcp" +``` + +## Mitigation +Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. + + + +## Description +This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed. +It performs the following steps: + +1. Retrieves all properties from the SBOM's `metadata.component.properties` whose names start with "imageExposedPorts_". +2. Expects each property value to be formatted as "port/protocol" (e.g., "3000/tcp") and splits the value into its components. +3. Compares each exposed port against the list of banned ports provided in the configuration (`with.banned_ports`). + - If a banned port (and, if specified, protocol) is detected, the rule flags it as a violation. +4. If no banned ports list is provided, the rule also fails. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component.properties` array with entries for exposed ports. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| banned_ports | array | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. | + diff --git a/docs/configuration/v2/initiatives/rules/images/banned-users.md b/docs/configuration/v2/initiatives/rules/images/banned-users.md new file mode 100644 index 000000000..b0ac82c5e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/banned-users.md @@ -0,0 +1,68 @@ +--- +sidebar_label: Disallow Specific Users in SBOM +title: Disallow Specific Users in SBOM +--- +# Disallow Specific Users in SBOM +**Type:** Rule +**ID:** `sbom-disallowed-users` +**Uses:** `images/banned-users@v2/rules` +**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml) +**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego) +**Labels:** SBOM, Image + +Verify specific users are not allowed in an SBOM. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/banned-users@v2/rules +with: + users: + - root +``` + +## Mitigation +Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured +to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property +with the name "user". The value of this property is then compared against a list of disallowed users specified in +the configuration (via `with.users`). If the image is found to be running as a banned user (for example, "root"), +a violation is recorded. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user". +- The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| users | array | False | A list of disallowed users. Each entry should be a string representing a username. | + diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md new file mode 100644 index 000000000..5506692dc --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md @@ -0,0 +1,57 @@ +--- +sidebar_label: Restrict Build Scripts +title: Restrict Build Scripts +--- +# Restrict Build Scripts +**Type:** Rule +**ID:** `images-disallowed-build-script` +**Uses:** `images/blocklist-build-scripts@v2/rules` +**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml) +**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego) +**Labels:** SBOM, Images + +Verify no build scripts commands appear in block list. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: images/blocklist-build-scripts@v2/rules +with: + blocklist: + - "wget" + - "curl" +``` + +## Mitigation +Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. + + + +## Description +This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". +It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. +If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| blocklist | array | False | A list of disallowed build script commands. Each entry should be a string representing a command or substring. | + diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-user.md b/docs/configuration/v2/initiatives/rules/images/blocklist-user.md new file mode 100644 index 000000000..9acd11cac --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/blocklist-user.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Blocklist Container User +title: Blocklist Container User +--- +# Blocklist Container User +**Type:** Rule +**ID:** `images-blocklist-user` +**Uses:** `images/blocklist-user@v2/rules` +**Source:** [v2/rules/images/blocklist-user.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.yaml) +**Rego Source:** [blocklist-user.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.rego) +**Labels:** SBOM, Images + +Ensures that the container image does not use a user in the blocklist. +We look for a SBOM property named "user" in metadata.component.properties. +If it matches any username from the 'users' list, we fail. + + +:::tip +Rule Result will be set as 'open' if evidence is missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +his rule requires evaluation with a target; without one, the rule will be **disabled**. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| users | [] | diff --git a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md new file mode 100644 index 000000000..8ead1a091 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md @@ -0,0 +1,48 @@ +--- +sidebar_label: Registry Connection HTTPS +title: Registry Connection HTTPS +--- +# Registry Connection HTTPS +**Type:** Rule +**ID:** `images-registry-https-check` +**Uses:** `images/enforce-https-registry@v2/rules` +**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml) +**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego) +**Labels:** Registry, Images + +Checks if the container's registry scheme is HTTPS + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Description +This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection +is secure. It does so by scanning the `metadata.component.properties` array for a property named +'registry_scheme'. If the value of this property is exactly 'https', the rule passes; otherwise, it fails, +indicating that the image may have been pulled from an insecure registry. + +**Evidence Requirements:** + +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['product', 'target'] | + diff --git a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md new file mode 100644 index 000000000..4cac5c3dc --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md @@ -0,0 +1,64 @@ +--- +sidebar_label: Forbid Large Images +title: Forbid Large Images +--- +# Forbid Large Images +**Type:** Rule +**ID:** `images-project-large-image` +**Uses:** `images/forbid-large-images@v2/rules` +**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml) +**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego) +**Labels:** SBOM, Images + +Verify the image size is below the specified threshold. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: images/forbid-large-images@v2/rules +with: + max_size: 77819980 +``` + +## Mitigation +Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components +to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically +looks for the size property when the associated "index" property is "0" (which typically represents the overall image size). +The extracted size is then converted to a numeric value and compared against the maximum size specified in the rule's configuration (`max_size`). + +- If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable. +- If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size. + +### **Evidence Requirements** + +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_size | integer | True | The maximum allowed image size in bytes. | + diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md new file mode 100644 index 000000000..efea01d97 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Fresh Base Image +title: Fresh Base Image +--- +# Fresh Base Image +**Type:** Rule +**ID:** `images-fresh-base-image` +**Uses:** `images/fresh-base-image@v2/rules` +**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml) +**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego) +**Labels:** SBOM, Images + +Verifies that each base image is not older than the specified threshold (max_days) from its creation date. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/fresh-base-image@v2/rules +with: + max_days: 183 +``` + +## Mitigation +Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. + + + +## Description +This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. +It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". +The rule then extracts the "created" timestamp from these components and calculates the image’s age against the allowed threshold specified in `with.max_days`. +If any base image is older than the allowed age, or if no base image data is found, the rule records a violation. + +**Evidence Requirements:** +- Evidence must be provided in CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | True | The maximum allowed age of the base image in days. | + diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-image.md new file mode 100644 index 000000000..019c85073 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/fresh-image.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Fresh Image +title: Fresh Image +--- +# Fresh Image +**Type:** Rule +**ID:** `fresh-image` +**Uses:** `images/fresh-image@v2/rules` +**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml) +**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego) +**Labels:** SBOM, Images + +Verify the image is not older than the specified threshold. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Usage example + +```yaml +uses: images/fresh-image@v2/rules +with: + max_days: 183 +``` + +## Mitigation +Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. + + + +## Description +This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" +within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339. + +The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum, +the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time. + +### **Evidence Requirements** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | True | The maximum allowed age of the image in days. | + diff --git a/docs/configuration/v2/initiatives/rules/images/image-signed.md b/docs/configuration/v2/initiatives/rules/images/image-signed.md new file mode 100644 index 000000000..e14d1b397 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/image-signed.md @@ -0,0 +1,73 @@ +--- +sidebar_label: Require Signed Container Image +title: Require Signed Container Image +--- +# Require Signed Container Image +**Type:** Rule +**ID:** `images-require-signed-image` +**Uses:** `images/image-signed@v2/rules` +**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml) +**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego) +**Labels:** Images, Blueprint + +Enforces that container images (target_type=container) are cryptographically signed. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: images/image-signed@v2/rules +with: + identity: + emails: + - bob@company.com + - alice@company.com + skip_image_regex: + - .*alpine.* +``` + +## Mitigation +Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. + + + +## Description +This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the +environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the +image name matches any pattern specified in `with.skip_image_regex`, the signature check is skipped, allowing flexibility +for images that do not require a signature. Otherwise, if the evidence does not indicate a valid signature, the rule fails. + +**Evidence Requirements:** + +- Evidence must be provided in CycloneDX JSON format with a `content_body_type` of "cyclonedx-json". +- The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json"). +- The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| target_type | container | +| signed | False | +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| identity | object | False | Identity information for the signers | +| skip_image_regex | array | False | Patterns to bypass the signature requirement for certain images | + diff --git a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md new file mode 100644 index 000000000..5a07f96ff --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md @@ -0,0 +1,52 @@ +--- +sidebar_label: Require Healthcheck +title: Require Healthcheck +--- +# Require Healthcheck +**Type:** Rule +**ID:** `images-require-healthcheck` +**Uses:** `images/require-healthcheck@v2/rules` +**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml) +**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego) +**Labels:** SBOM, Images + +Checks that the container image includes at least one healthcheck property. + + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by target and product. +::: + +## Mitigation +Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. + + + +## Description +This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined. +It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, +starts with "imagehealthcheck_". If at least one such property is found, the image is considered compliant; +otherwise, a violation is recorded indicating a missing healthcheck. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | +| filter-by | ['target', 'product'] | + diff --git a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md new file mode 100644 index 000000000..7240bd0fd --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md @@ -0,0 +1,46 @@ +--- +sidebar_label: Disallow Container Shell Entrypoint +title: Disallow Container Shell Entrypoint +--- +# Disallow Container Shell Entrypoint +**Type:** Rule +**ID:** `images-disallow-shell-access` +**Uses:** `images/restrict-shell-entrypoint@v2/rules` +**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml) +**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego) +**Labels:** SBOM, Images + +Verify the container image disallows shell entrypoint. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. + + + +## Description +This rule ensures that container images do not allow shell access by verifying their configured entrypoint. +Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. +This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). + +### **Evidence Requirements** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md new file mode 100644 index 000000000..853cafa03 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md @@ -0,0 +1,69 @@ +--- +sidebar_label: Require Image Labels +title: Require Image Labels +--- +# Require Image Labels +**Type:** Rule +**ID:** `required-image-labels` +**Uses:** `images/verify-labels-exist@v2/rules` +**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml) +**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego) +**Labels:** SBOM, Images + +Verify the image has the specified labels. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: images/verify-labels-exist@v2/rules +with: + labels: + - "org.opencontainers.image.created" + - "org.opencontainers.image.revision" + - "org.opencontainers.image.title" + - "org.opencontainers.image.vendor" + - "org.opencontainers.image.version" +``` + +## Mitigation +Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. + + + +## Description +This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label +(as defined in the `with.labels` parameter) exists with the correct value. + +1. The rule iterates over the list of required labels provided in the `with.labels` configuration. +2. For each required label, it examines the `metadata.component.properties` array in the SBOM. +3. It looks for a property where the name starts with "label_" and ends with the required label key, and + where the property value matches the expected value. +4. If such a property is not found, a violation is recorded with the missing label and expected value details. + +### **Evidence Requirements** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array that contains label information. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | array | False | A list of required labels. | + diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels.md b/docs/configuration/v2/initiatives/rules/images/verify-labels.md new file mode 100644 index 000000000..965c1ff95 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Verify Image Labels +title: Verify Image Labels +--- +# Verify Image Labels +**Type:** Rule +**ID:** `image-labels` +**Uses:** `images/verify-labels@v2/rules` +**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml) +**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego) +**Labels:** SBOM, Images + +Verify specified labels key-value pairs exist in the image. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: images/verify-labels@v2/rules +with: + labels: + - "org.opencontainers.image.vendor=my_vendor" +``` + +## Mitigation +Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. + + + +## Description +This rule checks the CycloneDX SBOM evidence for the container image to verify that each +required label (as defined in the `with.labels` parameter) exists with the correct value. + +1. The rule iterates over the list of required labels provided in the `with.labels` configuration. +2. For each required label, it examines the `metadata.component.properties` array in the SBOM. +3. It looks for a property where the name starts with "label_" and ends with the required label key, and + where the property value matches the expected value. +4. If such a property is not found, a violation is recorded with the missing label and expected value details. + +### **Evidence Requirements** +- Evidence must be provided in the `cyclonedx-json` format. +- The SBOM should include a `metadata.component.properties` array that contains label information. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | array | False | A list of required labels. | + diff --git a/docs/configuration/v2/initiatives/rules/jenkins/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/_category_.json new file mode 100644 index 000000000..a1e606da6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Jenkins", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json new file mode 100644 index 000000000..5a7c99815 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Folder", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md new file mode 100644 index 000000000..b1f7925b5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Verify Exposed Credentials +title: Verify Exposed Credentials +--- +# Verify Exposed Credentials +**Type:** Rule +**ID:** `jenkins-exposed-credentials` +**Uses:** `jenkins/folder/exposed-credentials@v2/rules` +**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml) +**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego) +**Labels:** Jenkins, Folder + +Verify there are no exposed credentials. + +:::note +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=folder | + diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json new file mode 100644 index 000000000..194968062 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Instance", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md new file mode 100644 index 000000000..8220a73bc --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Verify Inactive Users +title: Verify Inactive Users +--- +# Verify Inactive Users +**Type:** Rule +**ID:** `jenkins-inactive-users` +**Uses:** `jenkins/instance/inactive-users@v2/rules` +**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml) +**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego) +**Labels:** Jenkins, Instance + +Verify there are no inactive users. + +:::note +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=instance
- platform=jenkins | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| inactive_for_days | 90 | + diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md new file mode 100644 index 000000000..d9d7e37d6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md @@ -0,0 +1,32 @@ +--- +sidebar_label: Disallow Unused Users +title: Disallow Unused Users +--- +# Disallow Unused Users +**Type:** Rule +**ID:** `jenkins-unused-users` +**Uses:** `jenkins/instance/unused-users@v2/rules` +**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml) +**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego) +**Labels:** Jenkins, Instance + +Verify there are no users with zero activity. + +:::note +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=instance
- platform=jenkins | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/_category_.json new file mode 100644 index 000000000..8b1cd3ce2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "K8S", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json new file mode 100644 index 000000000..3ea66151d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Namespace", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md new file mode 100644 index 000000000..021754215 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Allowed Container Images +title: Allowed Container Images +--- +# Allowed Container Images +**Type:** Rule +**ID:** `k8s-namespace-blocked-images` +**Uses:** `k8s/namespace/allowed-images@v2/rules` +**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml) +**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego) +**Labels:** K8s, Namespace + +Verify only container images specified in the Allowed List run within the Kubernetes namespace. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/namespace/allowed-images@v2/rules +with: + images_to_include: + - docker.io/my_org/my_image1 + - docker.io/my_org/my_image2 +``` + +## Mitigation +Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. + + + +## Description +This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the container images running in the namespace. +2. Checks each image against the allowed list specified in the `with.images_to_include` configuration. + - If an image is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| images_to_include | array | False | List of allowed container images. | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md new file mode 100644 index 000000000..7f21e779d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Allowed Namespace Registries +title: Allowed Namespace Registries +--- +# Allowed Namespace Registries +**Type:** Rule +**ID:** `k8s-namespace-allowed-registries` +**Uses:** `k8s/namespace/allowed-registries@v2/rules` +**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml) +**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego) +**Labels:** K8s, Namespace + +Verify container images in Kubernetes namespaces originate from registries in the Allowed List. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/namespace/allowed-registries@v2/rules +with: + allowed_registries: + - docker.io/* + - gcr.io/* +``` + +## Mitigation +Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. + + + +## Description +This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the container images running in the namespace. +2. Checks each image's registry against the allowed registries specified in the `with.allowed_registries` configuration. + - If an image's registry is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_registries | array | False | A list of allowed container registries Regex patterns. | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md new file mode 100644 index 000000000..790853f93 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -0,0 +1,63 @@ +--- +sidebar_label: Verify Namespace Runtime Duration +title: Verify Namespace Runtime Duration +--- +# Verify Namespace Runtime Duration +**Type:** Rule +**ID:** `k8s-namespace-verify-namespace-duration` +**Uses:** `k8s/namespace/verify-namespace-duration@v2/rules` +**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml) +**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego) +**Labels:** K8s, Namespace + +Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/namespace/verify-namespace-duration@v2/rules +with: + threshold_date: "1970-01-01T00:00:00Z" +``` + +## Mitigation +Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. + + + +## Description +This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit. +It performs the following steps: + +1. Iterates over the namespaces in the cluster. +2. Checks each namespace's duration against the limit specified in the `with.threshold_date` configuration. + - If a namespace's duration exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| threshold_date | string | False | The threshold date for namespace duration (supports regex). | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md new file mode 100644 index 000000000..2e7c91285 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -0,0 +1,64 @@ +--- +sidebar_label: Verify Namespace Termination +title: Verify Namespace Termination +--- +# Verify Namespace Termination +**Type:** Rule +**ID:** `k8s-namespace-verify-namespace-termination` +**Uses:** `k8s/namespace/verify-namespace-termination@v2/rules` +**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml) +**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego) +**Labels:** K8s, Namespace + +Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/namespace/verify-namespace-termination@v2/rules +with: + namespaces: + - ".*" +``` + +## Mitigation +Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. + + + +## Description +This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. +It performs the following steps: + +1. Iterates over the namespaces marked for termination in the cluster. +2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration. + - If a namespace's termination time exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| namespaces | array | False | A list of namespaces to verify (supports regex). | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md new file mode 100644 index 000000000..ba5b79c8d --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -0,0 +1,55 @@ +--- +sidebar_label: Allowed Namespaces +title: Allowed Namespaces +--- +# Allowed Namespaces +**Type:** Rule +**ID:** `k8s-namespace-white-listed-namespaces` +**Uses:** `k8s/namespace/white-listed-namespaces@v2/rules` +**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml) +**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego) +**Labels:** K8s, Namespace + +Verify only namespaces specified in the Allowed List are allowed within the cluster. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces. + + + +## Description +This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster. +It performs the following steps: + +1. Iterates over the namespaces in the cluster. +2. Checks each namespace against the whitelist specified in the `with.namespaces` configuration. + - If a namespace is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| namespaces | array | False | A list of allowed namespaces. | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md new file mode 100644 index 000000000..f25805e33 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Allowed Pods in Namespace +title: Allowed Pods in Namespace +--- +# Allowed Pods in Namespace +**Type:** Rule +**ID:** `k8s-namespace-white-listed-pod` +**Uses:** `k8s/namespace/white-listed-pod@v2/rules` +**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego) +**Labels:** K8s, Namespace + +Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. + +:::note +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/namespace/white-listed-pod@v2/rules +with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* +``` + +## Mitigation +Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods. + + + +## Description +This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace. +It performs the following steps: + +1. Iterates over the pods in the namespace. +2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. + - If a pod is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=namespace
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| white_listed_pod | array | True | A list of allowed pods (supports regex). | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json new file mode 100644 index 000000000..d22e47cb4 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Pods", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md new file mode 100644 index 000000000..80168c2cf --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -0,0 +1,63 @@ +--- +sidebar_label: Verify Pod Runtime Duration +title: Verify Pod Runtime Duration +--- +# Verify Pod Runtime Duration +**Type:** Rule +**ID:** `k8s-pods-verify-pod-duration` +**Uses:** `k8s/pods/verify-pod-duration@v2/rules` +**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml) +**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego) +**Labels:** K8s, Pod + +Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. + +:::note +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/pods/verify-pod-duration@v2/rules +with: + max_days: 30 +``` + +## Mitigation +Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. + + + +## Description +This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit. +It performs the following steps: + +1. Iterates over the pods in the cluster. +2. Checks each pod's duration against the limit specified in the `with.max_days` configuration. + - If a pod's duration exceeds the limit, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | False | The maximum allowed duration for pods in days. | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md new file mode 100644 index 000000000..e92c72314 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -0,0 +1,49 @@ +--- +sidebar_label: Verify Pod Termination +title: Verify Pod Termination +--- +# Verify Pod Termination +**Type:** Rule +**ID:** `k8s-pods-verify-pod-termination` +**Uses:** `k8s/pods/verify-pod-termination@v2/rules` +**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml) +**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego) +**Labels:** K8s, Pod + +Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. + +:::note +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. + + + +## Description +This rule verifies that pods in Kubernetes are terminated properly within the specified time frame. +It performs the following steps: + +1. Iterates over the pods marked for termination in the cluster. +2. Checks each pod's termination status is present, if such a status is present, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod
- platform=k8s | + diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md new file mode 100644 index 000000000..42c13d9f5 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md @@ -0,0 +1,68 @@ +--- +sidebar_label: Allowed Pods +title: Allowed Pods +--- +# Allowed Pods +**Type:** Rule +**ID:** `k8s-pods-white-listed-pod` +**Uses:** `k8s/pods/white-listed-pod@v2/rules` +**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml) +**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego) +**Labels:** K8s, Pod + +Verify only pods explicitly listed in the Allowed List are allowed to run. + +:::note +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: k8s/pods/white-listed-pod@v2/rules +with: + white_listed_pod: + - my-pod-1.* + - my-pod-2.* + verify_namespaces: + - ".*" +``` + +## Mitigation +Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods. + + + +## Description +This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster. +It performs the following steps: + +1. Iterates over the pods in the cluster. +2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. + - If a pod is not in the whitelist, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - asset_type=pod
- platform=k8s | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| white_listed_pod | array | True | A list of allowed pods (supports regex). | +| verify_namespaces | array | True | A list of namespaces to verify (supports regex). | + diff --git a/docs/configuration/v2/initiatives/rules/multievidence/_category_.json b/docs/configuration/v2/initiatives/rules/multievidence/_category_.json new file mode 100644 index 000000000..9696ec52e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/multievidence/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Multievidence", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md new file mode 100644 index 000000000..aa7ab9a2a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify File Integrity +title: Verify File Integrity +--- +# Verify File Integrity +**Type:** Rule +**ID:** `file-integrity` +**Uses:** `multievidence/files_integrity@v2/rules` +**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) +**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) +**Labels:** SBOM + +Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. + +:::note +This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | cyclonedx-json | +| target_type | container | +| labels | - new_evidence | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | +| path_prefix | pkg:file/ | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/_category_.json new file mode 100644 index 000000000..1d0527158 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "SARIF", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md new file mode 100644 index 000000000..b3f366e6c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md @@ -0,0 +1,55 @@ +--- +sidebar_label: Verify Artifact Signature Using SARIF Report +title: Verify Artifact Signature Using SARIF Report +--- +# Verify Artifact Signature Using SARIF Report +**Type:** Rule +**ID:** `sarif-artifact-signed` +**Uses:** `sarif/artifact-signed@v2/rules` +**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego) +**Labels:** SARIF + +Verify the artifact referenced in the SARIF report is signed to confirm its integrity. + +:::note +This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. + + + +## Description +This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed. +It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists. +The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation. +Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration. + +### **Evidence Requirements** +- Evidence must be provided in a generic format conforming to SARIF 2.1.0. +- The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true). +- The signer's identity should match one of the specified common names or emails in the configuration. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | True | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md new file mode 100644 index 000000000..0152a2397 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md @@ -0,0 +1,43 @@ +--- +sidebar_label: Verify Required Evidence in SARIF +title: Verify Required Evidence in SARIF +--- +# Verify Required Evidence in SARIF +**Type:** Rule +**ID:** `required-sarif-evidence` +**Uses:** `sarif/evidence-exists@v2/rules` +**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego) +**Labels:** SARIF + +Verify all required evidence exists as defined by the SARIF policy. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. + + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json new file mode 100644 index 000000000..4a0cbea05 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Patcheck", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md new file mode 100644 index 000000000..a64e7d4ec --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md @@ -0,0 +1,32 @@ +--- +sidebar_label: SARIF Update Needed +title: SARIF Update Needed +--- +# SARIF Update Needed +**Type:** Rule +**ID:** `sarif-update-needed` +**Uses:** `sarif/patcheck/updates-needed@v2/rules` +**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml) +**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego) +**Labels:** SARIF + +Verify no security packages require updates. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md new file mode 100644 index 000000000..ff5091e83 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md @@ -0,0 +1,62 @@ +--- +sidebar_label: Verify IaC Misconfiguration Threshold in SARIF +title: Verify IaC Misconfiguration Threshold in SARIF +--- +# Verify IaC Misconfiguration Threshold in SARIF +**Type:** Rule +**ID:** `sarif-iac-findings` +**Uses:** `sarif/report-iac-errors@v2/rules` +**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml) +**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego) +**Labels:** SARIF + +Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: sarif/report-iac-errors@v2/rules +with: + violations_threshold: 2 +``` + +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + + +## Description +This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match +a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving +the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. +If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes +details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. + +### **Evidence Requirements** + +Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json new file mode 100644 index 000000000..54def2fba --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "Trivy", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md new file mode 100644 index 000000000..6c3d45eb6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -0,0 +1,64 @@ +--- +sidebar_label: Trivy Blocklist CVE Check +title: Trivy Blocklist CVE Check +--- +# Trivy Blocklist CVE Check +**Type:** Rule +**ID:** `trivy-blocklist-cve` +**Uses:** `sarif/trivy/blocklist-cve@v2/rules` +**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml) +**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verify a CVE Blocklist against a SARIF report + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by product. +::: + +## Mitigation +Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. + + + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities +matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows: + +The rule iterates over the vulnerability results in the SARIF report (located under +`input.evidence.predicate.content.runs[0].results`), and for each result, retrieves the corresponding rule definition from +`input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. It then checks if the result's +ruleId contains any of the CVE identifiers provided in the `with.rule_ids` configuration parameter. If the total number of such +findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including +the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". +- Evidence filtering based on the product must be applied as defined in the configuration. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_ids | array | False | List of CVE identifiers to check for in the Trivy SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md new file mode 100644 index 000000000..b308b98c0 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Verify IaC Misconfiguration Threshold in Trivy SARIF +title: Verify IaC Misconfiguration Threshold in Trivy SARIF +--- +# Verify IaC Misconfiguration Threshold in Trivy SARIF +**Type:** Rule +**ID:** `trivy-iac-findings` +**Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` +**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) +**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by product. +::: + +## Usage example + +```yaml +uses: sarif/trivy/report-trivy-iac-errors@v2/rules +with: + violations_threshold: 2 +``` + +## Mitigation +Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. + + + +## Description +This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match +a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving +the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. +If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes +details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. + +### **Evidence Requirements** + +Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md new file mode 100644 index 000000000..023c90fa1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -0,0 +1,77 @@ +--- +sidebar_label: Trivy Vulnerability Findings Check +title: Trivy Vulnerability Findings Check +--- +# Trivy Vulnerability Findings Check +**Type:** Rule +**ID:** `trivy-verify-vulnerability-findings` +**Uses:** `sarif/trivy/verify-cve-severity@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml) +**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed +the defined severity threshold. + + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by product. +::: + +## Usage example + +```yaml +uses: sarif/trivy/verify-cve-severity@v2/rules +with: + severity_threshold: 2 +``` + +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it +complies with a set of predefined rules. The evaluation is based on several configurable parameters: + +The rule iterates over the vulnerability results in the SARIF report (provided under +`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding +rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's +ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified +threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| severity_threshold | integer | True | The maximum severity level allowed for vulnerabilities. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md new file mode 100644 index 000000000..72a3eac65 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -0,0 +1,50 @@ +--- +sidebar_label: Verify Attack Vector Threshold in Trivy SARIF +title: Verify Attack Vector Threshold in Trivy SARIF +--- +# Verify Attack Vector Threshold in Trivy SARIF +**Type:** Rule +**ID:** `trivy-attack-vectors` +**Uses:** `sarif/trivy/verify-trivy-attack-vector@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) +**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego) +**Labels:** SARIF, Trivy + +Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by product. +::: + +## Usage example + +```yaml +uses: sarif/trivy/verify-trivy-attack-vector@v2/rules +with: + attack_vectors: + - "stack buffer overflow" + violations_threshold: 2 +``` + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| attack_vectors | array | False | List of attack vectors to check for in the Trivy SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed attack vector violations in the Trivy SARIF report. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md new file mode 100644 index 000000000..43f6ee033 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -0,0 +1,66 @@ +--- +sidebar_label: Verify Trivy SARIF Report Compliance +title: Verify Trivy SARIF Report Compliance +--- +# Verify Trivy SARIF Report Compliance +**Type:** Rule +**ID:** `trivy-report` +**Uses:** `sarif/trivy/verify-trivy-report@v2/rules` +**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml) +**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego) +**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example +**Labels:** SARIF, Trivy + +Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by product. +::: + +## Mitigation +Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. + + + +## Description +This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it +complies with a set of predefined rules. The evaluation is based on several configurable parameters: + +The rule iterates over the vulnerability results in the SARIF report (provided under +`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding +rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's +ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified +threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by the "Trivy Vulnerability Scanner". +- The evidence must include proper filtering based on the product as defined in the configuration. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +| tool | Trivy Vulnerability Scanner | +| filter-by | ['product'] | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the Trivy SARIF report. | +| precision | array | False | List of precision levels to check for in the Trivy SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the Trivy SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the Trivy SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md new file mode 100644 index 000000000..8589ad963 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md @@ -0,0 +1,73 @@ +--- +sidebar_label: Verify Attack Vector Exists in SARIF +title: Verify Attack Vector Exists in SARIF +--- +# Verify Attack Vector Exists in SARIF +**Type:** Rule +**ID:** `sarif-attack-vectors` +**Uses:** `sarif/verify-attack-vector@v2/rules` +**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml) +**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego) +**Labels:** SARIF + +Verify required evidence validates attack vectors in the SARIF report. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: sarif/verify-attack-vector@v2/rules +with: + attack_vectors: + - "stack buffer overflow" + violations_threshold: 2 +``` + +## Mitigation +Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. + + + +## Description +This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities +associated with specific attack vectors are properly identified. The rule works as follows: + +1. It iterates over the vulnerability results in the SARIF report (from `input.evidence.predicate.content.runs[0].results`). +2. For each result, it retrieves the corresponding rule definition from + `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. +3. The rule checks if the rule’s full description contains the phrase "The attack vector is" and whether it + includes any of the attack vectors specified in the configuration (`with.attack_vectors`). +4. If such a vulnerability is found and the total number of matching findings exceeds the configured threshold + (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the + associated description. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. +- The SARIF report should be generated by a tool like the Vulnerability Scanner. +- The report must include detailed rule definitions and descriptions that mention attack vectors. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| attack_vectors | array | False | List of attack vectors to check for in the SARIF report. | +| violations_threshold | integer | False | The maximum number of allowed attack vector violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md new file mode 100644 index 000000000..fce291346 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Verify Rule Compliance in SARIF +title: Verify Rule Compliance in SARIF +--- +# Verify Rule Compliance in SARIF +**Type:** Rule +**ID:** `sarif-policy` +**Uses:** `sarif/verify-sarif@v2/rules` +**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml) +**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) +**Labels:** SARIF + +Verify the SARIF report complies with defined generic rules for compliance and security. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. + + + +## Description +This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules. +It does so by using helper functions from the `data.sarif` module to: + +1. Check that the vulnerability results in the report (found under `input.evidence.predicate.content.runs[0].results`) + conform to the expected type and severity level as defined by configuration parameters (such as `rule_level`, `precision`, + `rule_ids`, and `ignore`). +2. Ensure that the total number of reported violations does not exceed the maximum allowed (`with.max_allowed`). + +If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier, +severity, and the corresponding location in the artifact. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema. +- The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions. +- The evaluation uses the configuration parameters provided in the `with` section to guide the verification process. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the SARIF report. | +| precision | array | False | List of precision levels to check for in the SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md new file mode 100644 index 000000000..8bf560212 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md @@ -0,0 +1,63 @@ +--- +sidebar_label: Verify Semgrep Rule in SARIF +title: Verify Semgrep Rule in SARIF +--- +# Verify Semgrep Rule in SARIF +**Type:** Rule +**ID:** `sarif-semgrep-report` +**Uses:** `sarif/verify-semgrep-report@v2/rules` +**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) +**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) +**Labels:** SARIF, Semgrep + +Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. + + + +## Description +This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules. +It iterates over the vulnerability results in the SARIF report (located under +`input.evidence.predicate.content.runs[0].results`) and retrieves the corresponding rule definitions +from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on each result's ruleIndex. + +The rule checks whether the result’s ruleId contains any of the identifiers specified in the configuration (`with.rule_ids`). +If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded. +Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding. + +### **Evidence Requirements** + +- Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema. +- The SARIF report should be generated by Semgrep. +- The report must include detailed rule definitions and descriptions that support matching against the specified blocklist. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| rule_level | array | False | List of rule levels to check for in the SARIF report. | +| precision | array | False | List of precision levels to check for in the SARIF report. | +| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | +| ignore | array | False | List of rule IDs to ignore in the SARIF report. | +| max_allowed | integer | False | The maximum number of allowed violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md new file mode 100644 index 000000000..feef1846e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md @@ -0,0 +1,54 @@ +--- +sidebar_label: Verify Tool Evidence in SARIF +title: Verify Tool Evidence in SARIF +--- +# Verify Tool Evidence in SARIF +**Type:** Rule +**ID:** `sarif-tool-evidence` +**Uses:** `sarif/verify-tool-evidence@v2/rules` +**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml) +**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego) +**Labels:** SARIF + +Verify required tools were used to generate the SARIF report. + +:::note +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. + + + +## Description +This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner +(e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: +the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool. +A mismatch indicates that the report may not be reliable. + +### **Evidence Requirements** +- Evidence must adhere to the SARIF 2.1.0 schema. +- The report must include a valid `tool` field. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md new file mode 100644 index 000000000..eaf1aafb9 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md @@ -0,0 +1,89 @@ +--- +sidebar_label: NTIA SBOM Compliance Check +title: NTIA SBOM Compliance Check +--- +# NTIA SBOM Compliance Check +**Type:** Rule +**ID:** `NTIA-compliance` +**Uses:** `sbom/NTIA-compliance@v2/rules` +**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) +**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) +**Labels:** SBOM, Compliance, Image, Git + +Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. + + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::note +Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. + +For example, +```yaml +valint bom my_company/my_image:latest \ + --author-name "bob" \ + --author-email bob@my_company.com \ + --author-phone "123-456-7890" \ + --supplier-email bob@my_company.com \ + --supplier-name "alice" \ + --supplier-url "https://my_company.com" \ + --supplier-phone "123-456-7890" +``` + +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/NTIA-compliance@v2/rules +with: + required_author: + name: "bom" + email: "bob@company.com" + required_supplier: + name: "alice" + +``` + +## Mitigation +Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers. + + + +## Description +This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers. +It performs the following steps: + +1. Checks that authors exist, are non-empty, and each author has both a name and email. +2. Checks that the supplier exists with a non-empty name, URL, and contact. At least one contact must have a non-empty email. +3. Optionally enforces a required author (case-insensitive match for name/email). +4. Optionally enforces a required supplier (case-insensitive match for supplier name). + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include metadata for authors and suppliers. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| required_author | object | False | The required author (case-insensitive match for name/email). | +| required_supplier | object | False | The required supplier (case-insensitive match for supplier name). | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/_category_.json b/docs/configuration/v2/initiatives/rules/sbom/_category_.json new file mode 100644 index 000000000..cdfd70c71 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "SBOM", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md new file mode 100644 index 000000000..7ba337691 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md @@ -0,0 +1,72 @@ +--- +sidebar_label: Enforce Allowed SBOM Components +title: Enforce Allowed SBOM Components +--- +# Enforce Allowed SBOM Components +**Type:** Rule +**ID:** `sbom-allowed-components` +**Uses:** `sbom/allowed-components@v2/rules` +**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) +**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) +**Labels:** SBOM, Image, Git + +Verify the artifact contains only allowed components. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::note +Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/allowed-components@v2/rules +with: + types: + - library + - operating-system +``` + +## Mitigation +Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components. +It performs the following steps: + +1. Iterates over the components listed in the SBOM. +2. Checks each component's type against the allowed types specified in the `with.types` configuration. +3. Compares each component's name against the allowlist provided in the `with.allowlist` configuration. + - If a component's type or name is not allowed, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of components with their types and names. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| types | array | True | A list of allowed component types. | +| allowlist | array | True | A list of allowed components. | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md new file mode 100644 index 000000000..7f3625136 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md @@ -0,0 +1,45 @@ +--- +sidebar_label: Require SBOM Signature +title: Require SBOM Signature +--- +# Require SBOM Signature +**Type:** Rule +**ID:** `sbom-signed` +**Uses:** `sbom/artifact-signed@v2/rules` +**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) +**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) +**Labels:** SBOM, Blueprint, Git + +Verify the SBOM is signed. + +:::note +This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | True | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md new file mode 100644 index 000000000..70f54874e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md @@ -0,0 +1,70 @@ +--- +sidebar_label: Restrict Disallowed SBOM Licenses +title: Restrict Disallowed SBOM Licenses +--- +# Restrict Disallowed SBOM Licenses +**Type:** Rule +**ID:** `sbom-disallowed-licenses` +**Uses:** `sbom/banned-licenses@v2/rules` +**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) +**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) +**Labels:** SBOM, Image, Git + +Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/banned-licenses@v2/rules +with: + blocklist: + - "GPL-2.0" + - "GPL-3.0" + blocklisted_limit: 1 +``` + +## Mitigation +Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses +remains below the specified threshold. It performs the following steps: + +1. Iterates over the components listed in the SBOM. +2. Checks each component's license against the blocklist provided in the `with.blocklist` configuration. +3. Counts the number of components with disallowed licenses. + - If the count exceeds the specified `with.blocklisted_limit`, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of components with their licenses. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| blocklist | array | False | A list of disallowed licenses. | +| blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md new file mode 100644 index 000000000..6b82d82a6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md @@ -0,0 +1,41 @@ +--- +sidebar_label: Restrict Disallowed Dependencies +title: Restrict Disallowed Dependencies +--- +# Restrict Disallowed Dependencies +**Type:** Rule +**ID:** `sbom-disallow-dependencies` +**Uses:** `sbom/blocklist-packages@v2/rules` +**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) +**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) +**Labels:** SBOM, Image, Blueprint, Git + +Verify the number of disallowed dependencies remains below the specified threshold. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | +| blocklisted_limit | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md new file mode 100644 index 000000000..4dd076f7e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md @@ -0,0 +1,52 @@ +--- +sidebar_label: Enforce SBOM License Completeness +title: Enforce SBOM License Completeness +--- +# Enforce SBOM License Completeness +**Type:** Rule +**ID:** `sbom-require-complete-license-set` +**Uses:** `sbom/complete-licenses@v2/rules` +**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) +**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) +**Labels:** SBOM, Image, Git + +Verify all dependencies in the artifact have a license. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency for the presence of a license. + - If a dependency does not have a license, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies with their licenses. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md new file mode 100644 index 000000000..6473f58a2 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md @@ -0,0 +1,65 @@ +--- +sidebar_label: Enforce SBOM Freshness +title: Enforce SBOM Freshness +--- +# Enforce SBOM Freshness +**Type:** Rule +**ID:** `fresh-sbom` +**Uses:** `sbom/fresh-sbom@v2/rules` +**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) +**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) +**Labels:** SBOM, Image, Git + +Verify the SBOM is not older than the specified duration. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/fresh-sbom@v2/rules +with: + max_days: 30 +``` + +## Mitigation +Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components. + + + +## Description +This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration. +It performs the following steps: + +1. Checks the creation date of the SBOM. +2. Compares the creation date against the maximum allowed age specified in the `with.max_days` configuration. + - If the SBOM is older than the allowed duration, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a creation date. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | integer | False | The maximum allowed age of the SBOM in days. | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md new file mode 100644 index 000000000..6a4c1c43c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md @@ -0,0 +1,56 @@ +--- +sidebar_label: Require SBOM Existence +title: Require SBOM Existence +--- +# Require SBOM Existence +**Type:** Rule +**ID:** `require-sbom` +**Uses:** `sbom/require-sbom@v2/rules` +**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) +**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) +**Labels:** SBOM, Blueprint, Image, Git + +Verify the SBOM exists as evidence. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies. + + + +## Description +This rule verifies the existence of an SBOM as evidence. +It performs the following steps: + +1. Checks for the presence of an SBOM. + - If the SBOM is missing, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | False | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md new file mode 100644 index 000000000..846c40697 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md @@ -0,0 +1,69 @@ +--- +sidebar_label: Enforce SBOM Dependencies +title: Enforce SBOM Dependencies +--- +# Enforce SBOM Dependencies +**Type:** Rule +**ID:** `sbom-required-dependencies` +**Uses:** `sbom/required-packages@v2/rules` +**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml) +**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) +**Labels:** SBOM, Image + +Verify the artifact includes all required dependencies specified as a list of PURLs. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/required-packages@v2/rules +with: + required_pkgs: + - "pkg:maven/org.apache.commons/commons-lang3@3.9" + - "pkg:npm/lodash@4.17.15" + violations_limit: 0 +``` + +## Mitigation +Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements. + + + +## Description +This rule verifies that the artifact includes all required dependencies as specified. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency against the required dependencies specified in the `with.required_pkgs` configuration. + - If a required dependency is missing, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| required_pkgs | array | True | A list of required dependencies specified as PURLs. | +| violations_limit | integer | False | The maximum number of allowed violations. | + diff --git a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md new file mode 100644 index 000000000..099a6bfa4 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md @@ -0,0 +1,71 @@ +--- +sidebar_label: Require Specified SBOM Licenses +title: Require Specified SBOM Licenses +--- +# Require Specified SBOM Licenses +**Type:** Rule +**ID:** `sbom-hf-license` +**Uses:** `sbom/verify-huggingface-license@v2/rules` +**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) +**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) +**Labels:** SBOM, Image, Git + +Verify the artifact includes all specified licenses. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +::: +:::note +Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/verify-huggingface-license@v2/rules +with: + licenses: + - "MIT" + - "Apache-2.0" +``` + +## Mitigation +Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses. + + + +## Description +This rule verifies that the artifact includes all specified licenses. +It performs the following steps: + +1. Iterates over the dependencies listed in the SBOM. +2. Checks each dependency for the presence of the specified licenses in the `with.licenses` configuration. + - If a specified license is missing, the rule flags it as a violation. +3. Accesses the Hugging Face API to validate the licenses. + +**Evidence Requirements:** +- Evidence must be provided in the CycloneDX JSON format. +- The SBOM must include a list of dependencies with their licenses. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | cyclonedx-json | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| licenses | array | True | A list of specified licenses. | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/_category_.json b/docs/configuration/v2/initiatives/rules/slsa/_category_.json new file mode 100644 index 000000000..da652e8f6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "SLSA", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md new file mode 100644 index 000000000..a3faf9a4b --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md @@ -0,0 +1,36 @@ +--- +sidebar_label: Disallow dependencies in SLSA Provenance Document +title: Disallow dependencies in SLSA Provenance Document +--- +# Disallow dependencies in SLSA Provenance Document +**Type:** Rule +**ID:** `slsa-builder-unallowed-dependencies` +**Uses:** `slsa/banned-builder-deps@v2/rules` +**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml) +**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego) +**Labels:** SLSA, Image + +Verify that dependencies in the block list do not appear in the SLSA Proveance document. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| blocklist | [] | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/build-time.md b/docs/configuration/v2/initiatives/rules/slsa/build-time.md new file mode 100644 index 000000000..a2571e4fb --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/build-time.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Verify build time +title: Verify build time +--- +# Verify build time +**Type:** Rule +**ID:** `slsa-build-time` +**Uses:** `slsa/build-time@v2/rules` +**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml) +**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego) +**Labels:** SLSA, Image + +Verify the artifact was created within the specified time window. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| start_hour | 8 | +| end_hour | 20 | +| workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md new file mode 100644 index 000000000..54174b058 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md @@ -0,0 +1,37 @@ +--- +sidebar_label: SLSA Field Exists in Provenance Document +title: SLSA Field Exists in Provenance Document +--- +# SLSA Field Exists in Provenance Document +**Type:** Rule +**ID:** `slsa-field-exists` +**Uses:** `slsa/field-exists@v2/rules` +**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml) +**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego) +**Labels:** SLSA, Image + +Verify the specified field exists in the provenance document. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| paths | [] | +| violations_threshold | 0 | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md new file mode 100644 index 000000000..e7ac74d2e --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md @@ -0,0 +1,45 @@ +--- +sidebar_label: Verify Provenance Document Exists +title: Verify Provenance Document Exists +--- +# Verify Provenance Document Exists +**Type:** Rule +**ID:** `SLSA.L1` +**Uses:** `slsa/l1-provenance-exists@v2/rules` +**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml) +**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego) +**Help:** https://slsa.dev/spec/v1.0/requirements +**Labels:** SLSA + +Verify that the Provenance document evidence exists. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | False | +| content_body_type | slsa | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md new file mode 100644 index 000000000..c5ae4854a --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -0,0 +1,51 @@ +--- +sidebar_label: Verify that provenance is authenticated +title: Verify that provenance is authenticated +--- +# Verify that provenance is authenticated +**Type:** Rule +**ID:** `SLSA.L2` +**Uses:** `slsa/l2-provenance-authenticated@v2/rules` +**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml) +**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego) +**Help:** https://slsa.dev/spec/v1.0/requirements +**Labels:** SLSA + +Verify the artifact is signed. + +:::note +This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS** required by default. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Mitigation +Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. + + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| signed | True | +| content_body_type | slsa | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md new file mode 100644 index 000000000..eb893329c --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md @@ -0,0 +1,37 @@ +--- +sidebar_label: Verify that artifact was created by the specified builder +title: Verify that artifact was created by the specified builder +--- +# Verify that artifact was created by the specified builder +**Type:** Rule +**ID:** `slsa-verify-builder` +**Uses:** `slsa/verify-builder@v2/rules` +**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml) +**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego) +**Labels:** SLSA, Image + +Verify the artifact was created by the specified builder. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::info +Rule is scoped by pipeline and product. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['pipeline', 'product'] | +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| id | `{{ .Env.HOSTNAME }}` | + diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md new file mode 100644 index 000000000..6f473f3ab --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md @@ -0,0 +1,36 @@ +--- +sidebar_label: Verify that artifact has no disallowed builder dependencies +title: Verify that artifact has no disallowed builder dependencies +--- +# Verify that artifact has no disallowed builder dependencies +**Type:** Rule +**ID:** `slsa-verify-byproducts` +**Uses:** `slsa/verify-byproducts@v2/rules` +**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml) +**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego) +**Labels:** SLSA, Image + +Verify the artifact has no disallowed builder dependencies. + +:::note +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| byproducts | [] | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/_category_.json b/docs/configuration/v2/initiatives/rules/ssdf/_category_.json new file mode 100644 index 000000000..dc1b66dcb --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/_category_.json @@ -0,0 +1,4 @@ +{ + "label": "SSDF", + "position": 1 +} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md new file mode 100644 index 000000000..fe5305fbf --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md @@ -0,0 +1,48 @@ +--- +sidebar_label: Enforce 2FA +title: Enforce 2FA +--- +# Enforce 2FA +**Type:** Rule +**ID:** `PS.1.1` +**Uses:** `ssdf/ps-1-2fa@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) +**Labels:** SSDF + +PS.1 Require 2FA for accessing code + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. + + + +## Description +This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. +It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the +`organization_details.two_factor_requirement_enabled` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match +the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional +layer of security against unauthorized access. + +### **Evidence Requirements** +- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. +- The data should come from a trusted source (e.g., a GitHub organization scan). +- The evidence must clearly indicate whether 2FA is enabled. + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | False | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md new file mode 100644 index 000000000..654867b98 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Branch protected +title: Branch protected +--- +# Branch protected +**Type:** Rule +**ID:** `PS.1.2` +**Uses:** `ssdf/ps-1-branch-protection@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) +**Labels:** SSDF + +PS.1 Require branch protection for the repository + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. + + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_protected | True | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md new file mode 100644 index 000000000..e4c8fcac6 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Limit admins +title: Limit admins +--- +# Limit admins +**Type:** Rule +**ID:** `PS.1.3` +**Uses:** `ssdf/ps-1-limit-admins@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) +**Labels:** SSDF + +PS.1 Restrict the maximum number of organization admins + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. + + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| max_admins | 3 | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md new file mode 100644 index 000000000..45592d4a8 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Repo private +title: Repo private +--- +# Repo private +**Type:** Rule +**ID:** `PS.1.4` +**Uses:** `ssdf/ps-1-repo-private@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) +**Labels:** SSDF + +PS.1 Assure the repository is private + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. + + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md new file mode 100644 index 000000000..4a1cdc2d1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Require signoff on web commits +title: Require signoff on web commits +--- +# Require signoff on web commits +**Type:** Rule +**ID:** `PS.1.5` +**Uses:** `ssdf/ps-1-web-commit-signoff@v2/rules` +**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) +**Labels:** SSDF + +PS.1 Require contributors to sign when committing to Github through the web interface + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. + + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md new file mode 100644 index 000000000..fea0b86b9 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -0,0 +1,33 @@ +--- +sidebar_label: Image-verifiable +title: Image-verifiable +--- +# Image-verifiable +**Type:** Rule +**ID:** `PS.2` +**Uses:** `ssdf/ps-2-image-verifiable@v2/rules` +**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) +**Labels:** SSDF + +PS.2 Provide a mechanism to verify the integrity of the image + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. + + + +## Evidence Requirements +| Field | Value | +|-------|-------| +| target_type | container | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md new file mode 100644 index 000000000..45732acb1 --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -0,0 +1,38 @@ +--- +sidebar_label: Code archived +title: Code archived +--- +# Code archived +**Type:** Rule +**ID:** `PS.3.1` +**Uses:** `ssdf/ps-3.1-code-archived@v2/rules` +**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) +**Labels:** SSDF + +PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Archives code changes to maintain a secure, immutable history for auditing and traceability. + + + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| allow | True | +| short_description | Code is archived. | +| description | Since the code is within a repository, it is archived. | +| reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. | + diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md new file mode 100644 index 000000000..ea77fc9bc --- /dev/null +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -0,0 +1,28 @@ +--- +sidebar_label: SBOM archived +title: SBOM archived +--- +# SBOM archived +**Type:** Rule +**ID:** `PS.3.2` +**Uses:** `ssdf/ps-3.2-archived-sbom@v2/rules` +**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) +**Labels:** SSDF + +PS.3.2 Archive SBOM + +:::note +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Mitigation +Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. + + + diff --git a/docs/configuration/v2/initiatives/slsa.l1.md b/docs/configuration/v2/initiatives/slsa.l1.md new file mode 100644 index 000000000..05c938eff --- /dev/null +++ b/docs/configuration/v2/initiatives/slsa.l1.md @@ -0,0 +1,48 @@ +--- +sidebar_label: SLSA L1 Framework +title: SLSA L1 Framework +--- +# SLSA L1 Framework +**Type:** Initiative +**ID:** `SLSA.L1` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml) +**Help:** https://slsa.dev/ + +Evaluate SLSA Level 1 + +## **Description** + +This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. + + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [prov_exists](#prov_exists-provenance-exists) | Provenance exists | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [prov_exists] Provenance exists + +This control verifies that essential provenance metadata is present for each build artifact. + + +### Mitigation +Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/v2/initiatives/slsa.l2.md b/docs/configuration/v2/initiatives/slsa.l2.md new file mode 100644 index 000000000..a4debb87e --- /dev/null +++ b/docs/configuration/v2/initiatives/slsa.l2.md @@ -0,0 +1,49 @@ +--- +sidebar_label: SLSA L2 Framework +title: SLSA L2 Framework +--- +# SLSA L2 Framework +**Type:** Initiative +**ID:** `SLSA.L2` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml) +**Help:** https://slsa.dev/ + +Evaluate SLSA Level 2 + +## **Description** + +Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." + + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [prov_authn](#prov_authn-provenance-authenticated) | Provenance authenticated | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [prov_authn] Provenance authenticated + +Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. + + +### Mitigation +Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [prov_authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/v2/initiatives/sp-800-190.md b/docs/configuration/v2/initiatives/sp-800-190.md new file mode 100644 index 000000000..c69918607 --- /dev/null +++ b/docs/configuration/v2/initiatives/sp-800-190.md @@ -0,0 +1,89 @@ +--- +sidebar_label: NIST Application Container Security Initiative +title: NIST Application Container Security Initiative +--- +# NIST Application Container Security Initiative +**Type:** Initiative +**ID:** `SP-800-190` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-190.yaml) +**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final + +This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. + + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [4.1](#41-41-image-countermeasures) | 4.1 IMAGE COUNTERMEASURES | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. + | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. + | +| [4.2](#42-42-registry-countermeasures) | 4.2 REGISTRY COUNTERMEASURES | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. + | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. + | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [4.1] 4.1 IMAGE COUNTERMEASURES + +Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. + + + +### Mitigation +Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. + | +| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. + | +| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. + | +| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. + | +| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. + | +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. + | +| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. + | +| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. + | +| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. + | + +## [4.2] 4.2 REGISTRY COUNTERMEASURES + +Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. + + + +### Mitigation +Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. + | +| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. + | +| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. + | diff --git a/docs/configuration/v2/initiatives/sp-800-53.md b/docs/configuration/v2/initiatives/sp-800-53.md new file mode 100644 index 000000000..f0dddaf2b --- /dev/null +++ b/docs/configuration/v2/initiatives/sp-800-53.md @@ -0,0 +1,89 @@ +--- +sidebar_label: NIST Supply Chain Integrity Initiative +title: NIST Supply Chain Integrity Initiative +--- +# NIST Supply Chain Integrity Initiative +**Type:** Initiative +**ID:** `SP-800-53` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-53.yaml) +**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final + +This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: + - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, + addressing requirements from SR-4 and CM-8. + - Provenance data to support architectural traceability, as outlined in SA-8. +Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. + + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [SR4_CM8](#sr4_cm8-sbom-requirement-sr-4-cm-8) | SBOM Requirement (SR-4 / CM-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. + | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | +| [SA8](#sa8-provenance-requirement-sa-8) | Provenance Requirement (SA-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. + | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | +| [SA12](#sa12-sbom-signature-enforcement-sa-12) | SBOM Signature Enforcement (SA-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. + | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## [SR4_CM8] SBOM Requirement (SR-4 / CM-8) + +Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. + + + +### Mitigation +Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: + | +| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. + | + +## [SA8] Provenance Requirement (SA-8) + +Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. + + + +### Mitigation +Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | + +## [SA12] SBOM Signature Enforcement (SA-12) + +Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. + + + +### Mitigation +Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/v2/initiatives/ssdf.md b/docs/configuration/v2/initiatives/ssdf.md new file mode 100644 index 000000000..9c0a66d9e --- /dev/null +++ b/docs/configuration/v2/initiatives/ssdf.md @@ -0,0 +1,91 @@ +--- +sidebar_label: SSDF Client Initiative +title: SSDF Client Initiative +--- +# SSDF Client Initiative +**Type:** Initiative +**ID:** `SSDF` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/ssdf.yaml) +**Help:** https://csrc.nist.gov/pubs/sp/800/218/final + +Evaluate PS rules from the SSDF initiative + +## **Description** + +This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. + + +## Controls Overview + +| Control ID | Control Name | Control Description | Mitigation | +|------------|--------------|---------------------|------------| +| [SSDF-IMAGE](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. + | +| [SSDF-ORG](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. + | +| [SSDF-REPO](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. + | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | False | + +--- + +# Detailed Controls + +## SSDF-IMAGE + +Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. + + +### Mitigation +Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [PS.3.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | + +## SSDF-ORG + +Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. + + +### Mitigation +Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.1.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | +| [PS.1.3](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [PS.1.5](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | + +## SSDF-REPO + +Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. + + +### Mitigation +Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. +We assume running in Github thus the code is allways stored in a repository + | +| [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | +| [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From b395fe47982b5b8fa16adc4f7e1452d71dac19a7 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:04:35 +0200 Subject: [PATCH 140/191] update index location --- docs/guides/enforcing-sdlc-initiative.md | 346 ++++++++++++++++++++--- scripts/sync_docs.sh | 31 +- 2 files changed, 334 insertions(+), 43 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 44aebcf7f..540c3f013 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -287,42 +287,322 @@ INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: In this case, no rule was disabled, and all of them were verified. -## Sample Rule Catalog +## Sample Policy Catalog -We provide a set of sample rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. +We provide a set of sample initiatives and rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. To use a different version of this catalog, use the `--bundle-tag` valint flag. -To use a custom rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo. - -| Rule | Description | Additional Info | -| --- | --- | --- | -| [Require SBOM Signature](#require-sbom-signature) | Verify the SBOM is signed. | [SBOM](#sbom) | -| [Restrict Disallowed Dependencies](#restrict-disallowed-dependencies) | Verify the number of disallowed dependencies remains below the specified threshold. | [SBOM](#sbom) | -| [Enforce SBOM Dependencies](#enforce-sbom-dependencies) | Verify the artifact includes all required dependencies. | [SBOM](#sbom) | -| [Restrict Disallowed SBOM Licenses](#restrict-disallowed-sbom-licenses) | Verify specific users are not allowed in an SBOM. | [SBOM](#sbom) | -| [Enforce SBOM License Completeness](#enforce-sbom-license-completeness) | Verify all dependencies in the artifact have a license. | [SBOM](#sbom) | -| [Enforce SBOM Freshness](#enforce-sbom-freshness) | Verify the SBOM is not older than the specified duration. | [SBOM](#sbom) | -| [Fresh Image](#fresh-image) |Verify the image is not older than the specified threshold. | [Image SBOM](#images) | -| [Disallow Container Shell Entrypoint](#disallow-container-shell-entrypoint) | Verify the container image disallows shell entrypoint. | [Image SBOM](#images) | -| [Restrict Build Scripts](#restrict-build-scripts) | Verify no build scripts commands appear in block list. | [Image SBOM](#images) | -| [Verify Image Labels](#verify-image-labels) | Verify specified labels key-value pairs exist in the image. | [Image SBOM](#images) | -| [Forbid Large Images](#forbid-large-images) | Verify the image size is below the specified threshold. | [Image SBOM](#images) | -| [Restrict Coding Permissions](#restrict-coding-permissions) | Verify only allowed users committed to the repository. | [Git SBOM](#git) | -| [Disallow Unsigned Commits](#disallow-unsigned-commits) | Verify all commits are signed. | [Git SBOM](#git) | -| [Disallow Commits to Main Branch](#disallow-commits-to-main-branch) | Verify commits made directly to the main branch are disallowed. | [Git SBOM](#git) | -| [Verify that artifact was created by the specified builder](#verify-that-artifact-was-created-by-the-specified-builder) | Verify the artifact was created by the specified builder. | [SLSA-Prov](#slsa) | -| [Disallow dependencies in SLSA Provenance Document](#disallow-dependencies-in-slsa-provenance-document) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | [SLSA-Prov](#slsa) | -| [Verify Build Time](#verify-build-time) | Verify the artifact was created within the specified time window. | [SLSA-Prov](#slsa) | -| [Verify that artifact has no disallowed builder dependencies](#verify-that-artifact-has-no-disallowed-builder-dependencies) | Verify the artifact has no disallowed builder dependencies. | [SLSA-Prov](#slsa) | -| [SLSA Field Exists in Provenance Document](#slsa-field-exists-in-provenance-document) | Verify the specified field exists in the provenance document. | [SLSA-Prov](#slsa) | -| [Verify Rule Compliance in SARIF](#verify-rule-compliance-in-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | [SARIF](#sarif-reports) | -| [Do Not Allow Vulnerabilities Based On Specific Attack Vector](#do-not-allow-vulnerabilities-based-on-specific-attack-vector) | Restrict vulnerabilities based on specific attack vector. | [SARIF](#sarif-reports) | -| [Verify IaC Misconfiguration Threshold in SARIF](#verify-iac-misconfiguration-threshold-in-sarif) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | [SARIF](#sarif-reports) | -| [Verify Semgrep Rule in SARIF](#verify-semgrep-rule-in-sarif) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | [SARIF](#sarif-reports) | -| [Verify Tool Evidence in SARIF](#verify-tool-evidence-in-sarif) | Verify required tools were used to generate the SARIF report. | [SARIF](#sarif-reports) | -| [K8s Jailbreak](#k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold. | [Generic](#generic) | -| [Verify Github Branch Protection](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/api/branch-protection.md) | Verify that the branch protection rules are compliant to required | None | -| [Verify GitLab Push Rules](https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/gitlab/api/push-rules.md) | Verify that the push rules are compliant to required. GitLabs push rules overlap some of GitHub's branch protection rules | None | +To use a custom initiatives rule catalog, you can specify the path to the catalog in the `--bundle` flag (it may be a local path or a git repo). Additionally, `--bundle-branch` and `--bundle-tag` flags can be used to specify the branch or tag of the catalog git repo. + + +| Name | Description | +|------|-------------| +| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | +| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | + +## Rules + +### SBOM +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | +| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | +| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | + +### Image SBOM +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +### Git SBOM +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | +| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | +| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | + +### SARIF Evidence +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | +| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | +| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | + +### Generic Statement +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | +| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | +| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | + +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Github Organization Discovery Evidence +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | +| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | + +### Github Repository Discovery Evidence +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | + +### Gitlab Organization Discovery Evidence +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | +| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | + +### Gitlab Project Discovery Evidence +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | +| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | +| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + +### K8s Namespace Discovery Evidence +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | +| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | + +### K8s Pod Discovery Evidence +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | + +### SLSA Provenance +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) + +| Rule Name | Description | +|-----------|-------------| +| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | +| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | + +### Statement +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) + +| Rule Name | Description | +|-----------|-------------| +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | +| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | + ### General Information diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index f95205bf5..367cc7507 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -255,22 +255,33 @@ export_orbs() { export_file_rename ${repo} "" "${dst_dir}/circleci.md" } - import_sample-policies() { repo="sample-policies" repo_dir="${submodules_dir}/${repo}" dst_dir="docs/guides" - cp -r "${repo_dir}/docs/v2/" "docs/configuration/" -# echo '--- -# sidebar_label: "Applying Policies to your SDLC" -# title: Applying Policies to your SDLC -# sidebar_position: 3 -# toc_min_heading_level: 2 -# toc_max_heading_level: 5 -# ---' > "${dst_dir}/enforcing-sdlc-policy.md" + # Copy sample policy docs + cp -r "${repo_dir}/docs/v2/" "docs/configuration/" -# tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md" + # Create a temporary file to hold the table content from index.md + tmpfile=$(mktemp) + + # Extract everything between and from index.md + # (excluding the markers themselves) into tmpfile + sed -n '//,// { + //d + //d + p + }' docs/configuration/initiatives/index.md > "${tmpfile}" + + # Replace the block in enforcing-sdlc-initiative.md with the table content from tmpfile + sed -i '//,//{ + //!{ //!d; } + //r '"${tmpfile}"' + }' "${dst_dir}/enforcing-sdlc-initiative.md" + + # Clean up + rm "${tmpfile}" } export_sample-policies() { From 7ddf02efd50c86120d9bf6b47010658c9e2d3cbf Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:05:58 +0200 Subject: [PATCH 141/191] update index location --- docs/configuration/initiatives/index.md | 2 +- docs/configuration/initiatives/rules/index.md | 204 ------------------ 2 files changed, 1 insertion(+), 205 deletions(-) delete mode 100644 docs/configuration/initiatives/rules/index.md diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index decf202cc..2353028c7 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -141,7 +141,7 @@ ### Github Organization Discovery Evidence **Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) -| Rule Name | Description | +|
Rule Name
| Description | |-----------|-------------| | [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | | [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | diff --git a/docs/configuration/initiatives/rules/index.md b/docs/configuration/initiatives/rules/index.md deleted file mode 100644 index d2a1fbcd7..000000000 --- a/docs/configuration/initiatives/rules/index.md +++ /dev/null @@ -1,204 +0,0 @@ -# Rule Index - -| Rule Name | Description | Evidence Type | -|-----------|-------------|---------------| -| Restrict Disallowed SBOM Licenses | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Enforce SBOM Freshness | Verify the SBOM is not older than the specified duration. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require Specified SBOM Licenses | Verify the artifact includes all specified licenses. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Enforce SBOM Dependencies | Verify the artifact includes all required dependencies specified as a list of PURLs. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| NTIA SBOM Compliance Check | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require SBOM Existence | Verify the SBOM exists as evidence. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Enforce Allowed SBOM Components | Verify the artifact contains only allowed components. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Enforce SBOM License Completeness | Verify all dependencies in the artifact have a license. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require SBOM Signature | Verify the SBOM is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Apply Scribe Template Policy | Verify XX using the Scribe API template rule. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Scribe Published Policy | Verify image Scribe Publish flag is set for container image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require Image Labels | Verify the image has the specified labels. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Disallow Container Shell Entrypoint | Verify the container image disallows shell entrypoint. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Allowed Base Image | Verifies that every base image is from an approved source. The rule returns a summary -including the component names and versions of valid base images, or lists the invalid ones. -This rule requires Dockerfile context; for example, run it with: -`valint my_image --base-image Dockerfile`. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Fresh Base Image | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Allowed Main Image Source | Ensures the main container image referenced in the SBOM is from an approved source. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Registry Connection HTTPS | Checks if the container's registry scheme is HTTPS - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Fresh Image | Verify the image is not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require Signed Container Image | Enforces that container images (target_type=container) are cryptographically signed. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Forbid Large Images | Verify the image size is below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Restrict Build Scripts | Verify no build scripts commands appear in block list. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Require Healthcheck | Checks that the container image includes at least one healthcheck property. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Disallow Specific Users in SBOM | Verify specific users are not allowed in an SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Verify Image Labels | Verify specified labels key-value pairs exist in the image. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Banned Ports | Ensures that the container image does not expose ports that are disallowed by organizational policy. -The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. -It fails if any banned port is exposed or if no banned ports list is provided. - | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Verify File Integrity | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Restrict Disallowed Dependencies | Verify the number of disallowed dependencies remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Verify No Critical or High Vulnerabilities | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Disallow Unsigned Commits | Verify all commits are signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Required Git Evidence Exists | Verify required Git evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Disallow Commits to Main Branch | Verify commits made directly to the main branch are disallowed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Restrict Coding Permissions | Verify only allowed users committed to the repository. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Git Artifact Signed | Verify the Git artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/sbom) for more details. | -| Verify Attack Vector Exists in SARIF | Verify required evidence validates attack vectors in the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Rule Compliance in SARIF | Verify the SARIF report complies with defined generic rules for compliance and security. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Required Evidence in SARIF | Verify all required evidence exists as defined by the SARIF policy. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Semgrep Rule in SARIF | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Tool Evidence in SARIF | Verify required tools were used to generate the SARIF report. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify IaC Misconfiguration Threshold in SARIF | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Artifact Signature Using SARIF Report | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| SARIF Update Needed | Verify no security packages require updates. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Trivy Blocklist CVE Check | Verify a CVE Blocklist against a SARIF report | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify IaC Misconfiguration Threshold in Trivy SARIF | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Trivy Vulnerability Findings Check | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed -the defined severity threshold. - | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Trivy SARIF Report Compliance | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Verify Attack Vector Threshold in Trivy SARIF | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| K8s Jailbreak | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | See [here](https://scribe-security.netlify.app/docs/valint/sarif) for more details. | -| Required Generic Evidence Exists | Verify required evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Required Trivy Evidence Exists | Verify required Trivy evidence exists | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Generic Artifact Signed | Verify required evidence is signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Prevent Long-Lived Tokens | Verify Bitbucket API tokens expire before the maximum time to live. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Prevent Credential Exposure | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Project Users | Verify only users specified in the Allowed List have user access to the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Project Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Verify Default Branch Protection Setting Is Configured | Verify the default branch protection is enabled in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Repository Users | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Repository Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Workspace Users | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Allowed Workspace Admins | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. | -| Verify Exposed Credentials | Verify there are no exposed credentials. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | -| GitLab pipeline verify labels exist | Verify the pipeline has all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | -| Verify GitLab Pipeline Labels | Verify the pipeline includes all required label keys and values. | See [here](https://scribe-security.netlify.app/docs/platforms/discover) for more details. | -| Verify DockerHub Tokens are Active | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. | -| Verify no unused Dockerhub | Verify that there are no unused Dockerhub. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. | -| Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Allowed GitHub Organization Users | Verify only users in the Allowed List have user access to the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Secret_Scanning_Push_Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify members_can_create_repositories setting | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Limit Admin Number in GitHub Organization | Verify the maximum number of GitHub organization admins is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify GitHub Organization Requires Signoff on Web Commits | Verify contributors sign commits through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Secret_Scanning Setting in Security_And_Analysis | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Secret_Scanning_Validity_Checks_Enabled Setting | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify two_factor_requirement_enabled setting | Verify `two_factor_requirement` is enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Repo Visibility Setting | Verify only repositories in the Allowed List are public in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify dependabot_alerts_enabled_for_new_repositories setting | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify dependabot_security_updates_enabled_for_new_repositories setting | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify GitHub Organization Secrets Are Not Too Old | Verify secrets in the GitHub organization are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify dependency_graph_enabled_for_new_repositories setting | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify advanced security setting is enabled | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify members_can_create_private_repositories setting | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Allowed GitHub Organization Admins | Verify only users in the Allowed List have admin privileges in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify dependabot_security_updates setting in security_and_analysis | Verify Dependabot security updates are configured in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify secret_scanning_enabled_for_new_repositories setting | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Branch Verification Setting | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Branch Protection Setting | Verify branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify All Commits Are Signed in Repository | Verify all commits are signed in a repository attestation. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Dependabot security updates setting | Verify Dependabot security updates are configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Repository Is Private | Verify the GitHub repository is private. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify No Organization Secrets Exist in Repository | Verify no organization secrets exist in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Repository Requires Commit Signoff | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify secret scanning. | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify No Old Secrets Exist in Repository | Verify secrets in the GitHub repository are not older than the specified threshold. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Allowed Public Repositories | Verify only GitHub repositories in the Allowed List are public. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify No Cache Usage Exists in Repository | Verify the GitHub repository has no cache usage. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Push Protection Setting | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Only Ephemeral Runners Exist in Repository | Verify self-hosted runners are disallowed in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify All Commits Are Signed in Repository | Verify all commits in the GitHub repository are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify Default Branch Protection | Verify the default branch protection is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Verify secret_scanning setting | Verify `secret_scanning` is configured in the GitHub repository. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. | -| Ensure Active Projects in GitLab Organization | Verify no GitLab organization projects are inactive. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Allowed Users in GitLab Organization | Verify only users in the Allowed List have access to the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Limit Admins in GitLab Organization | Verify the maximum number of admins for the GitLab project is restricted. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Forbid Unused Tokens in GitLab Organization | Verify there are no unused GitLab organization tokens. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Forbid Token Scopes in GitLab Organization | Verify no GitLab organization tokens have disallowed scopes. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Prevent Token Expiration in GitLab Organization | Verify no GitLab organization tokens are about to expire. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Allowed Admins in GitLab Organization | Verify only users in the Allowed List have admin privileges in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Restrict Token Scopes in GitLab | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Forbid Long-Lived Tokens in GitLab Organization | Verify no GitLab organization tokens have an excessively long lifespan. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Block Users in GitLab Organization | Verify no users in the GitLab organization are on the block list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Restrict Public Visibility in GitLab Organization | Verify only allowed projects in the GitLab organization have public visibility. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Reject Unsigned Commits in GitLab Project | Verify `reject_unsigned_commits` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enforce Merge Access Level Policy for GitLab Project | Verify the GitLab project's merge access level complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Set Push Access Level in GitLab Project | Verify the GitLab project's push access level policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Ensure SAST Scanning Passes | Verify SAST scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Check CWE Compliance | Verify that specified CWEs were not detected in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enable Commit Committer Check in GitLab Project | Verify `commit_committer_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Reset Approvals on Push in GitLab Project | Verify `reset_approvals_on_push` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Require Code Owner Approval in GitLab Project | Verify code owner approval is required for specific branches in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Disallow Force Push in GitLab Project | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Ensure Secrets Scanning Passes | Verify secrets scanning is successful for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Protect CI Secrets in GitLab Project | Verify secrets in the GitLab project are not shared. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enable Member Check for GitLab Project | Verify `member_check` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Check Description Substring | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Set Author Email Regex in GitLab Project | Verify the `author_email_regex` for the GitLab project is set to the specified value. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Restrict Approvers Per Merge Request | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Merge approval policy check for GitLab project | Verify the project's merge approval policy complies with requirements. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Require Password for Approvals in GitLab Project | Verify the binary field `require_password_to_approve` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Verify Project Activity | Verify the GitLab project is active for a specified duration. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Disable Committers' Approval for Merge Requests in GitLab | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Set Visibility Level in GitLab Project | Verify the GitLab project's visibility matches the required level. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Restrict Commit Authors in GitLab Project | Verify only GitLab project users in the Allowed List have commit author permissions. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Verify Commit Message Format | Verify that commit messages in the GitLab project adhere to the specified format template. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Validate All Commits in GitLab Project | Verify all commits in the GitLab project are validated. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enforce Critical Severity Limit | Verify the maximum allowed critical severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enable Secrets Prevention in GitLab Project | Verify `prevent_secrets` is enabled for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Restrict Selective Code Owner Removals in GitLab | Verify `selective_code_owner_removals` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Disable Author Approval for Merge Requests in GitLab | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Require Minimal Approvers in GitLab Project | Verify the required number of approvers for the GitLab project is met. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Run Secrets Scanning in GitLab Project | Verify secrets scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Allowed Committer Emails in GitLab Project | Verify only users in the Allowed List use committer email addresses in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Enforce Medium Severity Limit | Verify the maximum allowed medium severity alerts for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Ensure All Commits Are Signed in GitLab Project | Verify all commits in the GitLab project are signed. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Disallow Banned Approvers | Verify approvers in the GitLab project are not on the banned list. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Check Message Substring | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Allowed Committer Names in GitLab Project | Verify only users in the Allowed List commit by name in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Allowed Commit Authors in GitLab Project | Verify only users in the Allowed List author commits in the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Set Push Rules for GitLab Project | Verify push rules are set for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Run SAST Scanning in GitLab Project | Verify SAST scanning is performed for the GitLab project. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. | -| Disallow Unused Users | Verify there are no users with zero activity. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. | -| Verify Inactive Users | Verify there are no inactive users. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. | -| Allowed Namespace Registries | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Allowed Namespaces | Verify only namespaces specified in the Allowed List are allowed within the cluster. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Verify Namespace Runtime Duration | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Verify Namespace Termination | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Allowed Container Images | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Allowed Pods in Namespace | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Verify Pod Termination | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Verify Pod Runtime Duration | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Allowed Pods | Verify only pods explicitly listed in the Allowed List are allowed to run. | See [here](https://scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. | -| Verify that provenance is authenticated | Verify the artifact is signed. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Verify that artifact was created by the specified builder | Verify the artifact was created by the specified builder. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Disallow dependencies in SLSA Provenance Document | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| SLSA Field Exists in Provenance Document | Verify the specified field exists in the provenance document. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Verify that artifact has no disallowed builder dependencies | Verify the artifact has no disallowed builder dependencies. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Verify build time | Verify the artifact was created within the specified time window. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Verify Provenance Document Exists | Verify that the Provenance document evidence exists. | See [here](https://scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. | -| Sign Selected Commit Range in GitLab | Verify the selected range of commits is signed via the GitLab API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Sign Selected Commits in GitLab | Verify the selected commits are signed in the GitLab organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Set Push Rules in GitLab | Verify GitLab push rules are configured via the API. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Enforce 2FA | PS.1 Require 2FA for accessing code | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| SBOM archived | PS.3.2 Archive SBOM | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Limit admins | PS.1 Restrict the maximum number of organization admins | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Branch protected | PS.1 Require branch protection for the repository | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Code archived | PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository - | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Require signoff on web commits | PS.1 Require contributors to sign when committing to Github through the web interface | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Repo private | PS.1 Assure the repository is private | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Image-verifiable | PS.2 Provide a mechanism to verify the integrity of the image | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Verify No Critical or High Vulnerabilities in Product | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Disallow Unsigned Commits In Time Range | Verify commits in the specified time range are signed. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Branch protection enabled in GitHub repository | Verify GitHub branch protection rules | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | -| Verify Selected Commits Are Signed API | Verify selected commits are signed in the GitHub organization. | See [here](https://scribe-security.netlify.app/docs/valint/generic) for more details. | \ No newline at end of file From 74d9c828c1502f578b21ef72a58bacf3518f6302 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:10:09 +0200 Subject: [PATCH 142/191] update index location --- docs/configuration/initiatives/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 2353028c7..decf202cc 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -141,7 +141,7 @@ ### Github Organization Discovery Evidence **Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) -|
Rule Name
| Description | +| Rule Name | Description | |-----------|-------------| | [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | | [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | From fcedb85ab409b1fa326f1cd46eab67a15d830e9b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:17:18 +0200 Subject: [PATCH 143/191] update index location --- docs/configuration/initiatives/index.md | 130 ++++++++--------- .../rules/api/scribe-api-cve-product.md | 1 - .../initiatives/rules/api/scribe-api-cve.md | 1 - .../rules/api/scribe-api-published.md | 1 - .../initiatives/rules/api/scribe-api.md | 1 - .../rules/bitbucket/project/allow-admins.md | 3 +- .../rules/bitbucket/project/allow-users.md | 3 +- .../bitbucket/project/exposed-credentials.md | 3 +- .../bitbucket/project/long-live-tokens.md | 3 +- .../bitbucket/repository/allow-admins.md | 3 +- .../rules/bitbucket/repository/allow-users.md | 3 +- .../bitbucket/repository/branch-protection.md | 3 +- .../rules/bitbucket/workspace/allow-admins.md | 3 +- .../rules/bitbucket/workspace/allow-users.md | 3 +- .../rules/dockerhub/token-expiration.md | 3 +- .../rules/dockerhub/token-not-used.md | 3 +- .../rules/generic/artifact-signed.md | 3 +- .../rules/generic/evidence-exists.md | 3 +- .../rules/generic/k8s-jailbreak.md | 3 +- .../initiatives/rules/generic/trivy-exists.md | 3 +- .../initiatives/rules/git/artifact-signed.md | 3 +- .../rules/git/coding-permissions.md | 3 +- .../initiatives/rules/git/evidence-exists.md | 3 +- .../rules/git/no-commit-to-main.md | 3 +- .../rules/git/no-unsigned-commits.md | 3 +- .../rules/github/api/branch-protection.md | 1 - .../rules/github/api/signed-commits-list.md | 1 - .../rules/github/api/signed-commits-range.md | 1 - .../initiatives/rules/github/org/2fa.md | 3 +- .../rules/github/org/advanced-security.md | 3 +- .../rules/github/org/allow-admins.md | 3 +- .../rules/github/org/allow-users.md | 3 +- .../rules/github/org/create-private-repos.md | 3 +- .../rules/github/org/create-repos.md | 3 +- .../rules/github/org/dependabot-alerts.md | 3 +- .../org/dependabot-security-updates-sa.md | 3 +- .../github/org/dependabot-security-updates.md | 3 +- .../rules/github/org/dependency-graph.md | 3 +- .../rules/github/org/max-admins.md | 3 +- .../rules/github/org/old-secrets.md | 3 +- .../rules/github/org/pp-custom-link.md | 3 +- .../rules/github/org/push-protection-sa.md | 3 +- .../rules/github/org/push-protection.md | 3 +- .../rules/github/org/repo-visibility.md | 3 +- .../rules/github/org/secret-scanning-sa.md | 3 +- .../rules/github/org/secret-scanning.md | 3 +- .../rules/github/org/validity-checks-sa.md | 3 +- .../rules/github/org/validity-checks.md | 3 +- .../rules/github/org/web-commit-signoff.md | 3 +- .../github/repository/branch-protection.md | 3 +- .../github/repository/branch-verification.md | 3 +- .../github/repository/check-signed-commits.md | 3 +- .../repository/default-branch-protection.md | 3 +- .../rules/github/repository/dependabot.md | 3 +- .../repository/ephemeral-runners-only.md | 3 +- .../rules/github/repository/no-cache-usage.md | 3 +- .../rules/github/repository/no-org-secrets.md | 3 +- .../rules/github/repository/old-secrets.md | 3 +- .../github/repository/push-protection.md | 3 +- .../rules/github/repository/repo-private.md | 3 +- .../github/repository/secret-scanning.md | 3 +- .../rules/github/repository/signed-commits.md | 3 +- .../github/repository/validity-checks.md | 3 +- .../rules/github/repository/visibility.md | 3 +- .../github/repository/web-commit-signoff.md | 3 +- .../rules/gitlab/api/push-rules.md | 1 - .../rules/gitlab/api/signed-commits-list.md | 1 - .../rules/gitlab/api/signed-commits-range.md | 1 - .../rules/gitlab/org/allow-admins.md | 3 +- .../rules/gitlab/org/allow-token-scopes.md | 3 +- .../rules/gitlab/org/allow-users.md | 3 +- .../rules/gitlab/org/blocked-users.md | 3 +- .../rules/gitlab/org/expiring-tokens.md | 3 +- .../rules/gitlab/org/forbid-token-scopes.md | 3 +- .../rules/gitlab/org/inactive-projects.md | 3 +- .../rules/gitlab/org/longlive-tokens.md | 3 +- .../rules/gitlab/org/max-admins.md | 3 +- .../rules/gitlab/org/projects-visibility.md | 3 +- .../rules/gitlab/org/unused-tokens.md | 3 +- .../gitlab/pipeline/verify-labels-exist.md | 3 +- .../rules/gitlab/pipeline/verify-labels.md | 3 +- .../rules/gitlab/project/abandoned-project.md | 3 +- .../gitlab/project/approvals-policy-check.md | 3 +- .../project/approvers-per-merge-request.md | 3 +- .../gitlab/project/author-email-regex.md | 3 +- .../rules/gitlab/project/check-cwe.md | 3 +- .../gitlab/project/check-signed-commits.md | 3 +- .../gitlab/project/co-approval-required.md | 3 +- .../project/commit-author-email-check.md | 3 +- .../project/commit-author-name-check.md | 3 +- .../gitlab/project/commit-committer-check.md | 3 +- .../gitlab/project/commit-message-check.md | 3 +- .../rules/gitlab/project/commits-validated.md | 3 +- .../gitlab/project/committer-email-check.md | 3 +- .../gitlab/project/committer-name-check.md | 3 +- .../gitlab/project/critical-severity-limit.md | 3 +- .../project/description-substring-check.md | 3 +- .../project/disallowed-banned-approvers.md | 3 +- .../gitlab/project/force-push-protection.md | 3 +- .../gitlab/project/medium-severity-limit.md | 3 +- .../rules/gitlab/project/member-check.md | 3 +- .../gitlab/project/merge-access-level.md | 3 +- .../project/merge-requests-author-approval.md | 3 +- ...ge-requests-disable-committers-approval.md | 3 +- .../gitlab/project/message-substring-check.md | 3 +- .../gitlab/project/prevent-secrets-check.md | 3 +- .../gitlab/project/protect-ci-secrets.md | 3 +- .../rules/gitlab/project/push-access-level.md | 3 +- .../rules/gitlab/project/push-rules-set.md | 3 +- .../gitlab/project/reject-unsigned-commits.md | 3 +- .../project/require-password-to-approve.md | 3 +- .../project/required-minimal-approvers.md | 3 +- .../gitlab/project/reset-pprovals-on-push.md | 3 +- .../rules/gitlab/project/sast-scan-pass.md | 3 +- .../rules/gitlab/project/sast-scanning.md | 3 +- .../rules/gitlab/project/secrets-scan-pass.md | 3 +- .../rules/gitlab/project/secrets-scanning.md | 3 +- .../project/selective-code-owner-removals.md | 3 +- .../rules/gitlab/project/visibility-check.md | 3 +- .../rules/images/allowed-base-image.md | 3 +- .../rules/images/allowed-image-source.md | 3 +- .../initiatives/rules/images/banned-ports.md | 3 +- .../initiatives/rules/images/banned-users.md | 3 +- .../rules/images/blocklist-build-scripts.md | 3 +- .../rules/images/enforce-https-registry.md | 3 +- .../rules/images/forbid-large-images.md | 3 +- .../rules/images/fresh-base-image.md | 3 +- .../initiatives/rules/images/fresh-image.md | 3 +- .../initiatives/rules/images/image-signed.md | 3 +- .../rules/images/require-healthcheck.md | 3 +- .../rules/images/restrict-shell-entrypoint.md | 3 +- .../rules/images/verify-labels-exist.md | 3 +- .../initiatives/rules/images/verify-labels.md | 3 +- .../jenkins/folder/exposed-credentials.md | 3 +- .../rules/jenkins/instance/inactive-users.md | 3 +- .../rules/jenkins/instance/unused-users.md | 3 +- .../rules/k8s/namespace/allowed-images.md | 3 +- .../rules/k8s/namespace/allowed-registries.md | 3 +- .../namespace/verify-namespace-duration.md | 3 +- .../namespace/verify-namespace-termination.md | 3 +- .../k8s/namespace/white-listed-namespaces.md | 3 +- .../rules/k8s/namespace/white-listed-pod.md | 3 +- .../rules/k8s/pods/verify-pod-duration.md | 3 +- .../rules/k8s/pods/verify-pod-termination.md | 3 +- .../rules/k8s/pods/white-listed-pod.md | 3 +- .../rules/multievidence/files_integrity.md | 3 +- .../rules/sarif/artifact-signed.md | 3 +- .../rules/sarif/evidence-exists.md | 3 +- .../rules/sarif/patcheck/updates-needed.md | 3 +- .../rules/sarif/report-iac-errors.md | 3 +- .../rules/sarif/trivy/blocklist-cve.md | 3 +- .../sarif/trivy/report-trivy-iac-errors.md | 3 +- .../rules/sarif/trivy/verify-cve-severity.md | 3 +- .../sarif/trivy/verify-trivy-attack-vector.md | 3 +- .../rules/sarif/trivy/verify-trivy-report.md | 3 +- .../rules/sarif/verify-attack-vector.md | 3 +- .../initiatives/rules/sarif/verify-sarif.md | 3 +- .../rules/sarif/verify-semgrep-report.md | 3 +- .../rules/sarif/verify-tool-evidence.md | 3 +- .../initiatives/rules/sbom/NTIA-compliance.md | 3 +- .../rules/sbom/allowed-components.md | 3 +- .../initiatives/rules/sbom/artifact-signed.md | 3 +- .../initiatives/rules/sbom/banned-licenses.md | 3 +- .../rules/sbom/blocklist-packages.md | 3 +- .../rules/sbom/complete-licenses.md | 3 +- .../initiatives/rules/sbom/fresh-sbom.md | 3 +- .../initiatives/rules/sbom/require-sbom.md | 3 +- .../rules/sbom/required-packages.md | 3 +- .../rules/sbom/verify-huggingface-license.md | 3 +- .../rules/slsa/banned-builder-deps.md | 3 +- .../initiatives/rules/slsa/build-time.md | 3 +- .../initiatives/rules/slsa/field-exists.md | 3 +- .../rules/slsa/l1-provenance-exists.md | 3 +- .../rules/slsa/l2-provenance-authenticated.md | 3 +- .../initiatives/rules/slsa/verify-builder.md | 3 +- .../rules/slsa/verify-byproducts.md | 3 +- .../initiatives/rules/ssdf/ps-1-2fa.md | 3 +- .../rules/ssdf/ps-1-branch-protection.md | 3 +- .../rules/ssdf/ps-1-limit-admins.md | 3 +- .../rules/ssdf/ps-1-repo-private.md | 3 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 3 +- .../rules/ssdf/ps-2-image-verifiable.md | 3 +- .../rules/ssdf/ps-3.1-code-archived.md | 3 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 3 +- docs/configuration/v2/initiatives/index.md | 131 +++++++++--------- .../rules/bitbucket/project/allow-admins.md | 2 +- .../rules/bitbucket/project/allow-users.md | 2 +- .../bitbucket/project/exposed-credentials.md | 2 +- .../bitbucket/project/long-live-tokens.md | 2 +- .../bitbucket/repository/allow-admins.md | 2 +- .../rules/bitbucket/repository/allow-users.md | 2 +- .../bitbucket/repository/branch-protection.md | 2 +- .../rules/bitbucket/workspace/allow-admins.md | 2 +- .../rules/bitbucket/workspace/allow-users.md | 2 +- .../rules/dockerhub/token-expiration.md | 2 +- .../rules/dockerhub/token-not-used.md | 2 +- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 2 +- .../rules/git/coding-permissions.md | 2 +- .../initiatives/rules/git/evidence-exists.md | 2 +- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../v2/initiatives/rules/github/org/2fa.md | 2 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/github/org/allow-users.md | 2 +- .../rules/github/org/create-private-repos.md | 2 +- .../rules/github/org/create-repos.md | 2 +- .../rules/github/org/dependabot-alerts.md | 2 +- .../org/dependabot-security-updates-sa.md | 2 +- .../github/org/dependabot-security-updates.md | 2 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/max-admins.md | 2 +- .../rules/github/org/old-secrets.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/repo-visibility.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/github/org/web-commit-signoff.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../github/repository/branch-verification.md | 2 +- .../github/repository/check-signed-commits.md | 2 +- .../repository/default-branch-protection.md | 2 +- .../rules/github/repository/dependabot.md | 2 +- .../repository/ephemeral-runners-only.md | 2 +- .../rules/github/repository/no-cache-usage.md | 2 +- .../rules/github/repository/no-org-secrets.md | 2 +- .../rules/github/repository/old-secrets.md | 2 +- .../github/repository/push-protection.md | 2 +- .../rules/github/repository/repo-private.md | 2 +- .../github/repository/secret-scanning.md | 2 +- .../rules/github/repository/signed-commits.md | 2 +- .../github/repository/validity-checks.md | 2 +- .../rules/github/repository/visibility.md | 2 +- .../github/repository/web-commit-signoff.md | 2 +- .../rules/gitlab/org/allow-admins.md | 2 +- .../rules/gitlab/org/allow-token-scopes.md | 2 +- .../rules/gitlab/org/allow-users.md | 2 +- .../rules/gitlab/org/blocked-users.md | 2 +- .../rules/gitlab/org/expiring-tokens.md | 2 +- .../rules/gitlab/org/forbid-token-scopes.md | 2 +- .../rules/gitlab/org/inactive-projects.md | 2 +- .../rules/gitlab/org/longlive-tokens.md | 2 +- .../rules/gitlab/org/max-admins.md | 2 +- .../rules/gitlab/org/projects-visibility.md | 2 +- .../rules/gitlab/org/unused-tokens.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/gitlab/project/abandoned-project.md | 2 +- .../gitlab/project/approvals-policy-check.md | 2 +- .../project/approvers-per-merge-request.md | 2 +- .../gitlab/project/author-email-regex.md | 2 +- .../rules/gitlab/project/check-cwe.md | 2 +- .../gitlab/project/check-signed-commits.md | 2 +- .../gitlab/project/co-approval-required.md | 2 +- .../project/commit-author-email-check.md | 2 +- .../project/commit-author-name-check.md | 2 +- .../gitlab/project/commit-committer-check.md | 2 +- .../gitlab/project/commit-message-check.md | 2 +- .../rules/gitlab/project/commits-validated.md | 2 +- .../gitlab/project/committer-email-check.md | 2 +- .../gitlab/project/committer-name-check.md | 2 +- .../gitlab/project/critical-severity-limit.md | 2 +- .../project/description-substring-check.md | 2 +- .../project/disallowed-banned-approvers.md | 2 +- .../gitlab/project/force-push-protection.md | 2 +- .../gitlab/project/medium-severity-limit.md | 2 +- .../rules/gitlab/project/member-check.md | 2 +- .../gitlab/project/merge-access-level.md | 2 +- .../project/merge-requests-author-approval.md | 2 +- ...ge-requests-disable-committers-approval.md | 2 +- .../gitlab/project/message-substring-check.md | 2 +- .../gitlab/project/prevent-secrets-check.md | 2 +- .../gitlab/project/protect-ci-secrets.md | 2 +- .../rules/gitlab/project/push-access-level.md | 2 +- .../rules/gitlab/project/push-rules-set.md | 2 +- .../gitlab/project/reject-unsigned-commits.md | 2 +- .../project/require-password-to-approve.md | 2 +- .../project/required-minimal-approvers.md | 2 +- .../gitlab/project/reset-pprovals-on-push.md | 2 +- .../rules/gitlab/project/sast-scan-pass.md | 2 +- .../rules/gitlab/project/sast-scanning.md | 2 +- .../rules/gitlab/project/secrets-scan-pass.md | 2 +- .../rules/gitlab/project/secrets-scanning.md | 2 +- .../project/selective-code-owner-removals.md | 2 +- .../rules/gitlab/project/visibility-check.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 2 +- .../rules/jenkins/instance/unused-users.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 2 +- .../k8s/namespace/white-listed-namespaces.md | 2 +- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../v2/initiatives/rules/sbom/fresh-sbom.md | 2 +- .../v2/initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- .../rules/slsa/banned-builder-deps.md | 2 +- .../v2/initiatives/rules/slsa/build-time.md | 2 +- .../v2/initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- .../v2/initiatives/rules/ssdf/ps-1-2fa.md | 2 +- .../rules/ssdf/ps-1-branch-protection.md | 2 +- .../rules/ssdf/ps-1-limit-admins.md | 2 +- .../rules/ssdf/ps-1-repo-private.md | 2 +- .../rules/ssdf/ps-1-web-commit-signoff.md | 2 +- .../rules/ssdf/ps-2-image-verifiable.md | 2 +- .../rules/ssdf/ps-3.1-code-archived.md | 2 +- .../rules/ssdf/ps-3.2-archived-sbom.md | 2 +- 358 files changed, 477 insertions(+), 659 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index decf202cc..1109250b0 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -15,7 +15,7 @@ ## Rules ### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -32,7 +32,7 @@ | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | ### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -55,7 +55,7 @@ | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -66,7 +66,7 @@ | [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | ### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| @@ -86,7 +86,7 @@ | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| @@ -94,52 +94,8 @@ | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | | [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | -### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | - -### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | - -### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | - -### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | - -### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | - ### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -166,7 +122,7 @@ | [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | ### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -188,7 +144,7 @@ | [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -205,7 +161,7 @@ | [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | ### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -248,16 +204,8 @@ | [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | | [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | -### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | - ### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -269,7 +217,7 @@ | [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -277,8 +225,60 @@ | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | | [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + ### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| @@ -291,7 +291,7 @@ | [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | ### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index a600c2024..bd5f975eb 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -5,7 +5,6 @@ title: Verify No Critical or High Vulnerabilities in Product # Verify No Critical or High Vulnerabilities in Product **Type:** Rule **ID:** `scribe-cve-product` -**Uses:** `api/scribe-api-cve-product@v2/rules` **Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml) **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 5eda63552..0d260a3f7 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -5,7 +5,6 @@ title: Verify No Critical or High Vulnerabilities # Verify No Critical or High Vulnerabilities **Type:** Rule **ID:** `scribe-cve` -**Uses:** `api/scribe-api-cve@v2/rules` **Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index fda0f7d67..5d7cbca04 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -5,7 +5,6 @@ title: Scribe Published Policy # Scribe Published Policy **Type:** Rule **ID:** `scribe-published-policy` -**Uses:** `api/scribe-api-published@v2/rules` **Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml) **Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego) **Labels:** Scribe diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index ad81d49f1..b7f531c1d 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -5,7 +5,6 @@ title: Apply Scribe Template Policy # Apply Scribe Template Policy **Type:** Rule **ID:** `scribe-template` -**Uses:** `api/scribe-api@v2/rules` **Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) **Labels:** Scribe diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 934bbbca8..567876755 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -5,14 +5,13 @@ title: Allowed Project Admins # Allowed Project Admins **Type:** Rule **ID:** `bb-project-allowed-project-admins` -**Uses:** `bitbucket/project/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego) Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index dbb386d93..f04cf6caa 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -5,14 +5,13 @@ title: Allowed Project Users # Allowed Project Users **Type:** Rule **ID:** `bb-project-allowed-project-users` -**Uses:** `bitbucket/project/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego) Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 37aea5ed6..6a30f3015 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -5,7 +5,6 @@ title: Prevent Credential Exposure # Prevent Credential Exposure **Type:** Rule **ID:** `bb-project-exposed-credentials` -**Uses:** `bitbucket/project/exposed-credentials@v2/rules` **Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml) **Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego) **Labels:** Bitbucket, Project @@ -13,7 +12,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 99a423104..e2b078419 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -5,7 +5,6 @@ title: Prevent Long-Lived Tokens # Prevent Long-Lived Tokens **Type:** Rule **ID:** `bb-project-long-live-tokens` -**Uses:** `bitbucket/project/long-live-tokens@v2/rules` **Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml) **Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego) **Labels:** Bitbucket, Project @@ -13,7 +12,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 8cbf7fb47..c30c716c9 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Repository Admins # Allowed Repository Admins **Type:** Rule **ID:** `bb-repo-allowed-repository-admins` -**Uses:** `bitbucket/repository/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego) **Labels:** Bitbucket, Repository @@ -13,7 +12,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 7a22799b1..a24800589 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Repository Users # Allowed Repository Users **Type:** Rule **ID:** `bb-repo-allowed-repository-users` -**Uses:** `bitbucket/repository/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego) **Labels:** Bitbucket, Repository @@ -13,7 +12,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 825dfc978..e27ea2268 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -5,7 +5,6 @@ title: Verify Default Branch Protection Setting Is Configured # Verify Default Branch Protection Setting Is Configured **Type:** Rule **ID:** `bb-repo-branch-protection` -**Uses:** `bitbucket/repository/branch-protection@v2/rules` **Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego) **Labels:** Bitbucket, Repository @@ -13,7 +12,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 5d8a857ef..b5e2d1c7b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Workspace Admins # Allowed Workspace Admins **Type:** Rule **ID:** `bb-workspace-allowed-workspace-admins` -**Uses:** `bitbucket/workspace/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego) **Labels:** Bitbucket, Workspace @@ -13,7 +12,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 0e43f2b70..b3c5e4223 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Workspace Users # Allowed Workspace Users **Type:** Rule **ID:** `bb-workspace-allowed-workspace-users` -**Uses:** `bitbucket/workspace/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego) **Labels:** Bitbucket, Workspace @@ -13,7 +12,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index b01b31533..87ab4c5ea 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -5,7 +5,6 @@ title: Verify DockerHub Tokens are Active # Verify DockerHub Tokens are Active **Type:** Rule **ID:** `dockerhub-token-expiration` -**Uses:** `dockerhub/token-expiration@v2/rules` **Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml) **Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego) **Labels:** Dockerhub @@ -13,7 +12,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 3ded9c542..b5a101bb0 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -5,7 +5,6 @@ title: Verify no unused Dockerhub # Verify no unused Dockerhub **Type:** Rule **ID:** `dockerhub-token-not-used` -**Uses:** `dockerhub/token-not-used@v2/rules` **Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml) **Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego) **Labels:** Dockerhub @@ -13,7 +12,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 2917b47ef..43014375d 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -5,7 +5,6 @@ title: Generic Artifact Signed # Generic Artifact Signed **Type:** Rule **ID:** `generic-artifact-signed` -**Uses:** `generic/artifact-signed@v2/rules` **Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego) **Labels:** 3rd-party @@ -13,7 +12,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 22221a0fe..755d64a55 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -5,7 +5,6 @@ title: Required Generic Evidence Exists # Required Generic Evidence Exists **Type:** Rule **ID:** `generic-required-evidence` -**Uses:** `generic/evidence-exists@v2/rules` **Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego) **Labels:** 3rd-party @@ -13,7 +12,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 39afd1720..e109441d6 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -5,7 +5,6 @@ title: K8s Jailbreak # K8s Jailbreak **Type:** Rule **ID:** `k8s-jailbreak` -**Uses:** `generic/k8s-jailbreak@v2/rules` **Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml) **Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego) **Labels:** K8s @@ -13,7 +12,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 73b40dd7d..15dcc4d3c 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -5,14 +5,13 @@ title: Required Trivy Evidence Exists # Required Trivy Evidence Exists **Type:** Rule **ID:** `required-trivy-evidence` -**Uses:** `generic/trivy-exists@v2/rules` **Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml) **Labels:** 3rd-party Verify required Trivy evidence exists :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 2f1aa7b81..adba441c5 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -5,7 +5,6 @@ title: Git Artifact Signed # Git Artifact Signed **Type:** Rule **ID:** `git-artifact-signed` -**Uses:** `git/artifact-signed@v2/rules` **Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) **Labels:** SBOM, Git @@ -13,7 +12,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 4f9444ff5..b4c85592c 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -5,7 +5,6 @@ title: Restrict Coding Permissions # Restrict Coding Permissions **Type:** Rule **ID:** `git-coding-permissions` -**Uses:** `git/coding-permissions@v2/rules` **Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) **Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) **Labels:** SBOM, Git @@ -13,7 +12,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 7348f614a..1726df4b0 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -5,7 +5,6 @@ title: Required Git Evidence Exists # Required Git Evidence Exists **Type:** Rule **ID:** `required-git-evidence` -**Uses:** `git/evidence-exists@v2/rules` **Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) **Labels:** SBOM, Git @@ -13,7 +12,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index fc197b904..db13bcef5 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -5,7 +5,6 @@ title: Disallow Commits to Main Branch # Disallow Commits to Main Branch **Type:** Rule **ID:** `git-disallow-commits-to-main` -**Uses:** `git/no-commit-to-main@v2/rules` **Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) **Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) **Labels:** SBOM, Git @@ -13,7 +12,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index def24f262..d24a41b6a 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -5,7 +5,6 @@ title: Disallow Unsigned Commits # Disallow Unsigned Commits **Type:** Rule **ID:** `git-disallow-unsigned-commits` -**Uses:** `git/no-unsigned-commits@v2/rules` **Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml) **Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego) **Labels:** Git @@ -13,7 +12,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index e0b2d2e0a..69b6df675 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -5,7 +5,6 @@ title: Branch protection enabled in GitHub repository # Branch protection enabled in GitHub repository **Type:** Rule **ID:** `github-api-branch-protection` -**Uses:** `github/api/branch-protection@v2/rules` **Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego) **Labels:** GitHub diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 498569af5..1baaf80f2 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -5,7 +5,6 @@ title: Verify Selected Commits Are Signed API # Verify Selected Commits Are Signed API **Type:** Rule **ID:** `github-api-signed-commits-list` -**Uses:** `github/api/signed-commits-list@v2/rules` **Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml) **Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego) **Labels:** GitHub, API diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index 5ef9ddcab..af3785ad1 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -5,7 +5,6 @@ title: Disallow Unsigned Commits In Time Range # Disallow Unsigned Commits In Time Range **Type:** Rule **ID:** `signed-commits-range` -**Uses:** `github/api/signed-commits-range@v2/rules` **Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego) **Labels:** GitHub diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 2a8488cf6..ae5da3a0a 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -5,7 +5,6 @@ title: Verify two_factor_requirement_enabled setting # Verify two_factor_requirement_enabled setting **Type:** Rule **ID:** `github-org-2fa` -**Uses:** `github/org/2fa@v2/rules` **Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) **Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 6ed759530..0f5cb8cc3 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -5,7 +5,6 @@ title: Verify advanced security setting is enabled # Verify advanced security setting is enabled **Type:** Rule **ID:** `github-org-advanced-security` -**Uses:** `github/org/advanced-security@v2/rules` **Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) **Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 89599f795..afeb2b2ad 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed GitHub Organization Admins # Allowed GitHub Organization Admins **Type:** Rule **ID:** `github-orgallowed-admins` -**Uses:** `github/org/allow-admins@v2/rules` **Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 988cf73ec..bac4a8911 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -5,7 +5,6 @@ title: Allowed GitHub Organization Users # Allowed GitHub Organization Users **Type:** Rule **ID:** `github-org-allowed-users` -**Uses:** `github/org/allow-users@v2/rules` **Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 209fd14b5..cfbee5cf9 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -5,7 +5,6 @@ title: Verify members_can_create_private_repositories setting # Verify members_can_create_private_repositories setting **Type:** Rule **ID:** `github-org-create-private-repos` -**Uses:** `github/org/create-private-repos@v2/rules` **Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) **Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 64ce2379c..72760c946 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -5,7 +5,6 @@ title: Verify members_can_create_repositories setting # Verify members_can_create_repositories setting **Type:** Rule **ID:** `github-org-create-repos` -**Uses:** `github/org/create-repos@v2/rules` **Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) **Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 42e3a6efa..8181b5b5f 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -5,7 +5,6 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting # Verify dependabot_alerts_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-alerts` -**Uses:** `github/org/dependabot-alerts@v2/rules` **Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml) **Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 22f3adb35..56cb07e39 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -5,7 +5,6 @@ title: Verify dependabot_security_updates setting in security_and_analysis # Verify dependabot_security_updates setting in security_and_analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` -**Uses:** `github/org/dependabot-security-updates-sa@v2/rules` **Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) **Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 7956e64d2..59c3eca94 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -5,7 +5,6 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting # Verify dependabot_security_updates_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` -**Uses:** `github/org/dependabot-security-updates@v2/rules` **Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) **Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 910faa028..1506245b8 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -5,7 +5,6 @@ title: Verify dependency_graph_enabled_for_new_repositories setting # Verify dependency_graph_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependency-graph` -**Uses:** `github/org/dependency-graph@v2/rules` **Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) **Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 85b2b2b69..483f73dea 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -5,7 +5,6 @@ title: Limit Admin Number in GitHub Organization # Limit Admin Number in GitHub Organization **Type:** Rule **ID:** `github-org-max-admins` -**Uses:** `github/org/max-admins@v2/rules` **Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) **Labels:** Blueprint, GitHub, Organization @@ -13,7 +12,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 54b24f34d..d1df76007 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -5,7 +5,6 @@ title: Verify GitHub Organization Secrets Are Not Too Old # Verify GitHub Organization Secrets Are Not Too Old **Type:** Rule **ID:** `github-org-old-secrets` -**Uses:** `github/org/old-secrets@v2/rules` **Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml) **Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index c2a6daea7..cd1d1da56 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting # Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting **Type:** Rule **ID:** `github-org-pp-custom-link` -**Uses:** `github/org/pp-custom-link@v2/rules` **Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) **Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index dc2bffe5d..c0d62d5c6 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Push_Protection Setting # Verify Secret_Scanning_Push_Protection Setting **Type:** Rule **ID:** `github-org-push-protection-sa` -**Uses:** `github/org/push-protection-sa@v2/rules` **Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) **Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 33ff8c5f6..1beace40b 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -6,7 +6,6 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti # Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting **Type:** Rule **ID:** `github-org-push-protection` -**Uses:** `github/org/push-protection@v2/rules` **Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) **Labels:** GitHub, Organization @@ -14,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 44d6a2217..f8bb1c2b7 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -5,7 +5,6 @@ title: Verify Repo Visibility Setting # Verify Repo Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` -**Uses:** `github/org/repo-visibility@v2/rules` **Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) **Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 32bfe2a76..3cd023f4a 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis # Verify Secret_Scanning Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-secret-scanning-sa` -**Uses:** `github/org/secret-scanning-sa@v2/rules` **Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) **Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 261afff50..a13e8a48f 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -5,7 +5,6 @@ title: Verify secret_scanning_enabled_for_new_repositories setting # Verify secret_scanning_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-secret-scanning` -**Uses:** `github/org/secret-scanning@v2/rules` **Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml) **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 78fda54b1..90d59da07 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis # Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-validity-checks-sa` -**Uses:** `github/org/validity-checks-sa@v2/rules` **Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) **Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 4c22fd1e4..827210cb7 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting # Verify Secret_Scanning_Validity_Checks_Enabled Setting **Type:** Rule **ID:** `github-org-validity-checks` -**Uses:** `github/org/validity-checks@v2/rules` **Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 673c12709..5639ddfde 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -5,7 +5,6 @@ title: Verify GitHub Organization Requires Signoff on Web Commits # Verify GitHub Organization Requires Signoff on Web Commits **Type:** Rule **ID:** `github-org-web-commit-signoff` -**Uses:** `github/org/web-commit-signoff@v2/rules` **Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml) **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) **Labels:** GitHub, Organization @@ -13,7 +12,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index b894a20a9..315c00f8c 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -5,7 +5,6 @@ title: Verify Branch Protection Setting # Verify Branch Protection Setting **Type:** Rule **ID:** `github-repo-branch-protection` -**Uses:** `github/repository/branch-protection@v2/rules` **Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index a405b1b16..723bc3496 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -5,7 +5,6 @@ title: Verify Branch Verification Setting # Verify Branch Verification Setting **Type:** Rule **ID:** `github-repo-branch-verification` -**Uses:** `github/repository/branch-verification@v2/rules` **Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml) **Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index f5fd720a2..3d388f009 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -5,7 +5,6 @@ title: Verify All Commits Are Signed in Repository # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` -**Uses:** `github/repository/check-signed-commits@v2/rules` **Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml) **Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index fdfd24a1b..9b5e1e6e9 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -5,7 +5,6 @@ title: Verify Default Branch Protection # Verify Default Branch Protection **Type:** Rule **ID:** `github-repo-default-branch-protection` -**Uses:** `github/repository/default-branch-protection@v2/rules` **Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml) **Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 9492af752..abbff1459 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -5,7 +5,6 @@ title: Verify Dependabot security updates setting # Verify Dependabot security updates setting **Type:** Rule **ID:** `github-repo-dependabot` -**Uses:** `github/repository/dependabot@v2/rules` **Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) **Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index ba1382e7e..572fbe2b8 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -5,7 +5,6 @@ title: Verify Only Ephemeral Runners Exist in Repository # Verify Only Ephemeral Runners Exist in Repository **Type:** Rule **ID:** `github-repo-ephemeral-runners-only` -**Uses:** `github/repository/ephemeral-runners-only@v2/rules` **Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml) **Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 3f8fe057f..5562f259f 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -5,7 +5,6 @@ title: Verify No Cache Usage Exists in Repository # Verify No Cache Usage Exists in Repository **Type:** Rule **ID:** `github-repo-no-cache-usage` -**Uses:** `github/repository/no-cache-usage@v2/rules` **Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml) **Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index c9cf95629..912288d43 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -5,7 +5,6 @@ title: Verify No Organization Secrets Exist in Repository # Verify No Organization Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-no-org-secrets` -**Uses:** `github/repository/no-org-secrets@v2/rules` **Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml) **Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 5d2f5fd06..52b136720 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -5,7 +5,6 @@ title: Verify No Old Secrets Exist in Repository # Verify No Old Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-old-secrets` -**Uses:** `github/repository/old-secrets@v2/rules` **Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml) **Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index d863b1b53..c8be2eccd 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -5,7 +5,6 @@ title: Verify Push Protection Setting # Verify Push Protection Setting **Type:** Rule **ID:** `github-repo-push-protection` -**Uses:** `github/repository/push-protection@v2/rules` **Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml) **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index ed82a1378..4f643335a 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -5,7 +5,6 @@ title: Verify Repository Is Private # Verify Repository Is Private **Type:** Rule **ID:** `github-repo-private` -**Uses:** `github/repository/repo-private@v2/rules` **Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml) **Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 6667f2a99..587ff9ae0 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -5,7 +5,6 @@ title: Verify secret_scanning setting # Verify secret_scanning setting **Type:** Rule **ID:** `github-repo-secret-scanning` -**Uses:** `github/repository/secret-scanning@v2/rules` **Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml) **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index d28625af9..f6e2a27c4 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -5,7 +5,6 @@ title: Verify All Commits Are Signed in Repository # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` -**Uses:** `github/repository/signed-commits@v2/rules` **Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml) **Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 7ab444790..190a3af0d 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -5,7 +5,6 @@ title: Verify secret scanning. # Verify secret scanning. **Type:** Rule **ID:** `github-repo-validity-checks` -**Uses:** `github/repository/validity-checks@v2/rules` **Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml) **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index bb2134616..21aaada2a 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -5,7 +5,6 @@ title: Allowed Public Repositories # Allowed Public Repositories **Type:** Rule **ID:** `github-repo-visibility` -**Uses:** `github/repository/visibility@v2/rules` **Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml) **Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 99d0d29d9..e7d7fe222 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -5,7 +5,6 @@ title: Verify Repository Requires Commit Signoff # Verify Repository Requires Commit Signoff **Type:** Rule **ID:** `github-repo-web-commit-signoff` -**Uses:** `github/repository/web-commit-signoff@v2/rules` **Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml) **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego) **Labels:** GitHub, Repository @@ -13,7 +12,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 0775d11ca..046bd9576 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -5,7 +5,6 @@ title: Set Push Rules in GitLab # Set Push Rules in GitLab **Type:** Rule **ID:** `gitlab-api-push-rules` -**Uses:** `gitlab/api/push-rules@v2/rules` **Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml) **Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 14681c39d..92e04c992 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -5,7 +5,6 @@ title: Sign Selected Commits in GitLab # Sign Selected Commits in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-list` -**Uses:** `gitlab/api/signed-commits-list@v2/rules` **Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml) **Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index cfbac0ea1..4d8cb10e6 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -5,7 +5,6 @@ title: Sign Selected Commit Range in GitLab # Sign Selected Commit Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` -**Uses:** `gitlab/api/signed-commits-range@v2/rules` **Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 47334c1ed..a2f8911a4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Admins in GitLab Organization # Allowed Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-admins` -**Uses:** `gitlab/org/allow-admins@v2/rules` **Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 807bf8507..257f6ca94 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -5,7 +5,6 @@ title: Restrict Token Scopes in GitLab # Restrict Token Scopes in GitLab **Type:** Rule **ID:** `gitlab-org-allowed-token-scope` -**Uses:** `gitlab/org/allow-token-scopes@v2/rules` **Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml) **Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 2081bf272..64bcb0745 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Users in GitLab Organization # Allowed Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-users` -**Uses:** `gitlab/org/allow-users@v2/rules` **Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 7db84cdc0..614ca946d 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -5,7 +5,6 @@ title: Block Users in GitLab Organization # Block Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-blocked-users` -**Uses:** `gitlab/org/blocked-users@v2/rules` **Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml) **Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index dd4ee66ea..fbaa4782f 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -5,7 +5,6 @@ title: Prevent Token Expiration in GitLab Organization # Prevent Token Expiration in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-about-to-expire` -**Uses:** `gitlab/org/expiring-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml) **Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 87deffc1e..d194cd96e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -5,7 +5,6 @@ title: Forbid Token Scopes in GitLab Organization # Forbid Token Scopes in GitLab Organization **Type:** Rule **ID:** `gitlab-org-disallowed-token-scope` -**Uses:** `gitlab/org/forbid-token-scopes@v2/rules` **Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml) **Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego) **Labels:** Blueprint, Gitlab, Organization @@ -13,7 +12,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index af4e48288..295a1c1a6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -5,7 +5,6 @@ title: Ensure Active Projects in GitLab Organization # Ensure Active Projects in GitLab Organization **Type:** Rule **ID:** `gitlab-org-inactive-projects` -**Uses:** `gitlab/org/inactive-projects@v2/rules` **Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml) **Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index f40f63ed3..6303bf36f 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -5,7 +5,6 @@ title: Forbid Long-Lived Tokens in GitLab Organization # Forbid Long-Lived Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-excessive-lifespan` -**Uses:** `gitlab/org/longlive-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml) **Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego) **Labels:** Blueprint, Gitlab, Organization @@ -13,7 +12,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 527965a58..80360d979 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -5,7 +5,6 @@ title: Limit Admins in GitLab Organization # Limit Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-max-admins` -**Uses:** `gitlab/org/max-admins@v2/rules` **Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego) **Labels:** Blueprint, GitLab, Organization @@ -13,7 +12,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 9d1c66c97..6f7bbbcdd 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -5,7 +5,6 @@ title: Restrict Public Visibility in GitLab Organization # Restrict Public Visibility in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-visible-projects` -**Uses:** `gitlab/org/projects-visibility@v2/rules` **Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml) **Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index a5ebc847d..8bf0c8cb6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -5,7 +5,6 @@ title: Forbid Unused Tokens in GitLab Organization # Forbid Unused Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-unused-tokens` -**Uses:** `gitlab/org/unused-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml) **Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego) **Labels:** Gitlab, Organization @@ -13,7 +12,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 9df82e5c5..91b4d96cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -5,7 +5,6 @@ title: GitLab pipeline verify labels exist # GitLab pipeline verify labels exist **Type:** Rule **ID:** `gitlab-pipeline-verify-labels-exist` -**Uses:** `gitlab/pipeline/verify-labels-exist@v2/rules` **Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) **Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego) **Labels:** Gitlab, Pipeline @@ -13,7 +12,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index dbd3bf258..ddb89d453 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -5,7 +5,6 @@ title: Verify GitLab Pipeline Labels # Verify GitLab Pipeline Labels **Type:** Rule **ID:** `gitlab-pipeline-verify-labels` -**Uses:** `gitlab/pipeline/verify-labels@v2/rules` **Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml) **Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego) **Labels:** Gitlab, Pipeline @@ -13,7 +12,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index df85b81e2..d2c53cd07 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -5,7 +5,6 @@ title: Verify Project Activity # Verify Project Activity **Type:** Rule **ID:** `gitlab-project-abandoned-project` -**Uses:** `gitlab/project/abandoned-project@v2/rules` **Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml) **Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index efc49aae7..9485a24db 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -5,7 +5,6 @@ title: Merge approval policy check for GitLab project # Merge approval policy check for GitLab project **Type:** Rule **ID:** `gitlab-project-merge-approval` -**Uses:** `gitlab/project/approvals-policy-check@v2/rules` **Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml) **Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego) **Labels:** Blueprint, Gitlab, Project @@ -13,7 +12,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 52f269abd..d6491877b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -5,7 +5,6 @@ title: Restrict Approvers Per Merge Request # Restrict Approvers Per Merge Request **Type:** Rule **ID:** `gitlab-project-approvers-per-merge-request` -**Uses:** `gitlab/project/approvers-per-merge-request@v2/rules` **Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml) **Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index 3b4b06223..f0bef95b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -5,7 +5,6 @@ title: Set Author Email Regex in GitLab Project # Set Author Email Regex in GitLab Project **Type:** Rule **ID:** `gitlab-project-author-email-regex` -**Uses:** `gitlab/project/author-email-regex@v2/rules` **Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml) **Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index d60b4377b..13a874c4f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -5,7 +5,6 @@ title: Check CWE Compliance # Check CWE Compliance **Type:** Rule **ID:** `gitlab-project-check-cwe` -**Uses:** `gitlab/project/check-cwe@v2/rules` **Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml) **Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 539c25e11..19358c074 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -5,7 +5,6 @@ title: Ensure All Commits Are Signed in GitLab Project # Ensure All Commits Are Signed in GitLab Project **Type:** Rule **ID:** `gitlab-project-signed-commits` -**Uses:** `gitlab/project/check-signed-commits@v2/rules` **Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml) **Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 13263990b..1bb6d0a2b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -5,7 +5,6 @@ title: Require Code Owner Approval in GitLab Project # Require Code Owner Approval in GitLab Project **Type:** Rule **ID:** `gitlab-project-code-owner-approval` -**Uses:** `gitlab/project/co-approval-required@v2/rules` **Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml) **Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 493e80d0c..5f2002d5f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -5,7 +5,6 @@ title: Restrict Commit Authors in GitLab Project # Restrict Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-authors` -**Uses:** `gitlab/project/commit-author-email-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml) **Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 253b6359c..c91db1fa0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -5,7 +5,6 @@ title: Allowed Commit Authors in GitLab Project # Allowed Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-author-names` -**Uses:** `gitlab/project/commit-author-name-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml) **Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 43bf3f371..f6e91c841 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -5,7 +5,6 @@ title: Enable Commit Committer Check in GitLab Project # Enable Commit Committer Check in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-commit_committer_check` -**Uses:** `gitlab/project/commit-committer-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml) **Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 86418c640..8497009be 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -5,7 +5,6 @@ title: Verify Commit Message Format # Verify Commit Message Format **Type:** Rule **ID:** `gitlab-project-verify-commit_message_check` -**Uses:** `gitlab/project/commit-message-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml) **Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 3e4588c99..729edca82 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -5,7 +5,6 @@ title: Validate All Commits in GitLab Project # Validate All Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-all-commits-validated` -**Uses:** `gitlab/project/commits-validated@v2/rules` **Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml) **Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index b25f2f9bc..7a44c7317 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -5,7 +5,6 @@ title: Allowed Committer Emails in GitLab Project # Allowed Committer Emails in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-emails` -**Uses:** `gitlab/project/committer-email-check@v2/rules` **Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml) **Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 61a671818..0a6f037b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -5,7 +5,6 @@ title: Allowed Committer Names in GitLab Project # Allowed Committer Names in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-names` -**Uses:** `gitlab/project/committer-name-check@v2/rules` **Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml) **Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index a1f26cb13..dac1fb819 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -5,7 +5,6 @@ title: Enforce Critical Severity Limit # Enforce Critical Severity Limit **Type:** Rule **ID:** `gitlab-project-critical-severity-limit` -**Uses:** `gitlab/project/critical-severity-limit@v2/rules` **Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml) **Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index e9f46ed8a..c513b4a0d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -5,7 +5,6 @@ title: Check Description Substring # Check Description Substring **Type:** Rule **ID:** `gitlab-project-description-substring-check` -**Uses:** `gitlab/project/description-substring-check@v2/rules` **Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml) **Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 84551fdec..d29c02ef5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -5,7 +5,6 @@ title: Disallow Banned Approvers # Disallow Banned Approvers **Type:** Rule **ID:** `gitlab-project-disallowed-banned-approvers` -**Uses:** `gitlab/project/disallowed-banned-approvers@v2/rules` **Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) **Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 206a299c2..2cc0a3f81 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -5,7 +5,6 @@ title: Disallow Force Push in GitLab Project # Disallow Force Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-force-push` -**Uses:** `gitlab/project/force-push-protection@v2/rules` **Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml) **Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index d4adead00..d657f8634 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -5,7 +5,6 @@ title: Enforce Medium Severity Limit # Enforce Medium Severity Limit **Type:** Rule **ID:** `gitlab-project-medium-severity-limit` -**Uses:** `gitlab/project/medium-severity-limit@v2/rules` **Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml) **Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index d8092c8cd..090bfe4c1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -5,7 +5,6 @@ title: Enable Member Check for GitLab Project # Enable Member Check for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-member_check` -**Uses:** `gitlab/project/member-check@v2/rules` **Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml) **Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index e39c71110..ec045a9db 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -5,7 +5,6 @@ title: Enforce Merge Access Level Policy for GitLab Project # Enforce Merge Access Level Policy for GitLab Project **Type:** Rule **ID:** `gitlab-project-merge-access-level` -**Uses:** `gitlab/project/merge-access-level@v2/rules` **Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml) **Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index faa1a0cb7..471d12ac7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -5,7 +5,6 @@ title: Disable Author Approval for Merge Requests in GitLab # Disable Author Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-author-approval` -**Uses:** `gitlab/project/merge-requests-author-approval@v2/rules` **Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml) **Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 298bd272d..f7d34cdd8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -5,7 +5,6 @@ title: Disable Committers' Approval for Merge Requests in GitLab # Disable Committers' Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-disable-committers-approval` -**Uses:** `gitlab/project/merge-requests-disable-committers-approval@v2/rules` **Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) **Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index d36e50548..8c78c0e7c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -5,7 +5,6 @@ title: Check Message Substring # Check Message Substring **Type:** Rule **ID:** `gitlab-project-message-substring-check` -**Uses:** `gitlab/project/message-substring-check@v2/rules` **Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml) **Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 7df8bf61c..bc27834dd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -5,7 +5,6 @@ title: Enable Secrets Prevention in GitLab Project # Enable Secrets Prevention in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-prevent_secrets` -**Uses:** `gitlab/project/prevent-secrets-check@v2/rules` **Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml) **Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 1162289a1..5306a5b84 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -5,7 +5,6 @@ title: Protect CI Secrets in GitLab Project # Protect CI Secrets in GitLab Project **Type:** Rule **ID:** `gitlab-project-protect-ci-secrets` -**Uses:** `gitlab/project/protect-ci-secrets@v2/rules` **Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml) **Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 34f462a1c..e4b1195b7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -5,7 +5,6 @@ title: Set Push Access Level in GitLab Project # Set Push Access Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-push-access-level` -**Uses:** `gitlab/project/push-access-level@v2/rules` **Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml) **Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index ff581119e..990c718fa 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -5,7 +5,6 @@ title: Set Push Rules for GitLab Project # Set Push Rules for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-push_rules` -**Uses:** `gitlab/project/push-rules-set@v2/rules` **Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml) **Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 4d8d745c8..f3d7ffa7f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -5,7 +5,6 @@ title: Reject Unsigned Commits in GitLab Project # Reject Unsigned Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-unsigned-commits` -**Uses:** `gitlab/project/reject-unsigned-commits@v2/rules` **Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml) **Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego) **Labels:** Blueprint, Gitlab, Project @@ -13,7 +12,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 0bcbea9e7..4b4e1b9e2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -5,7 +5,6 @@ title: Require Password for Approvals in GitLab Project # Require Password for Approvals in GitLab Project **Type:** Rule **ID:** `gitlab-project-require-password-to-approve` -**Uses:** `gitlab/project/require-password-to-approve@v2/rules` **Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml) **Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 446d41f0a..551fdfe42 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -5,7 +5,6 @@ title: Require Minimal Approvers in GitLab Project # Require Minimal Approvers in GitLab Project **Type:** Rule **ID:** `gitlab-project-required-minimal-approvers` -**Uses:** `gitlab/project/required-minimal-approvers@v2/rules` **Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml) **Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 2cede0d5c..070835191 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -5,7 +5,6 @@ title: Reset Approvals on Push in GitLab Project # Reset Approvals on Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-reset-pprovals-on-push` -**Uses:** `gitlab/project/reset-pprovals-on-push@v2/rules` **Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) **Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 4f945318a..d25cd30ae 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -5,7 +5,6 @@ title: Ensure SAST Scanning Passes # Ensure SAST Scanning Passes **Type:** Rule **ID:** `gitlab-project-sast-scan-pass` -**Uses:** `gitlab/project/sast-scan-pass@v2/rules` **Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml) **Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 35fef07cb..1d17f8255 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -5,7 +5,6 @@ title: Run SAST Scanning in GitLab Project # Run SAST Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-sast-scanning` -**Uses:** `gitlab/project/sast-scanning@v2/rules` **Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml) **Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 8cd54fb8e..4b0f92e2f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -5,7 +5,6 @@ title: Ensure Secrets Scanning Passes # Ensure Secrets Scanning Passes **Type:** Rule **ID:** `gitlab-project-secrets-scan-pass` -**Uses:** `gitlab/project/secrets-scan-pass@v2/rules` **Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml) **Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index b6f9323ef..27f7be669 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -5,7 +5,6 @@ title: Run Secrets Scanning in GitLab Project # Run Secrets Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-secrets-scanning` -**Uses:** `gitlab/project/secrets-scanning@v2/rules` **Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml) **Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 10e339523..4947c4d7f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -5,7 +5,6 @@ title: Restrict Selective Code Owner Removals in GitLab # Restrict Selective Code Owner Removals in GitLab **Type:** Rule **ID:** `gitlab-project-selective-code-owner-removals` -**Uses:** `gitlab/project/selective-code-owner-removals@v2/rules` **Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml) **Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 56ba542ea..93e8da37a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -5,7 +5,6 @@ title: Set Visibility Level in GitLab Project # Set Visibility Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-project-visibility-level` -**Uses:** `gitlab/project/visibility-check@v2/rules` **Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml) **Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego) **Labels:** Gitlab, Project @@ -13,7 +12,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index c3d388068..6d634f65a 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -5,7 +5,6 @@ title: Allowed Base Image # Allowed Base Image **Type:** Rule **ID:** `images-allowed-base-image` -**Uses:** `images/allowed-base-image@v2/rules` **Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml) **Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) **Labels:** SBOM, Images @@ -17,7 +16,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 602abe860..db698f395 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -5,7 +5,6 @@ title: Allowed Main Image Source # Allowed Main Image Source **Type:** Rule **ID:** `images-allowed-image-source` -**Uses:** `images/allowed-image-source@v2/rules` **Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml) **Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego) **Labels:** SBOM, Images @@ -14,7 +13,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 37ad6ed31..75931681b 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -5,7 +5,6 @@ title: Banned Ports # Banned Ports **Type:** Rule **ID:** `images-banned-ports` -**Uses:** `images/banned-ports@v2/rules` **Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml) **Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) **Labels:** SBOM, Images @@ -16,7 +15,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index b0ac82c5e..44c954d67 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -5,7 +5,6 @@ title: Disallow Specific Users in SBOM # Disallow Specific Users in SBOM **Type:** Rule **ID:** `sbom-disallowed-users` -**Uses:** `images/banned-users@v2/rules` **Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml) **Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego) **Labels:** SBOM, Image @@ -13,7 +12,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 5506692dc..46a08b9e4 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -5,7 +5,6 @@ title: Restrict Build Scripts # Restrict Build Scripts **Type:** Rule **ID:** `images-disallowed-build-script` -**Uses:** `images/blocklist-build-scripts@v2/rules` **Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml) **Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 8ead1a091..ec4a36a37 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -5,7 +5,6 @@ title: Registry Connection HTTPS # Registry Connection HTTPS **Type:** Rule **ID:** `images-registry-https-check` -**Uses:** `images/enforce-https-registry@v2/rules` **Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml) **Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego) **Labels:** Registry, Images @@ -14,7 +13,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 4cac5c3dc..594222fd6 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -5,7 +5,6 @@ title: Forbid Large Images # Forbid Large Images **Type:** Rule **ID:** `images-project-large-image` -**Uses:** `images/forbid-large-images@v2/rules` **Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml) **Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index efea01d97..064ced39d 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -5,7 +5,6 @@ title: Fresh Base Image # Fresh Base Image **Type:** Rule **ID:** `images-fresh-base-image` -**Uses:** `images/fresh-base-image@v2/rules` **Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml) **Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego) **Labels:** SBOM, Images @@ -14,7 +13,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 019c85073..1db34faec 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -5,7 +5,6 @@ title: Fresh Image # Fresh Image **Type:** Rule **ID:** `fresh-image` -**Uses:** `images/fresh-image@v2/rules` **Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml) **Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index e14d1b397..e4aa92051 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -5,7 +5,6 @@ title: Require Signed Container Image # Require Signed Container Image **Type:** Rule **ID:** `images-require-signed-image` -**Uses:** `images/image-signed@v2/rules` **Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml) **Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego) **Labels:** Images, Blueprint @@ -14,7 +13,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 5a07f96ff..65a5a3e73 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -5,7 +5,6 @@ title: Require Healthcheck # Require Healthcheck **Type:** Rule **ID:** `images-require-healthcheck` -**Uses:** `images/require-healthcheck@v2/rules` **Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml) **Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego) **Labels:** SBOM, Images @@ -14,7 +13,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 7240bd0fd..04b60aa2a 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -5,7 +5,6 @@ title: Disallow Container Shell Entrypoint # Disallow Container Shell Entrypoint **Type:** Rule **ID:** `images-disallow-shell-access` -**Uses:** `images/restrict-shell-entrypoint@v2/rules` **Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml) **Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 853cafa03..04ce31753 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -5,7 +5,6 @@ title: Require Image Labels # Require Image Labels **Type:** Rule **ID:** `required-image-labels` -**Uses:** `images/verify-labels-exist@v2/rules` **Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml) **Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 965c1ff95..727fe0a99 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -5,7 +5,6 @@ title: Verify Image Labels # Verify Image Labels **Type:** Rule **ID:** `image-labels` -**Uses:** `images/verify-labels@v2/rules` **Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml) **Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego) **Labels:** SBOM, Images @@ -13,7 +12,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index b1f7925b5..b0fa24114 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -5,7 +5,6 @@ title: Verify Exposed Credentials # Verify Exposed Credentials **Type:** Rule **ID:** `jenkins-exposed-credentials` -**Uses:** `jenkins/folder/exposed-credentials@v2/rules` **Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml) **Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego) **Labels:** Jenkins, Folder @@ -13,7 +12,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 8220a73bc..9c20b26d6 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -5,7 +5,6 @@ title: Verify Inactive Users # Verify Inactive Users **Type:** Rule **ID:** `jenkins-inactive-users` -**Uses:** `jenkins/instance/inactive-users@v2/rules` **Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml) **Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego) **Labels:** Jenkins, Instance @@ -13,7 +12,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index d9d7e37d6..64d220a56 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -5,7 +5,6 @@ title: Disallow Unused Users # Disallow Unused Users **Type:** Rule **ID:** `jenkins-unused-users` -**Uses:** `jenkins/instance/unused-users@v2/rules` **Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml) **Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego) **Labels:** Jenkins, Instance @@ -13,7 +12,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 021754215..d093613e4 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -5,7 +5,6 @@ title: Allowed Container Images # Allowed Container Images **Type:** Rule **ID:** `k8s-namespace-blocked-images` -**Uses:** `k8s/namespace/allowed-images@v2/rules` **Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml) **Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 7f21e779d..89675409e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -5,7 +5,6 @@ title: Allowed Namespace Registries # Allowed Namespace Registries **Type:** Rule **ID:** `k8s-namespace-allowed-registries` -**Uses:** `k8s/namespace/allowed-registries@v2/rules` **Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml) **Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 790853f93..26d7b3f21 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -5,7 +5,6 @@ title: Verify Namespace Runtime Duration # Verify Namespace Runtime Duration **Type:** Rule **ID:** `k8s-namespace-verify-namespace-duration` -**Uses:** `k8s/namespace/verify-namespace-duration@v2/rules` **Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml) **Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 2e7c91285..a17d75823 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -5,7 +5,6 @@ title: Verify Namespace Termination # Verify Namespace Termination **Type:** Rule **ID:** `k8s-namespace-verify-namespace-termination` -**Uses:** `k8s/namespace/verify-namespace-termination@v2/rules` **Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml) **Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index ba5b79c8d..7e41bc992 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -5,7 +5,6 @@ title: Allowed Namespaces # Allowed Namespaces **Type:** Rule **ID:** `k8s-namespace-white-listed-namespaces` -**Uses:** `k8s/namespace/white-listed-namespaces@v2/rules` **Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml) **Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index f25805e33..2d55d651a 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -5,7 +5,6 @@ title: Allowed Pods in Namespace # Allowed Pods in Namespace **Type:** Rule **ID:** `k8s-namespace-white-listed-pod` -**Uses:** `k8s/namespace/white-listed-pod@v2/rules` **Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml) **Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego) **Labels:** K8s, Namespace @@ -13,7 +12,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 80168c2cf..0a0db38ee 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -5,7 +5,6 @@ title: Verify Pod Runtime Duration # Verify Pod Runtime Duration **Type:** Rule **ID:** `k8s-pods-verify-pod-duration` -**Uses:** `k8s/pods/verify-pod-duration@v2/rules` **Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml) **Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego) **Labels:** K8s, Pod @@ -13,7 +12,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index e92c72314..48ae71a0c 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -5,7 +5,6 @@ title: Verify Pod Termination # Verify Pod Termination **Type:** Rule **ID:** `k8s-pods-verify-pod-termination` -**Uses:** `k8s/pods/verify-pod-termination@v2/rules` **Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml) **Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego) **Labels:** K8s, Pod @@ -13,7 +12,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 42c13d9f5..17e7462e8 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -5,7 +5,6 @@ title: Allowed Pods # Allowed Pods **Type:** Rule **ID:** `k8s-pods-white-listed-pod` -**Uses:** `k8s/pods/white-listed-pod@v2/rules` **Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml) **Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego) **Labels:** K8s, Pod @@ -13,7 +12,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index aa7ab9a2a..fa6c0b2bd 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -5,7 +5,6 @@ title: Verify File Integrity # Verify File Integrity **Type:** Rule **ID:** `file-integrity` -**Uses:** `multievidence/files_integrity@v2/rules` **Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) **Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) **Labels:** SBOM @@ -13,7 +12,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index b3f366e6c..c3480fabc 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -5,7 +5,6 @@ title: Verify Artifact Signature Using SARIF Report # Verify Artifact Signature Using SARIF Report **Type:** Rule **ID:** `sarif-artifact-signed` -**Uses:** `sarif/artifact-signed@v2/rules` **Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 0152a2397..d964e62af 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -5,7 +5,6 @@ title: Verify Required Evidence in SARIF # Verify Required Evidence in SARIF **Type:** Rule **ID:** `required-sarif-evidence` -**Uses:** `sarif/evidence-exists@v2/rules` **Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index a64e7d4ec..abb7b62cd 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -5,7 +5,6 @@ title: SARIF Update Needed # SARIF Update Needed **Type:** Rule **ID:** `sarif-update-needed` -**Uses:** `sarif/patcheck/updates-needed@v2/rules` **Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml) **Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index ff5091e83..b5c0cb8cd 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -5,7 +5,6 @@ title: Verify IaC Misconfiguration Threshold in SARIF # Verify IaC Misconfiguration Threshold in SARIF **Type:** Rule **ID:** `sarif-iac-findings` -**Uses:** `sarif/report-iac-errors@v2/rules` **Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml) **Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 6c3d45eb6..01dc70227 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -5,7 +5,6 @@ title: Trivy Blocklist CVE Check # Trivy Blocklist CVE Check **Type:** Rule **ID:** `trivy-blocklist-cve` -**Uses:** `sarif/trivy/blocklist-cve@v2/rules` **Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml) **Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example @@ -14,7 +13,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index b308b98c0..fc97b9858 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -5,7 +5,6 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF # Verify IaC Misconfiguration Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-iac-findings` -**Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` **Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) **Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example @@ -14,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 023c90fa1..f81c69280 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -5,7 +5,6 @@ title: Trivy Vulnerability Findings Check # Trivy Vulnerability Findings Check **Type:** Rule **ID:** `trivy-verify-vulnerability-findings` -**Uses:** `sarif/trivy/verify-cve-severity@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml) **Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example @@ -16,7 +15,7 @@ the defined severity threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 72a3eac65..54d336702 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -5,7 +5,6 @@ title: Verify Attack Vector Threshold in Trivy SARIF # Verify Attack Vector Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-attack-vectors` -**Uses:** `sarif/trivy/verify-trivy-attack-vector@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) **Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego) **Labels:** SARIF, Trivy @@ -13,7 +12,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 43f6ee033..f1c198303 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -5,7 +5,6 @@ title: Verify Trivy SARIF Report Compliance # Verify Trivy SARIF Report Compliance **Type:** Rule **ID:** `trivy-report` -**Uses:** `sarif/trivy/verify-trivy-report@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml) **Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example @@ -14,7 +13,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 8589ad963..ec085bbf8 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -5,7 +5,6 @@ title: Verify Attack Vector Exists in SARIF # Verify Attack Vector Exists in SARIF **Type:** Rule **ID:** `sarif-attack-vectors` -**Uses:** `sarif/verify-attack-vector@v2/rules` **Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml) **Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index fce291346..b9d1677ad 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -5,7 +5,6 @@ title: Verify Rule Compliance in SARIF # Verify Rule Compliance in SARIF **Type:** Rule **ID:** `sarif-policy` -**Uses:** `sarif/verify-sarif@v2/rules` **Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml) **Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 8bf560212..98994825d 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -5,7 +5,6 @@ title: Verify Semgrep Rule in SARIF # Verify Semgrep Rule in SARIF **Type:** Rule **ID:** `sarif-semgrep-report` -**Uses:** `sarif/verify-semgrep-report@v2/rules` **Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) **Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) **Labels:** SARIF, Semgrep @@ -13,7 +12,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index feef1846e..a226b55f9 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -5,7 +5,6 @@ title: Verify Tool Evidence in SARIF # Verify Tool Evidence in SARIF **Type:** Rule **ID:** `sarif-tool-evidence` -**Uses:** `sarif/verify-tool-evidence@v2/rules` **Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml) **Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego) **Labels:** SARIF @@ -13,7 +12,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index eaf1aafb9..848936c2c 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -5,7 +5,6 @@ title: NTIA SBOM Compliance Check # NTIA SBOM Compliance Check **Type:** Rule **ID:** `NTIA-compliance` -**Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) **Labels:** SBOM, Compliance, Image, Git @@ -14,7 +13,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 7ba337691..3911c25d6 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -5,7 +5,6 @@ title: Enforce Allowed SBOM Components # Enforce Allowed SBOM Components **Type:** Rule **ID:** `sbom-allowed-components` -**Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) **Labels:** SBOM, Image, Git @@ -13,7 +12,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 7f3625136..d5c073b1b 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -5,7 +5,6 @@ title: Require SBOM Signature # Require SBOM Signature **Type:** Rule **ID:** `sbom-signed` -**Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) **Labels:** SBOM, Blueprint, Git @@ -13,7 +12,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 70f54874e..4dc58a690 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -5,7 +5,6 @@ title: Restrict Disallowed SBOM Licenses # Restrict Disallowed SBOM Licenses **Type:** Rule **ID:** `sbom-disallowed-licenses` -**Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) **Labels:** SBOM, Image, Git @@ -13,7 +12,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 6b82d82a6..1c619722a 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -5,7 +5,6 @@ title: Restrict Disallowed Dependencies # Restrict Disallowed Dependencies **Type:** Rule **ID:** `sbom-disallow-dependencies` -**Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) **Labels:** SBOM, Image, Blueprint, Git @@ -13,7 +12,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 4dd076f7e..0dd812234 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -5,7 +5,6 @@ title: Enforce SBOM License Completeness # Enforce SBOM License Completeness **Type:** Rule **ID:** `sbom-require-complete-license-set` -**Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) **Labels:** SBOM, Image, Git @@ -13,7 +12,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index 6473f58a2..a6c8a78fe 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -5,7 +5,6 @@ title: Enforce SBOM Freshness # Enforce SBOM Freshness **Type:** Rule **ID:** `fresh-sbom` -**Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) **Labels:** SBOM, Image, Git @@ -13,7 +12,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 6a4c1c43c..9d31dc49c 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -5,7 +5,6 @@ title: Require SBOM Existence # Require SBOM Existence **Type:** Rule **ID:** `require-sbom` -**Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) **Labels:** SBOM, Blueprint, Image, Git @@ -13,7 +12,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 846c40697..8048b8332 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -5,7 +5,6 @@ title: Enforce SBOM Dependencies # Enforce SBOM Dependencies **Type:** Rule **ID:** `sbom-required-dependencies` -**Uses:** `sbom/required-packages@v2/rules` **Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml) **Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) **Labels:** SBOM, Image @@ -13,7 +12,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index 099a6bfa4..ea5b11952 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -5,7 +5,6 @@ title: Require Specified SBOM Licenses # Require Specified SBOM Licenses **Type:** Rule **ID:** `sbom-hf-license` -**Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) **Labels:** SBOM, Image, Git @@ -13,7 +12,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index a3faf9a4b..1c1d44f4f 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -5,7 +5,6 @@ title: Disallow dependencies in SLSA Provenance Document # Disallow dependencies in SLSA Provenance Document **Type:** Rule **ID:** `slsa-builder-unallowed-dependencies` -**Uses:** `slsa/banned-builder-deps@v2/rules` **Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml) **Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego) **Labels:** SLSA, Image @@ -13,7 +12,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index a2571e4fb..84443b498 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -5,7 +5,6 @@ title: Verify build time # Verify build time **Type:** Rule **ID:** `slsa-build-time` -**Uses:** `slsa/build-time@v2/rules` **Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml) **Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego) **Labels:** SLSA, Image @@ -13,7 +12,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 54174b058..e0bfea3b8 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -5,7 +5,6 @@ title: SLSA Field Exists in Provenance Document # SLSA Field Exists in Provenance Document **Type:** Rule **ID:** `slsa-field-exists` -**Uses:** `slsa/field-exists@v2/rules` **Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml) **Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego) **Labels:** SLSA, Image @@ -13,7 +12,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index e7ac74d2e..86f1244cd 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -5,7 +5,6 @@ title: Verify Provenance Document Exists # Verify Provenance Document Exists **Type:** Rule **ID:** `SLSA.L1` -**Uses:** `slsa/l1-provenance-exists@v2/rules` **Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml) **Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego) **Help:** https://slsa.dev/spec/v1.0/requirements @@ -14,7 +13,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index c5ae4854a..6be915c55 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -5,7 +5,6 @@ title: Verify that provenance is authenticated # Verify that provenance is authenticated **Type:** Rule **ID:** `SLSA.L2` -**Uses:** `slsa/l2-provenance-authenticated@v2/rules` **Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml) **Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego) **Help:** https://slsa.dev/spec/v1.0/requirements @@ -14,7 +13,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index eb893329c..55ecede25 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -5,7 +5,6 @@ title: Verify that artifact was created by the specified builder # Verify that artifact was created by the specified builder **Type:** Rule **ID:** `slsa-verify-builder` -**Uses:** `slsa/verify-builder@v2/rules` **Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml) **Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego) **Labels:** SLSA, Image @@ -13,7 +12,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 6f473f3ab..c5ed5e430 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -5,7 +5,6 @@ title: Verify that artifact has no disallowed builder dependencies # Verify that artifact has no disallowed builder dependencies **Type:** Rule **ID:** `slsa-verify-byproducts` -**Uses:** `slsa/verify-byproducts@v2/rules` **Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml) **Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego) **Labels:** SLSA, Image @@ -13,7 +12,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index fe5305fbf..53f8731f8 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -5,14 +5,13 @@ title: Enforce 2FA # Enforce 2FA **Type:** Rule **ID:** `PS.1.1` -**Uses:** `ssdf/ps-1-2fa@v2/rules` **Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) **Labels:** SSDF PS.1 Require 2FA for accessing code :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 654867b98..9f23a8ac5 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -5,14 +5,13 @@ title: Branch protected # Branch protected **Type:** Rule **ID:** `PS.1.2` -**Uses:** `ssdf/ps-1-branch-protection@v2/rules` **Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) **Labels:** SSDF PS.1 Require branch protection for the repository :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index e4c8fcac6..dfac15c63 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -5,14 +5,13 @@ title: Limit admins # Limit admins **Type:** Rule **ID:** `PS.1.3` -**Uses:** `ssdf/ps-1-limit-admins@v2/rules` **Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) **Labels:** SSDF PS.1 Restrict the maximum number of organization admins :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index 45592d4a8..b2e8d4604 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -5,14 +5,13 @@ title: Repo private # Repo private **Type:** Rule **ID:** `PS.1.4` -**Uses:** `ssdf/ps-1-repo-private@v2/rules` **Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) **Labels:** SSDF PS.1 Assure the repository is private :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 4a1cdc2d1..c238474c6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -5,14 +5,13 @@ title: Require signoff on web commits # Require signoff on web commits **Type:** Rule **ID:** `PS.1.5` -**Uses:** `ssdf/ps-1-web-commit-signoff@v2/rules` **Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) **Labels:** SSDF PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index fea0b86b9..33875b4f5 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -5,14 +5,13 @@ title: Image-verifiable # Image-verifiable **Type:** Rule **ID:** `PS.2` -**Uses:** `ssdf/ps-2-image-verifiable@v2/rules` **Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) **Labels:** SSDF PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 45732acb1..55949571f 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -5,7 +5,6 @@ title: Code archived # Code archived **Type:** Rule **ID:** `PS.3.1` -**Uses:** `ssdf/ps-3.1-code-archived@v2/rules` **Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) **Labels:** SSDF @@ -14,7 +13,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index ea77fc9bc..9ec173cac 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -5,14 +5,13 @@ title: SBOM archived # SBOM archived **Type:** Rule **ID:** `PS.3.2` -**Uses:** `ssdf/ps-3.2-archived-sbom@v2/rules` **Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) **Labels:** SSDF PS.3.2 Archive SBOM :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/index.md b/docs/configuration/v2/initiatives/index.md index ba1766169..1109250b0 100644 --- a/docs/configuration/v2/initiatives/index.md +++ b/docs/configuration/v2/initiatives/index.md @@ -2,6 +2,7 @@ ## Initiatives + | Name | Description | |------|-------------| | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | @@ -14,7 +15,7 @@ ## Rules ### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -31,7 +32,7 @@ | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | ### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -54,7 +55,7 @@ | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -65,7 +66,7 @@ | [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | ### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| @@ -85,7 +86,7 @@ | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| @@ -93,52 +94,8 @@ | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | | [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | -### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | - -### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | - -### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | - -### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | - -### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | - ### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -165,7 +122,7 @@ | [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | ### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -187,7 +144,7 @@ | [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -204,7 +161,7 @@ | [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | ### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -247,16 +204,8 @@ | [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | | [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | -### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | - ### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -268,7 +217,7 @@ | [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -276,8 +225,60 @@ | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | | [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + ### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| @@ -290,7 +291,7 @@ | [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | ### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md index 934bbbca8..c1ba16d05 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md index dbb386d93..983c5435e 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md index 37aea5ed6..62d43c15d 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -13,7 +13,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md index 99a423104..0517e7123 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -13,7 +13,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md index 8cbf7fb47..60b5b816a 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md index 7a22799b1..680ef7efe 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md index 825dfc978..fee4f98b3 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md index 5d8a857ef..558d1906f 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md index 0e43f2b70..e0abc14d0 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md index b01b31533..77fc5c93a 100644 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md @@ -13,7 +13,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md index 3ded9c542..c82c75f4d 100644 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md @@ -13,7 +13,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md index 2917b47ef..6c30ed128 100644 --- a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md @@ -13,7 +13,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md index 22221a0fe..bfb57f1cb 100644 --- a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md index 39afd1720..ca71fa137 100644 --- a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md @@ -13,7 +13,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md index 73b40dd7d..dc1a90282 100644 --- a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md @@ -12,7 +12,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md index 2f1aa7b81..03dfef58d 100644 --- a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md @@ -13,7 +13,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md index 4f9444ff5..16f2b779c 100644 --- a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md @@ -13,7 +13,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md index 7348f614a..c8aea5f96 100644 --- a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md @@ -13,7 +13,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md index fc197b904..b8a4bbcd5 100644 --- a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md @@ -13,7 +13,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md index def24f262..1b384b1e4 100644 --- a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md @@ -13,7 +13,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/2fa.md b/docs/configuration/v2/initiatives/rules/github/org/2fa.md index 2a8488cf6..15a186faf 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/2fa.md @@ -13,7 +13,7 @@ title: Verify two_factor_requirement_enabled setting Verify `two_factor_requirement` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md index 6ed759530..742c68639 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md @@ -13,7 +13,7 @@ title: Verify advanced security setting is enabled Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md index 89599f795..608f815f4 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md index 988cf73ec..2fde637d1 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md index 209fd14b5..afedf6e13 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_private_repositories setting Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md index 64ce2379c..6aaf65911 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md @@ -13,7 +13,7 @@ title: Verify members_can_create_repositories setting Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md index 42e3a6efa..53bbc71ba 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md @@ -13,7 +13,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md index 22f3adb35..b0b7c0e97 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md index 7956e64d2..b1258bad5 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md @@ -13,7 +13,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md index 910faa028..62ba7a665 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md @@ -13,7 +13,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md index 85b2b2b69..ed0d6c16b 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md index 54b24f34d..fc4807948 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md index c2a6daea7..17c9f4d3f 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md index dc2bffe5d..7f28a1044 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Push_Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md index 33ff8c5f6..17ddf80c3 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md @@ -14,7 +14,7 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md index 44d6a2217..07ffd0bd8 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md @@ -13,7 +13,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md index 32bfe2a76..7f9763201 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md index 261afff50..115f3968b 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md index 78fda54b1..d29513abd 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md index 4c22fd1e4..278f1c115 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md @@ -13,7 +13,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md index 673c12709..2571db2f5 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md index b894a20a9..7031f1651 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md @@ -13,7 +13,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md index a405b1b16..d5be52f03 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md @@ -13,7 +13,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md index f5fd720a2..ea9be38be 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md index fdfd24a1b..3048999f4 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md @@ -13,7 +13,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md index 9492af752..cb3faf853 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md @@ -13,7 +13,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md index ba1382e7e..7acb8af9d 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -13,7 +13,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md index 3f8fe057f..a60a6900a 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md @@ -13,7 +13,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md index c9cf95629..d0fd82ac0 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md @@ -13,7 +13,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md index 5d2f5fd06..20e08b6c3 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md @@ -13,7 +13,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md index d863b1b53..68ef05b56 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md @@ -13,7 +13,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md index ed82a1378..56260d877 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md @@ -13,7 +13,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md index 6667f2a99..bbda6a024 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md @@ -13,7 +13,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md index d28625af9..145f69922 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md @@ -13,7 +13,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md index 7ab444790..2dc97ce94 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md @@ -13,7 +13,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md index bb2134616..35b3524d4 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md @@ -13,7 +13,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md index 99d0d29d9..4caa30e32 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md @@ -13,7 +13,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md index 47334c1ed..8eb5fb0cc 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md @@ -13,7 +13,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md index 807bf8507..4f8a57b91 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -13,7 +13,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md index 2081bf272..59e6f6132 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md @@ -13,7 +13,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md index 7db84cdc0..b940c90ba 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md @@ -13,7 +13,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md index dd4ee66ea..9d5e6899a 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md @@ -13,7 +13,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md index 87deffc1e..49c5a7dfd 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -13,7 +13,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md index af4e48288..a2743aa47 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md @@ -13,7 +13,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md index f40f63ed3..ad13786ea 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md @@ -13,7 +13,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md index 527965a58..52d146630 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md @@ -13,7 +13,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md index 9d1c66c97..939c9eb9f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md @@ -13,7 +13,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md index a5ebc847d..139cb5099 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md @@ -13,7 +13,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 9df82e5c5..c3373bc35 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -13,7 +13,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md index dbd3bf258..1a7f3f6d6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -13,7 +13,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md index df85b81e2..4ae45ffd2 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md @@ -13,7 +13,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md index efc49aae7..67dfcd21e 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -13,7 +13,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 52f269abd..2d662a08a 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -13,7 +13,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md index 3b4b06223..f9d8ac904 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md @@ -13,7 +13,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md index d60b4377b..324c4497b 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md @@ -13,7 +13,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md index 539c25e11..9c6565d9a 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md @@ -13,7 +13,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md index 13263990b..4ff4304be 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md @@ -13,7 +13,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md index 493e80d0c..897718cb6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -13,7 +13,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md index 253b6359c..15dedbbba 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -13,7 +13,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md index 43bf3f371..c32a08756 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md @@ -13,7 +13,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md index 86418c640..4cc1607b4 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md @@ -13,7 +13,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md index 3e4588c99..c53f445e1 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md @@ -13,7 +13,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md index b25f2f9bc..ec139e22f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md index 61a671818..fb89452d2 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md @@ -13,7 +13,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md index a1f26cb13..80839f0ae 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md index e9f46ed8a..7cbe2f86c 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md @@ -13,7 +13,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 84551fdec..81dd703ff 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -13,7 +13,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md index 206a299c2..226843f8c 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md @@ -13,7 +13,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md index d4adead00..6b88855d2 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -13,7 +13,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md index d8092c8cd..13627dc2d 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md @@ -13,7 +13,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md index e39c71110..bdc70884c 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md @@ -13,7 +13,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md index faa1a0cb7..ab5f51017 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -13,7 +13,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 298bd272d..107491f5f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -13,7 +13,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md index d36e50548..35c522b3c 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md @@ -13,7 +13,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md index 7df8bf61c..acad85cf4 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -13,7 +13,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md index 1162289a1..59698935a 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -13,7 +13,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md index 34f462a1c..e66deecc4 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md @@ -13,7 +13,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md index ff581119e..833713cb5 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md @@ -13,7 +13,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 4d8d745c8..780f94885 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -13,7 +13,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md index 0bcbea9e7..6bc79a287 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -13,7 +13,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md index 446d41f0a..e5b6d2191 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -13,7 +13,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 2cede0d5c..546c9c63d 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -13,7 +13,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md index 4f945318a..a23988b60 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md index 35fef07cb..0eb9eb28d 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md @@ -13,7 +13,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md index 8cd54fb8e..78cf9c536 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -13,7 +13,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md index b6f9323ef..810bbd477 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md @@ -13,7 +13,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 10e339523..30d6c42a5 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -13,7 +13,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md index 56ba542ea..c51b8c464 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md @@ -13,7 +13,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md index c3d388068..57edc0723 100644 --- a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md @@ -17,7 +17,7 @@ This rule requires Dockerfile context; for example, run it with: :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md index 602abe860..761170e55 100644 --- a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md @@ -14,7 +14,7 @@ Ensures the main container image referenced in the SBOM is from an approved sour :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/banned-ports.md b/docs/configuration/v2/initiatives/rules/images/banned-ports.md index 37ad6ed31..67c01b2c2 100644 --- a/docs/configuration/v2/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/v2/initiatives/rules/images/banned-ports.md @@ -16,7 +16,7 @@ It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/banned-users.md b/docs/configuration/v2/initiatives/rules/images/banned-users.md index b0ac82c5e..90eebb2e5 100644 --- a/docs/configuration/v2/initiatives/rules/images/banned-users.md +++ b/docs/configuration/v2/initiatives/rules/images/banned-users.md @@ -13,7 +13,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md index 5506692dc..bd0c3fb8e 100644 --- a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md @@ -13,7 +13,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md index 8ead1a091..1bbd6da22 100644 --- a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md @@ -14,7 +14,7 @@ Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md index 4cac5c3dc..b7a5d0e07 100644 --- a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md @@ -13,7 +13,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md index efea01d97..3c88f114e 100644 --- a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md @@ -14,7 +14,7 @@ Verifies that each base image is not older than the specified threshold (max_day :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-image.md index 019c85073..fc178cadd 100644 --- a/docs/configuration/v2/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/v2/initiatives/rules/images/fresh-image.md @@ -13,7 +13,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/image-signed.md b/docs/configuration/v2/initiatives/rules/images/image-signed.md index e14d1b397..b259a0354 100644 --- a/docs/configuration/v2/initiatives/rules/images/image-signed.md +++ b/docs/configuration/v2/initiatives/rules/images/image-signed.md @@ -14,7 +14,7 @@ Enforces that container images (target_type=container) are cryptographically sig :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md index 5a07f96ff..dd0382473 100644 --- a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md @@ -14,7 +14,7 @@ Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md index 7240bd0fd..785461656 100644 --- a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md @@ -13,7 +13,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md index 853cafa03..7b123def5 100644 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md @@ -13,7 +13,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels.md b/docs/configuration/v2/initiatives/rules/images/verify-labels.md index 965c1ff95..0bcd29c13 100644 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels.md @@ -13,7 +13,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md index b1f7925b5..62dc5203b 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -13,7 +13,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md index 8220a73bc..b0bc4951a 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md @@ -13,7 +13,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md index d9d7e37d6..b3d4503d2 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md @@ -13,7 +13,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md index 021754215..501d7953a 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md @@ -13,7 +13,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md index 7f21e779d..1db90d375 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md @@ -13,7 +13,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 790853f93..782dc2aa1 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -13,7 +13,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 2e7c91285..56cfc4b1f 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -13,7 +13,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md index ba5b79c8d..d9795dac1 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -13,7 +13,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md index f25805e33..ef3678c53 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md index 80168c2cf..9d8104046 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -13,7 +13,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md index e92c72314..af11c74e5 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -13,7 +13,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md index 42c13d9f5..74ba98e01 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md @@ -13,7 +13,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md index aa7ab9a2a..96fcbc0f3 100644 --- a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md @@ -13,7 +13,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md index b3f366e6c..0403f5c38 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md @@ -13,7 +13,7 @@ title: Verify Artifact Signature Using SARIF Report Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md index 0152a2397..dc21e8d62 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md @@ -13,7 +13,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md index a64e7d4ec..692c3a235 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md @@ -13,7 +13,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md index ff5091e83..a0b8ff5be 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md index 6c3d45eb6..c83dfa390 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -14,7 +14,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index b308b98c0..809af5970 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -14,7 +14,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md index 023c90fa1..130808329 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -16,7 +16,7 @@ the defined severity threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 72a3eac65..74cc89a1d 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md index 43f6ee033..09188371d 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -14,7 +14,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md index 8589ad963..a4bbd9807 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md @@ -13,7 +13,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md index fce291346..2815b687f 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md @@ -13,7 +13,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md index 8bf560212..cefc2845b 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md @@ -13,7 +13,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md index feef1846e..a394777fc 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md @@ -13,7 +13,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md index eaf1aafb9..b7130bbc8 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md @@ -14,7 +14,7 @@ Validates that SBOM metadata meets basic NTIA requirements for authors and suppl :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. diff --git a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md index 7ba337691..5d7fc6ea1 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md @@ -13,7 +13,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type diff --git a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md index 7f3625136..23acfa1c0 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md @@ -13,7 +13,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md index 70f54874e..4c4b74fb6 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md @@ -13,7 +13,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md index 6b82d82a6..a934656ed 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md @@ -13,7 +13,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md index 4dd076f7e..abb1f4f5b 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md @@ -13,7 +13,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md index 6473f58a2..370ce178d 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md @@ -13,7 +13,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md index 6a4c1c43c..a959dd86d 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md @@ -13,7 +13,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md index 846c40697..b887d7e6b 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md @@ -13,7 +13,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies specified as a list of PURLs. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md index 099a6bfa4..ec97f6551 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md @@ -13,7 +13,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) for more details. +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. diff --git a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md index a3faf9a4b..26f57432e 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md @@ -13,7 +13,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/slsa/build-time.md b/docs/configuration/v2/initiatives/rules/slsa/build-time.md index a2571e4fb..571595d85 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/v2/initiatives/rules/slsa/build-time.md @@ -13,7 +13,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md index 54174b058..8892d5d2f 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md @@ -13,7 +13,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md index e7ac74d2e..56291ff0e 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md @@ -14,7 +14,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md index c5ae4854a..3b9bb1411 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -14,7 +14,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md index eb893329c..a69d195fd 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md @@ -13,7 +13,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md index 6f473f3ab..628610063 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md @@ -13,7 +13,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md index fe5305fbf..f84ae4836 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md @@ -12,7 +12,7 @@ title: Enforce 2FA PS.1 Require 2FA for accessing code :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md index 654867b98..92ba07249 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -12,7 +12,7 @@ title: Branch protected PS.1 Require branch protection for the repository :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md index e4c8fcac6..6ecb48c36 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -12,7 +12,7 @@ title: Limit admins PS.1 Restrict the maximum number of organization admins :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md index 45592d4a8..11502a208 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md @@ -12,7 +12,7 @@ title: Repo private PS.1 Assure the repository is private :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 4a1cdc2d1..533da72f4 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -12,7 +12,7 @@ title: Require signoff on web commits PS.1 Require contributors to sign when committing to Github through the web interface :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md index fea0b86b9..7b217e8a0 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -12,7 +12,7 @@ title: Image-verifiable PS.2 Provide a mechanism to verify the integrity of the image :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md index 45732acb1..509acc548 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -14,7 +14,7 @@ We assume running in Github thus the code is allways stored in a repository :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index ea77fc9bc..6537b2e59 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -12,7 +12,7 @@ title: SBOM archived PS.3.2 Archive SBOM :::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) for more details. +This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. From b3b8c8e1b8025980e6a39d6f792fb9f62881ff47 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:31:06 +0200 Subject: [PATCH 144/191] update index location --- .../rules/api/scribe-api-cve-product.md | 1 - .../initiatives/rules/api/scribe-api-cve.md | 1 - .../rules/api/scribe-api-published.md | 1 - .../v2/initiatives/rules/api/scribe-api.md | 1 - .../rules/bitbucket/project/allow-admins.md | 1 - .../rules/bitbucket/project/allow-users.md | 1 - .../bitbucket/project/exposed-credentials.md | 1 - .../bitbucket/project/long-live-tokens.md | 1 - .../bitbucket/repository/allow-admins.md | 1 - .../rules/bitbucket/repository/allow-users.md | 1 - .../bitbucket/repository/branch-protection.md | 1 - .../rules/bitbucket/workspace/allow-admins.md | 1 - .../rules/bitbucket/workspace/allow-users.md | 1 - .../rules/dockerhub/token-expiration.md | 1 - .../rules/dockerhub/token-not-used.md | 1 - .../rules/generic/artifact-signed.md | 1 - .../rules/generic/evidence-exists.md | 1 - .../rules/generic/k8s-jailbreak.md | 1 - .../initiatives/rules/generic/trivy-exists.md | 1 - .../initiatives/rules/git/artifact-signed.md | 1 - .../rules/git/coding-permissions.md | 1 - .../initiatives/rules/git/evidence-exists.md | 1 - .../rules/git/no-commit-to-main.md | 1 - .../rules/git/no-unsigned-commits.md | 1 - .../rules/github/api/branch-protection.md | 1 - .../rules/github/api/signed-commits-list.md | 1 - .../rules/github/api/signed-commits-range.md | 1 - .../v2/initiatives/rules/github/org/2fa.md | 1 - .../rules/github/org/advanced-security.md | 1 - .../rules/github/org/allow-admins.md | 1 - .../rules/github/org/allow-users.md | 1 - .../rules/github/org/create-private-repos.md | 1 - .../rules/github/org/create-repos.md | 1 - .../rules/github/org/dependabot-alerts.md | 1 - .../org/dependabot-security-updates-sa.md | 1 - .../github/org/dependabot-security-updates.md | 1 - .../rules/github/org/dependency-graph.md | 1 - .../rules/github/org/max-admins.md | 1 - .../rules/github/org/old-secrets.md | 1 - .../rules/github/org/pp-custom-link.md | 1 - .../rules/github/org/push-protection-sa.md | 1 - .../rules/github/org/push-protection.md | 1 - .../rules/github/org/repo-visibility.md | 1 - .../rules/github/org/secret-scanning-sa.md | 1 - .../rules/github/org/secret-scanning.md | 1 - .../rules/github/org/validity-checks-sa.md | 1 - .../rules/github/org/validity-checks.md | 1 - .../rules/github/org/web-commit-signoff.md | 1 - .../github/repository/branch-protection.md | 1 - .../github/repository/branch-verification.md | 1 - .../github/repository/check-signed-commits.md | 1 - .../repository/default-branch-protection.md | 1 - .../rules/github/repository/dependabot.md | 1 - .../repository/ephemeral-runners-only.md | 1 - .../rules/github/repository/no-cache-usage.md | 1 - .../rules/github/repository/no-org-secrets.md | 1 - .../rules/github/repository/old-secrets.md | 1 - .../github/repository/push-protection.md | 1 - .../rules/github/repository/repo-private.md | 1 - .../github/repository/secret-scanning.md | 1 - .../rules/github/repository/signed-commits.md | 1 - .../github/repository/validity-checks.md | 1 - .../rules/github/repository/visibility.md | 1 - .../github/repository/web-commit-signoff.md | 1 - .../rules/gitlab/api/push-rules.md | 1 - .../rules/gitlab/api/signed-commits-list.md | 1 - .../rules/gitlab/api/signed-commits-range.md | 1 - .../rules/gitlab/org/allow-admins.md | 1 - .../rules/gitlab/org/allow-token-scopes.md | 1 - .../rules/gitlab/org/allow-users.md | 1 - .../rules/gitlab/org/blocked-users.md | 1 - .../rules/gitlab/org/expiring-tokens.md | 1 - .../rules/gitlab/org/forbid-token-scopes.md | 1 - .../rules/gitlab/org/inactive-projects.md | 1 - .../rules/gitlab/org/longlive-tokens.md | 1 - .../rules/gitlab/org/max-admins.md | 1 - .../rules/gitlab/org/projects-visibility.md | 1 - .../rules/gitlab/org/unused-tokens.md | 1 - .../gitlab/pipeline/verify-labels-exist.md | 1 - .../rules/gitlab/pipeline/verify-labels.md | 1 - .../rules/gitlab/project/abandoned-project.md | 1 - .../gitlab/project/approvals-policy-check.md | 1 - .../project/approvers-per-merge-request.md | 1 - .../gitlab/project/author-email-regex.md | 1 - .../rules/gitlab/project/check-cwe.md | 1 - .../gitlab/project/check-signed-commits.md | 1 - .../gitlab/project/co-approval-required.md | 1 - .../project/commit-author-email-check.md | 1 - .../project/commit-author-name-check.md | 1 - .../gitlab/project/commit-committer-check.md | 1 - .../gitlab/project/commit-message-check.md | 1 - .../rules/gitlab/project/commits-validated.md | 1 - .../gitlab/project/committer-email-check.md | 1 - .../gitlab/project/committer-name-check.md | 1 - .../gitlab/project/critical-severity-limit.md | 1 - .../project/description-substring-check.md | 1 - .../project/disallowed-banned-approvers.md | 1 - .../gitlab/project/force-push-protection.md | 1 - .../gitlab/project/medium-severity-limit.md | 1 - .../rules/gitlab/project/member-check.md | 1 - .../gitlab/project/merge-access-level.md | 1 - .../project/merge-requests-author-approval.md | 1 - ...ge-requests-disable-committers-approval.md | 1 - .../gitlab/project/message-substring-check.md | 1 - .../gitlab/project/prevent-secrets-check.md | 1 - .../gitlab/project/protect-ci-secrets.md | 1 - .../rules/gitlab/project/push-access-level.md | 1 - .../rules/gitlab/project/push-rules-set.md | 1 - .../gitlab/project/reject-unsigned-commits.md | 1 - .../project/require-password-to-approve.md | 1 - .../project/required-minimal-approvers.md | 1 - .../gitlab/project/reset-pprovals-on-push.md | 1 - .../rules/gitlab/project/sast-scan-pass.md | 1 - .../rules/gitlab/project/sast-scanning.md | 1 - .../rules/gitlab/project/secrets-scan-pass.md | 1 - .../rules/gitlab/project/secrets-scanning.md | 1 - .../project/selective-code-owner-removals.md | 1 - .../rules/gitlab/project/visibility-check.md | 1 - .../rules/images/allowed-base-image.md | 1 - .../rules/images/allowed-image-source.md | 1 - .../initiatives/rules/images/banned-ports.md | 1 - .../initiatives/rules/images/banned-users.md | 1 - .../rules/images/blocklist-build-scripts.md | 1 - .../rules/images/enforce-https-registry.md | 1 - .../rules/images/forbid-large-images.md | 1 - .../rules/images/fresh-base-image.md | 1 - .../initiatives/rules/images/fresh-image.md | 1 - .../initiatives/rules/images/image-signed.md | 1 - .../rules/images/require-healthcheck.md | 1 - .../rules/images/restrict-shell-entrypoint.md | 1 - .../rules/images/verify-labels-exist.md | 1 - .../initiatives/rules/images/verify-labels.md | 1 - .../jenkins/folder/exposed-credentials.md | 1 - .../rules/jenkins/instance/inactive-users.md | 1 - .../rules/jenkins/instance/unused-users.md | 1 - .../rules/k8s/namespace/allowed-images.md | 1 - .../rules/k8s/namespace/allowed-registries.md | 1 - .../namespace/verify-namespace-duration.md | 1 - .../namespace/verify-namespace-termination.md | 1 - .../k8s/namespace/white-listed-namespaces.md | 1 - .../rules/k8s/namespace/white-listed-pod.md | 1 - .../rules/k8s/pods/verify-pod-duration.md | 1 - .../rules/k8s/pods/verify-pod-termination.md | 1 - .../rules/k8s/pods/white-listed-pod.md | 1 - .../rules/multievidence/files_integrity.md | 1 - .../rules/sarif/artifact-signed.md | 1 - .../rules/sarif/evidence-exists.md | 1 - .../rules/sarif/patcheck/updates-needed.md | 1 - .../rules/sarif/report-iac-errors.md | 1 - .../rules/sarif/trivy/blocklist-cve.md | 1 - .../sarif/trivy/report-trivy-iac-errors.md | 1 - .../rules/sarif/trivy/verify-cve-severity.md | 1 - .../sarif/trivy/verify-trivy-attack-vector.md | 1 - .../rules/sarif/trivy/verify-trivy-report.md | 1 - .../rules/sarif/verify-attack-vector.md | 1 - .../initiatives/rules/sarif/verify-sarif.md | 1 - .../rules/sarif/verify-semgrep-report.md | 1 - .../rules/sarif/verify-tool-evidence.md | 1 - .../initiatives/rules/sbom/NTIA-compliance.md | 1 - .../rules/sbom/allowed-components.md | 1 - .../initiatives/rules/sbom/artifact-signed.md | 1 - .../initiatives/rules/sbom/banned-licenses.md | 1 - .../rules/sbom/blocklist-packages.md | 1 - .../rules/sbom/complete-licenses.md | 1 - .../v2/initiatives/rules/sbom/fresh-sbom.md | 1 - .../v2/initiatives/rules/sbom/require-sbom.md | 1 - .../rules/sbom/required-packages.md | 1 - .../rules/sbom/verify-huggingface-license.md | 1 - .../rules/slsa/banned-builder-deps.md | 1 - .../v2/initiatives/rules/slsa/build-time.md | 1 - .../v2/initiatives/rules/slsa/field-exists.md | 1 - .../rules/slsa/l1-provenance-exists.md | 1 - .../rules/slsa/l2-provenance-authenticated.md | 1 - .../initiatives/rules/slsa/verify-builder.md | 1 - .../rules/slsa/verify-byproducts.md | 1 - .../v2/initiatives/rules/ssdf/ps-1-2fa.md | 1 - .../rules/ssdf/ps-1-branch-protection.md | 1 - .../rules/ssdf/ps-1-limit-admins.md | 1 - .../rules/ssdf/ps-1-repo-private.md | 1 - .../rules/ssdf/ps-1-web-commit-signoff.md | 1 - .../rules/ssdf/ps-2-image-verifiable.md | 1 - .../rules/ssdf/ps-3.1-code-archived.md | 1 - .../rules/ssdf/ps-3.2-archived-sbom.md | 1 - docs/guides/enforcing-sdlc-initiative.md | 130 +++++++++--------- 184 files changed, 65 insertions(+), 248 deletions(-) diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md index a600c2024..bd5f975eb 100644 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md @@ -5,7 +5,6 @@ title: Verify No Critical or High Vulnerabilities in Product # Verify No Critical or High Vulnerabilities in Product **Type:** Rule **ID:** `scribe-cve-product` -**Uses:** `api/scribe-api-cve-product@v2/rules` **Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml) **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md index 5eda63552..0d260a3f7 100644 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md @@ -5,7 +5,6 @@ title: Verify No Critical or High Vulnerabilities # Verify No Critical or High Vulnerabilities **Type:** Rule **ID:** `scribe-cve` -**Uses:** `api/scribe-api-cve@v2/rules` **Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md index fda0f7d67..5d7cbca04 100644 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md @@ -5,7 +5,6 @@ title: Scribe Published Policy # Scribe Published Policy **Type:** Rule **ID:** `scribe-published-policy` -**Uses:** `api/scribe-api-published@v2/rules` **Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml) **Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego) **Labels:** Scribe diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api.md b/docs/configuration/v2/initiatives/rules/api/scribe-api.md index ad81d49f1..b7f531c1d 100644 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/v2/initiatives/rules/api/scribe-api.md @@ -5,7 +5,6 @@ title: Apply Scribe Template Policy # Apply Scribe Template Policy **Type:** Rule **ID:** `scribe-template` -**Uses:** `api/scribe-api@v2/rules` **Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) **Labels:** Scribe diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md index c1ba16d05..567876755 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Project Admins # Allowed Project Admins **Type:** Rule **ID:** `bb-project-allowed-project-admins` -**Uses:** `bitbucket/project/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego) diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md index 983c5435e..f04cf6caa 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Project Users # Allowed Project Users **Type:** Rule **ID:** `bb-project-allowed-project-users` -**Uses:** `bitbucket/project/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego) diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md index 62d43c15d..6a30f3015 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -5,7 +5,6 @@ title: Prevent Credential Exposure # Prevent Credential Exposure **Type:** Rule **ID:** `bb-project-exposed-credentials` -**Uses:** `bitbucket/project/exposed-credentials@v2/rules` **Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml) **Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego) **Labels:** Bitbucket, Project diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md index 0517e7123..e2b078419 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -5,7 +5,6 @@ title: Prevent Long-Lived Tokens # Prevent Long-Lived Tokens **Type:** Rule **ID:** `bb-project-long-live-tokens` -**Uses:** `bitbucket/project/long-live-tokens@v2/rules` **Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml) **Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego) **Labels:** Bitbucket, Project diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md index 60b5b816a..c30c716c9 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Repository Admins # Allowed Repository Admins **Type:** Rule **ID:** `bb-repo-allowed-repository-admins` -**Uses:** `bitbucket/repository/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego) **Labels:** Bitbucket, Repository diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md index 680ef7efe..a24800589 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Repository Users # Allowed Repository Users **Type:** Rule **ID:** `bb-repo-allowed-repository-users` -**Uses:** `bitbucket/repository/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego) **Labels:** Bitbucket, Repository diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md index fee4f98b3..e27ea2268 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md @@ -5,7 +5,6 @@ title: Verify Default Branch Protection Setting Is Configured # Verify Default Branch Protection Setting Is Configured **Type:** Rule **ID:** `bb-repo-branch-protection` -**Uses:** `bitbucket/repository/branch-protection@v2/rules` **Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego) **Labels:** Bitbucket, Repository diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md index 558d1906f..b5e2d1c7b 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Workspace Admins # Allowed Workspace Admins **Type:** Rule **ID:** `bb-workspace-allowed-workspace-admins` -**Uses:** `bitbucket/workspace/allow-admins@v2/rules` **Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego) **Labels:** Bitbucket, Workspace diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md index e0abc14d0..b3c5e4223 100644 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Workspace Users # Allowed Workspace Users **Type:** Rule **ID:** `bb-workspace-allowed-workspace-users` -**Uses:** `bitbucket/workspace/allow-users@v2/rules` **Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego) **Labels:** Bitbucket, Workspace diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md index 77fc5c93a..87ab4c5ea 100644 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md @@ -5,7 +5,6 @@ title: Verify DockerHub Tokens are Active # Verify DockerHub Tokens are Active **Type:** Rule **ID:** `dockerhub-token-expiration` -**Uses:** `dockerhub/token-expiration@v2/rules` **Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml) **Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego) **Labels:** Dockerhub diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md index c82c75f4d..b5a101bb0 100644 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md @@ -5,7 +5,6 @@ title: Verify no unused Dockerhub # Verify no unused Dockerhub **Type:** Rule **ID:** `dockerhub-token-not-used` -**Uses:** `dockerhub/token-not-used@v2/rules` **Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml) **Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego) **Labels:** Dockerhub diff --git a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md index 6c30ed128..43014375d 100644 --- a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md @@ -5,7 +5,6 @@ title: Generic Artifact Signed # Generic Artifact Signed **Type:** Rule **ID:** `generic-artifact-signed` -**Uses:** `generic/artifact-signed@v2/rules` **Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego) **Labels:** 3rd-party diff --git a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md index bfb57f1cb..755d64a55 100644 --- a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md @@ -5,7 +5,6 @@ title: Required Generic Evidence Exists # Required Generic Evidence Exists **Type:** Rule **ID:** `generic-required-evidence` -**Uses:** `generic/evidence-exists@v2/rules` **Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego) **Labels:** 3rd-party diff --git a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md index ca71fa137..e109441d6 100644 --- a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md @@ -5,7 +5,6 @@ title: K8s Jailbreak # K8s Jailbreak **Type:** Rule **ID:** `k8s-jailbreak` -**Uses:** `generic/k8s-jailbreak@v2/rules` **Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml) **Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego) **Labels:** K8s diff --git a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md index dc1a90282..15dcc4d3c 100644 --- a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md @@ -5,7 +5,6 @@ title: Required Trivy Evidence Exists # Required Trivy Evidence Exists **Type:** Rule **ID:** `required-trivy-evidence` -**Uses:** `generic/trivy-exists@v2/rules` **Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml) **Labels:** 3rd-party diff --git a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md index 03dfef58d..adba441c5 100644 --- a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md @@ -5,7 +5,6 @@ title: Git Artifact Signed # Git Artifact Signed **Type:** Rule **ID:** `git-artifact-signed` -**Uses:** `git/artifact-signed@v2/rules` **Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) **Labels:** SBOM, Git diff --git a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md index 16f2b779c..b4c85592c 100644 --- a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md @@ -5,7 +5,6 @@ title: Restrict Coding Permissions # Restrict Coding Permissions **Type:** Rule **ID:** `git-coding-permissions` -**Uses:** `git/coding-permissions@v2/rules` **Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) **Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) **Labels:** SBOM, Git diff --git a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md index c8aea5f96..1726df4b0 100644 --- a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md @@ -5,7 +5,6 @@ title: Required Git Evidence Exists # Required Git Evidence Exists **Type:** Rule **ID:** `required-git-evidence` -**Uses:** `git/evidence-exists@v2/rules` **Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) **Labels:** SBOM, Git diff --git a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md index b8a4bbcd5..db13bcef5 100644 --- a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md @@ -5,7 +5,6 @@ title: Disallow Commits to Main Branch # Disallow Commits to Main Branch **Type:** Rule **ID:** `git-disallow-commits-to-main` -**Uses:** `git/no-commit-to-main@v2/rules` **Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) **Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) **Labels:** SBOM, Git diff --git a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md index 1b384b1e4..d24a41b6a 100644 --- a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md @@ -5,7 +5,6 @@ title: Disallow Unsigned Commits # Disallow Unsigned Commits **Type:** Rule **ID:** `git-disallow-unsigned-commits` -**Uses:** `git/no-unsigned-commits@v2/rules` **Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml) **Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego) **Labels:** Git diff --git a/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md index e0b2d2e0a..69b6df675 100644 --- a/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md @@ -5,7 +5,6 @@ title: Branch protection enabled in GitHub repository # Branch protection enabled in GitHub repository **Type:** Rule **ID:** `github-api-branch-protection` -**Uses:** `github/api/branch-protection@v2/rules` **Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego) **Labels:** GitHub diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md index 498569af5..1baaf80f2 100644 --- a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md @@ -5,7 +5,6 @@ title: Verify Selected Commits Are Signed API # Verify Selected Commits Are Signed API **Type:** Rule **ID:** `github-api-signed-commits-list` -**Uses:** `github/api/signed-commits-list@v2/rules` **Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml) **Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego) **Labels:** GitHub, API diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md index 5ef9ddcab..af3785ad1 100644 --- a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md @@ -5,7 +5,6 @@ title: Disallow Unsigned Commits In Time Range # Disallow Unsigned Commits In Time Range **Type:** Rule **ID:** `signed-commits-range` -**Uses:** `github/api/signed-commits-range@v2/rules` **Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego) **Labels:** GitHub diff --git a/docs/configuration/v2/initiatives/rules/github/org/2fa.md b/docs/configuration/v2/initiatives/rules/github/org/2fa.md index 15a186faf..ae5da3a0a 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/2fa.md @@ -5,7 +5,6 @@ title: Verify two_factor_requirement_enabled setting # Verify two_factor_requirement_enabled setting **Type:** Rule **ID:** `github-org-2fa` -**Uses:** `github/org/2fa@v2/rules` **Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) **Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md index 742c68639..0f5cb8cc3 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md @@ -5,7 +5,6 @@ title: Verify advanced security setting is enabled # Verify advanced security setting is enabled **Type:** Rule **ID:** `github-org-advanced-security` -**Uses:** `github/org/advanced-security@v2/rules` **Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) **Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md index 608f815f4..afeb2b2ad 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed GitHub Organization Admins # Allowed GitHub Organization Admins **Type:** Rule **ID:** `github-orgallowed-admins` -**Uses:** `github/org/allow-admins@v2/rules` **Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md index 2fde637d1..bac4a8911 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md @@ -5,7 +5,6 @@ title: Allowed GitHub Organization Users # Allowed GitHub Organization Users **Type:** Rule **ID:** `github-org-allowed-users` -**Uses:** `github/org/allow-users@v2/rules` **Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md index afedf6e13..cfbee5cf9 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md @@ -5,7 +5,6 @@ title: Verify members_can_create_private_repositories setting # Verify members_can_create_private_repositories setting **Type:** Rule **ID:** `github-org-create-private-repos` -**Uses:** `github/org/create-private-repos@v2/rules` **Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) **Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md index 6aaf65911..72760c946 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md @@ -5,7 +5,6 @@ title: Verify members_can_create_repositories setting # Verify members_can_create_repositories setting **Type:** Rule **ID:** `github-org-create-repos` -**Uses:** `github/org/create-repos@v2/rules` **Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) **Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md index 53bbc71ba..8181b5b5f 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md @@ -5,7 +5,6 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting # Verify dependabot_alerts_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-alerts` -**Uses:** `github/org/dependabot-alerts@v2/rules` **Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml) **Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md index b0b7c0e97..56cb07e39 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -5,7 +5,6 @@ title: Verify dependabot_security_updates setting in security_and_analysis # Verify dependabot_security_updates setting in security_and_analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` -**Uses:** `github/org/dependabot-security-updates-sa@v2/rules` **Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) **Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md index b1258bad5..59c3eca94 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md @@ -5,7 +5,6 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting # Verify dependabot_security_updates_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` -**Uses:** `github/org/dependabot-security-updates@v2/rules` **Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) **Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md index 62ba7a665..1506245b8 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md @@ -5,7 +5,6 @@ title: Verify dependency_graph_enabled_for_new_repositories setting # Verify dependency_graph_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependency-graph` -**Uses:** `github/org/dependency-graph@v2/rules` **Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) **Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md index ed0d6c16b..483f73dea 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md @@ -5,7 +5,6 @@ title: Limit Admin Number in GitHub Organization # Limit Admin Number in GitHub Organization **Type:** Rule **ID:** `github-org-max-admins` -**Uses:** `github/org/max-admins@v2/rules` **Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) **Labels:** Blueprint, GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md index fc4807948..d1df76007 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md @@ -5,7 +5,6 @@ title: Verify GitHub Organization Secrets Are Not Too Old # Verify GitHub Organization Secrets Are Not Too Old **Type:** Rule **ID:** `github-org-old-secrets` -**Uses:** `github/org/old-secrets@v2/rules` **Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml) **Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md index 17c9f4d3f..cd1d1da56 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting # Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting **Type:** Rule **ID:** `github-org-pp-custom-link` -**Uses:** `github/org/pp-custom-link@v2/rules` **Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) **Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md index 7f28a1044..c0d62d5c6 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Push_Protection Setting # Verify Secret_Scanning_Push_Protection Setting **Type:** Rule **ID:** `github-org-push-protection-sa` -**Uses:** `github/org/push-protection-sa@v2/rules` **Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) **Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md index 17ddf80c3..1beace40b 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md @@ -6,7 +6,6 @@ title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setti # Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting **Type:** Rule **ID:** `github-org-push-protection` -**Uses:** `github/org/push-protection@v2/rules` **Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md index 07ffd0bd8..f8bb1c2b7 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md @@ -5,7 +5,6 @@ title: Verify Repo Visibility Setting # Verify Repo Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` -**Uses:** `github/org/repo-visibility@v2/rules` **Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) **Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md index 7f9763201..3cd023f4a 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis # Verify Secret_Scanning Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-secret-scanning-sa` -**Uses:** `github/org/secret-scanning-sa@v2/rules` **Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) **Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md index 115f3968b..a13e8a48f 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md @@ -5,7 +5,6 @@ title: Verify secret_scanning_enabled_for_new_repositories setting # Verify secret_scanning_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-secret-scanning` -**Uses:** `github/org/secret-scanning@v2/rules` **Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml) **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md index d29513abd..90d59da07 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis # Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis **Type:** Rule **ID:** `github-org-validity-checks-sa` -**Uses:** `github/org/validity-checks-sa@v2/rules` **Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) **Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md index 278f1c115..827210cb7 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md @@ -5,7 +5,6 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting # Verify Secret_Scanning_Validity_Checks_Enabled Setting **Type:** Rule **ID:** `github-org-validity-checks` -**Uses:** `github/org/validity-checks@v2/rules` **Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md index 2571db2f5..5639ddfde 100644 --- a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md @@ -5,7 +5,6 @@ title: Verify GitHub Organization Requires Signoff on Web Commits # Verify GitHub Organization Requires Signoff on Web Commits **Type:** Rule **ID:** `github-org-web-commit-signoff` -**Uses:** `github/org/web-commit-signoff@v2/rules` **Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml) **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md index 7031f1651..315c00f8c 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md @@ -5,7 +5,6 @@ title: Verify Branch Protection Setting # Verify Branch Protection Setting **Type:** Rule **ID:** `github-repo-branch-protection` -**Uses:** `github/repository/branch-protection@v2/rules` **Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml) **Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md index d5be52f03..723bc3496 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md @@ -5,7 +5,6 @@ title: Verify Branch Verification Setting # Verify Branch Verification Setting **Type:** Rule **ID:** `github-repo-branch-verification` -**Uses:** `github/repository/branch-verification@v2/rules` **Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml) **Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md index ea9be38be..3d388f009 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md @@ -5,7 +5,6 @@ title: Verify All Commits Are Signed in Repository # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` -**Uses:** `github/repository/check-signed-commits@v2/rules` **Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml) **Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md index 3048999f4..9b5e1e6e9 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md @@ -5,7 +5,6 @@ title: Verify Default Branch Protection # Verify Default Branch Protection **Type:** Rule **ID:** `github-repo-default-branch-protection` -**Uses:** `github/repository/default-branch-protection@v2/rules` **Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml) **Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md index cb3faf853..abbff1459 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md @@ -5,7 +5,6 @@ title: Verify Dependabot security updates setting # Verify Dependabot security updates setting **Type:** Rule **ID:** `github-repo-dependabot` -**Uses:** `github/repository/dependabot@v2/rules` **Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) **Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md index 7acb8af9d..572fbe2b8 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -5,7 +5,6 @@ title: Verify Only Ephemeral Runners Exist in Repository # Verify Only Ephemeral Runners Exist in Repository **Type:** Rule **ID:** `github-repo-ephemeral-runners-only` -**Uses:** `github/repository/ephemeral-runners-only@v2/rules` **Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml) **Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md index a60a6900a..5562f259f 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md @@ -5,7 +5,6 @@ title: Verify No Cache Usage Exists in Repository # Verify No Cache Usage Exists in Repository **Type:** Rule **ID:** `github-repo-no-cache-usage` -**Uses:** `github/repository/no-cache-usage@v2/rules` **Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml) **Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md index d0fd82ac0..912288d43 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md @@ -5,7 +5,6 @@ title: Verify No Organization Secrets Exist in Repository # Verify No Organization Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-no-org-secrets` -**Uses:** `github/repository/no-org-secrets@v2/rules` **Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml) **Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md index 20e08b6c3..52b136720 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md @@ -5,7 +5,6 @@ title: Verify No Old Secrets Exist in Repository # Verify No Old Secrets Exist in Repository **Type:** Rule **ID:** `github-repo-old-secrets` -**Uses:** `github/repository/old-secrets@v2/rules` **Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml) **Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md index 68ef05b56..c8be2eccd 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md @@ -5,7 +5,6 @@ title: Verify Push Protection Setting # Verify Push Protection Setting **Type:** Rule **ID:** `github-repo-push-protection` -**Uses:** `github/repository/push-protection@v2/rules` **Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml) **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md index 56260d877..4f643335a 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md @@ -5,7 +5,6 @@ title: Verify Repository Is Private # Verify Repository Is Private **Type:** Rule **ID:** `github-repo-private` -**Uses:** `github/repository/repo-private@v2/rules` **Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml) **Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md index bbda6a024..587ff9ae0 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md @@ -5,7 +5,6 @@ title: Verify secret_scanning setting # Verify secret_scanning setting **Type:** Rule **ID:** `github-repo-secret-scanning` -**Uses:** `github/repository/secret-scanning@v2/rules` **Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml) **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md index 145f69922..f6e2a27c4 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md @@ -5,7 +5,6 @@ title: Verify All Commits Are Signed in Repository # Verify All Commits Are Signed in Repository **Type:** Rule **ID:** `github-repo-signed-commits` -**Uses:** `github/repository/signed-commits@v2/rules` **Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml) **Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md index 2dc97ce94..190a3af0d 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md @@ -5,7 +5,6 @@ title: Verify secret scanning. # Verify secret scanning. **Type:** Rule **ID:** `github-repo-validity-checks` -**Uses:** `github/repository/validity-checks@v2/rules` **Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml) **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md index 35b3524d4..21aaada2a 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md @@ -5,7 +5,6 @@ title: Allowed Public Repositories # Allowed Public Repositories **Type:** Rule **ID:** `github-repo-visibility` -**Uses:** `github/repository/visibility@v2/rules` **Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml) **Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md index 4caa30e32..e7d7fe222 100644 --- a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md @@ -5,7 +5,6 @@ title: Verify Repository Requires Commit Signoff # Verify Repository Requires Commit Signoff **Type:** Rule **ID:** `github-repo-web-commit-signoff` -**Uses:** `github/repository/web-commit-signoff@v2/rules` **Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml) **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego) **Labels:** GitHub, Repository diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md index 0775d11ca..046bd9576 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md @@ -5,7 +5,6 @@ title: Set Push Rules in GitLab # Set Push Rules in GitLab **Type:** Rule **ID:** `gitlab-api-push-rules` -**Uses:** `gitlab/api/push-rules@v2/rules` **Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml) **Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md index 14681c39d..92e04c992 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md @@ -5,7 +5,6 @@ title: Sign Selected Commits in GitLab # Sign Selected Commits in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-list` -**Uses:** `gitlab/api/signed-commits-list@v2/rules` **Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml) **Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md index cfbac0ea1..4d8cb10e6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md @@ -5,7 +5,6 @@ title: Sign Selected Commit Range in GitLab # Sign Selected Commit Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` -**Uses:** `gitlab/api/signed-commits-range@v2/rules` **Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) **Labels:** Gitlab, API diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md index 8eb5fb0cc..a2f8911a4 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md @@ -5,7 +5,6 @@ title: Allowed Admins in GitLab Organization # Allowed Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-admins` -**Uses:** `gitlab/org/allow-admins@v2/rules` **Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md index 4f8a57b91..257f6ca94 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -5,7 +5,6 @@ title: Restrict Token Scopes in GitLab # Restrict Token Scopes in GitLab **Type:** Rule **ID:** `gitlab-org-allowed-token-scope` -**Uses:** `gitlab/org/allow-token-scopes@v2/rules` **Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml) **Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md index 59e6f6132..64bcb0745 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md @@ -5,7 +5,6 @@ title: Allowed Users in GitLab Organization # Allowed Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-users` -**Uses:** `gitlab/org/allow-users@v2/rules` **Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml) **Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md index b940c90ba..614ca946d 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md @@ -5,7 +5,6 @@ title: Block Users in GitLab Organization # Block Users in GitLab Organization **Type:** Rule **ID:** `gitlab-org-blocked-users` -**Uses:** `gitlab/org/blocked-users@v2/rules` **Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml) **Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md index 9d5e6899a..fbaa4782f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md @@ -5,7 +5,6 @@ title: Prevent Token Expiration in GitLab Organization # Prevent Token Expiration in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-about-to-expire` -**Uses:** `gitlab/org/expiring-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml) **Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md index 49c5a7dfd..d194cd96e 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -5,7 +5,6 @@ title: Forbid Token Scopes in GitLab Organization # Forbid Token Scopes in GitLab Organization **Type:** Rule **ID:** `gitlab-org-disallowed-token-scope` -**Uses:** `gitlab/org/forbid-token-scopes@v2/rules` **Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml) **Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego) **Labels:** Blueprint, Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md index a2743aa47..295a1c1a6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md @@ -5,7 +5,6 @@ title: Ensure Active Projects in GitLab Organization # Ensure Active Projects in GitLab Organization **Type:** Rule **ID:** `gitlab-org-inactive-projects` -**Uses:** `gitlab/org/inactive-projects@v2/rules` **Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml) **Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md index ad13786ea..6303bf36f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md @@ -5,7 +5,6 @@ title: Forbid Long-Lived Tokens in GitLab Organization # Forbid Long-Lived Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-token-excessive-lifespan` -**Uses:** `gitlab/org/longlive-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml) **Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego) **Labels:** Blueprint, Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md index 52d146630..80360d979 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md @@ -5,7 +5,6 @@ title: Limit Admins in GitLab Organization # Limit Admins in GitLab Organization **Type:** Rule **ID:** `gitlab-org-max-admins` -**Uses:** `gitlab/org/max-admins@v2/rules` **Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego) **Labels:** Blueprint, GitLab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md index 939c9eb9f..6f7bbbcdd 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md @@ -5,7 +5,6 @@ title: Restrict Public Visibility in GitLab Organization # Restrict Public Visibility in GitLab Organization **Type:** Rule **ID:** `gitlab-org-allowed-visible-projects` -**Uses:** `gitlab/org/projects-visibility@v2/rules` **Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml) **Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md index 139cb5099..8bf0c8cb6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md @@ -5,7 +5,6 @@ title: Forbid Unused Tokens in GitLab Organization # Forbid Unused Tokens in GitLab Organization **Type:** Rule **ID:** `gitlab-org-unused-tokens` -**Uses:** `gitlab/org/unused-tokens@v2/rules` **Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml) **Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego) **Labels:** Gitlab, Organization diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index c3373bc35..91b4d96cb 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -5,7 +5,6 @@ title: GitLab pipeline verify labels exist # GitLab pipeline verify labels exist **Type:** Rule **ID:** `gitlab-pipeline-verify-labels-exist` -**Uses:** `gitlab/pipeline/verify-labels-exist@v2/rules` **Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) **Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego) **Labels:** Gitlab, Pipeline diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md index 1a7f3f6d6..ddb89d453 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -5,7 +5,6 @@ title: Verify GitLab Pipeline Labels # Verify GitLab Pipeline Labels **Type:** Rule **ID:** `gitlab-pipeline-verify-labels` -**Uses:** `gitlab/pipeline/verify-labels@v2/rules` **Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml) **Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego) **Labels:** Gitlab, Pipeline diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md index 4ae45ffd2..d2c53cd07 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md @@ -5,7 +5,6 @@ title: Verify Project Activity # Verify Project Activity **Type:** Rule **ID:** `gitlab-project-abandoned-project` -**Uses:** `gitlab/project/abandoned-project@v2/rules` **Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml) **Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md index 67dfcd21e..9485a24db 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -5,7 +5,6 @@ title: Merge approval policy check for GitLab project # Merge approval policy check for GitLab project **Type:** Rule **ID:** `gitlab-project-merge-approval` -**Uses:** `gitlab/project/approvals-policy-check@v2/rules` **Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml) **Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego) **Labels:** Blueprint, Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 2d662a08a..d6491877b 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -5,7 +5,6 @@ title: Restrict Approvers Per Merge Request # Restrict Approvers Per Merge Request **Type:** Rule **ID:** `gitlab-project-approvers-per-merge-request` -**Uses:** `gitlab/project/approvers-per-merge-request@v2/rules` **Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml) **Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md index f9d8ac904..f0bef95b6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md @@ -5,7 +5,6 @@ title: Set Author Email Regex in GitLab Project # Set Author Email Regex in GitLab Project **Type:** Rule **ID:** `gitlab-project-author-email-regex` -**Uses:** `gitlab/project/author-email-regex@v2/rules` **Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml) **Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md index 324c4497b..13a874c4f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md @@ -5,7 +5,6 @@ title: Check CWE Compliance # Check CWE Compliance **Type:** Rule **ID:** `gitlab-project-check-cwe` -**Uses:** `gitlab/project/check-cwe@v2/rules` **Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml) **Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md index 9c6565d9a..19358c074 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md @@ -5,7 +5,6 @@ title: Ensure All Commits Are Signed in GitLab Project # Ensure All Commits Are Signed in GitLab Project **Type:** Rule **ID:** `gitlab-project-signed-commits` -**Uses:** `gitlab/project/check-signed-commits@v2/rules` **Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml) **Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md index 4ff4304be..1bb6d0a2b 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md @@ -5,7 +5,6 @@ title: Require Code Owner Approval in GitLab Project # Require Code Owner Approval in GitLab Project **Type:** Rule **ID:** `gitlab-project-code-owner-approval` -**Uses:** `gitlab/project/co-approval-required@v2/rules` **Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml) **Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md index 897718cb6..5f2002d5f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -5,7 +5,6 @@ title: Restrict Commit Authors in GitLab Project # Restrict Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-authors` -**Uses:** `gitlab/project/commit-author-email-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml) **Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md index 15dedbbba..c91db1fa0 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -5,7 +5,6 @@ title: Allowed Commit Authors in GitLab Project # Allowed Commit Authors in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-commit-author-names` -**Uses:** `gitlab/project/commit-author-name-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml) **Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md index c32a08756..f6e91c841 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md @@ -5,7 +5,6 @@ title: Enable Commit Committer Check in GitLab Project # Enable Commit Committer Check in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-commit_committer_check` -**Uses:** `gitlab/project/commit-committer-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml) **Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md index 4cc1607b4..8497009be 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md @@ -5,7 +5,6 @@ title: Verify Commit Message Format # Verify Commit Message Format **Type:** Rule **ID:** `gitlab-project-verify-commit_message_check` -**Uses:** `gitlab/project/commit-message-check@v2/rules` **Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml) **Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md index c53f445e1..729edca82 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md @@ -5,7 +5,6 @@ title: Validate All Commits in GitLab Project # Validate All Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-all-commits-validated` -**Uses:** `gitlab/project/commits-validated@v2/rules` **Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml) **Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md index ec139e22f..7a44c7317 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md @@ -5,7 +5,6 @@ title: Allowed Committer Emails in GitLab Project # Allowed Committer Emails in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-emails` -**Uses:** `gitlab/project/committer-email-check@v2/rules` **Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml) **Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md index fb89452d2..0a6f037b6 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md @@ -5,7 +5,6 @@ title: Allowed Committer Names in GitLab Project # Allowed Committer Names in GitLab Project **Type:** Rule **ID:** `gitlab-project-allowed-committer-names` -**Uses:** `gitlab/project/committer-name-check@v2/rules` **Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml) **Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md index 80839f0ae..dac1fb819 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -5,7 +5,6 @@ title: Enforce Critical Severity Limit # Enforce Critical Severity Limit **Type:** Rule **ID:** `gitlab-project-critical-severity-limit` -**Uses:** `gitlab/project/critical-severity-limit@v2/rules` **Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml) **Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md index 7cbe2f86c..c513b4a0d 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md @@ -5,7 +5,6 @@ title: Check Description Substring # Check Description Substring **Type:** Rule **ID:** `gitlab-project-description-substring-check` -**Uses:** `gitlab/project/description-substring-check@v2/rules` **Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml) **Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 81dd703ff..d29c02ef5 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -5,7 +5,6 @@ title: Disallow Banned Approvers # Disallow Banned Approvers **Type:** Rule **ID:** `gitlab-project-disallowed-banned-approvers` -**Uses:** `gitlab/project/disallowed-banned-approvers@v2/rules` **Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) **Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md index 226843f8c..2cc0a3f81 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md @@ -5,7 +5,6 @@ title: Disallow Force Push in GitLab Project # Disallow Force Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-force-push` -**Uses:** `gitlab/project/force-push-protection@v2/rules` **Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml) **Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md index 6b88855d2..d657f8634 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -5,7 +5,6 @@ title: Enforce Medium Severity Limit # Enforce Medium Severity Limit **Type:** Rule **ID:** `gitlab-project-medium-severity-limit` -**Uses:** `gitlab/project/medium-severity-limit@v2/rules` **Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml) **Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md index 13627dc2d..090bfe4c1 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md @@ -5,7 +5,6 @@ title: Enable Member Check for GitLab Project # Enable Member Check for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-member_check` -**Uses:** `gitlab/project/member-check@v2/rules` **Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml) **Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md index bdc70884c..ec045a9db 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md @@ -5,7 +5,6 @@ title: Enforce Merge Access Level Policy for GitLab Project # Enforce Merge Access Level Policy for GitLab Project **Type:** Rule **ID:** `gitlab-project-merge-access-level` -**Uses:** `gitlab/project/merge-access-level@v2/rules` **Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml) **Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md index ab5f51017..471d12ac7 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -5,7 +5,6 @@ title: Disable Author Approval for Merge Requests in GitLab # Disable Author Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-author-approval` -**Uses:** `gitlab/project/merge-requests-author-approval@v2/rules` **Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml) **Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 107491f5f..f7d34cdd8 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -5,7 +5,6 @@ title: Disable Committers' Approval for Merge Requests in GitLab # Disable Committers' Approval for Merge Requests in GitLab **Type:** Rule **ID:** `gitlab-project-merge-requests-disable-committers-approval` -**Uses:** `gitlab/project/merge-requests-disable-committers-approval@v2/rules` **Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) **Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md index 35c522b3c..8c78c0e7c 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md @@ -5,7 +5,6 @@ title: Check Message Substring # Check Message Substring **Type:** Rule **ID:** `gitlab-project-message-substring-check` -**Uses:** `gitlab/project/message-substring-check@v2/rules` **Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml) **Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md index acad85cf4..bc27834dd 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -5,7 +5,6 @@ title: Enable Secrets Prevention in GitLab Project # Enable Secrets Prevention in GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-prevent_secrets` -**Uses:** `gitlab/project/prevent-secrets-check@v2/rules` **Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml) **Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md index 59698935a..5306a5b84 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -5,7 +5,6 @@ title: Protect CI Secrets in GitLab Project # Protect CI Secrets in GitLab Project **Type:** Rule **ID:** `gitlab-project-protect-ci-secrets` -**Uses:** `gitlab/project/protect-ci-secrets@v2/rules` **Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml) **Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md index e66deecc4..e4b1195b7 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md @@ -5,7 +5,6 @@ title: Set Push Access Level in GitLab Project # Set Push Access Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-push-access-level` -**Uses:** `gitlab/project/push-access-level@v2/rules` **Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml) **Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md index 833713cb5..990c718fa 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md @@ -5,7 +5,6 @@ title: Set Push Rules for GitLab Project # Set Push Rules for GitLab Project **Type:** Rule **ID:** `gitlab-project-verify-push_rules` -**Uses:** `gitlab/project/push-rules-set@v2/rules` **Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml) **Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 780f94885..f3d7ffa7f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -5,7 +5,6 @@ title: Reject Unsigned Commits in GitLab Project # Reject Unsigned Commits in GitLab Project **Type:** Rule **ID:** `gitlab-project-disallow-unsigned-commits` -**Uses:** `gitlab/project/reject-unsigned-commits@v2/rules` **Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml) **Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego) **Labels:** Blueprint, Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md index 6bc79a287..4b4e1b9e2 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -5,7 +5,6 @@ title: Require Password for Approvals in GitLab Project # Require Password for Approvals in GitLab Project **Type:** Rule **ID:** `gitlab-project-require-password-to-approve` -**Uses:** `gitlab/project/require-password-to-approve@v2/rules` **Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml) **Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md index e5b6d2191..551fdfe42 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -5,7 +5,6 @@ title: Require Minimal Approvers in GitLab Project # Require Minimal Approvers in GitLab Project **Type:** Rule **ID:** `gitlab-project-required-minimal-approvers` -**Uses:** `gitlab/project/required-minimal-approvers@v2/rules` **Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml) **Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 546c9c63d..070835191 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -5,7 +5,6 @@ title: Reset Approvals on Push in GitLab Project # Reset Approvals on Push in GitLab Project **Type:** Rule **ID:** `gitlab-project-reset-pprovals-on-push` -**Uses:** `gitlab/project/reset-pprovals-on-push@v2/rules` **Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) **Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md index a23988b60..d25cd30ae 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -5,7 +5,6 @@ title: Ensure SAST Scanning Passes # Ensure SAST Scanning Passes **Type:** Rule **ID:** `gitlab-project-sast-scan-pass` -**Uses:** `gitlab/project/sast-scan-pass@v2/rules` **Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml) **Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md index 0eb9eb28d..1d17f8255 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md @@ -5,7 +5,6 @@ title: Run SAST Scanning in GitLab Project # Run SAST Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-sast-scanning` -**Uses:** `gitlab/project/sast-scanning@v2/rules` **Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml) **Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md index 78cf9c536..4b0f92e2f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -5,7 +5,6 @@ title: Ensure Secrets Scanning Passes # Ensure Secrets Scanning Passes **Type:** Rule **ID:** `gitlab-project-secrets-scan-pass` -**Uses:** `gitlab/project/secrets-scan-pass@v2/rules` **Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml) **Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md index 810bbd477..27f7be669 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md @@ -5,7 +5,6 @@ title: Run Secrets Scanning in GitLab Project # Run Secrets Scanning in GitLab Project **Type:** Rule **ID:** `gitlab-project-secrets-scanning` -**Uses:** `gitlab/project/secrets-scanning@v2/rules` **Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml) **Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 30d6c42a5..4947c4d7f 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -5,7 +5,6 @@ title: Restrict Selective Code Owner Removals in GitLab # Restrict Selective Code Owner Removals in GitLab **Type:** Rule **ID:** `gitlab-project-selective-code-owner-removals` -**Uses:** `gitlab/project/selective-code-owner-removals@v2/rules` **Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml) **Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md index c51b8c464..93e8da37a 100644 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md @@ -5,7 +5,6 @@ title: Set Visibility Level in GitLab Project # Set Visibility Level in GitLab Project **Type:** Rule **ID:** `gitlab-project-project-visibility-level` -**Uses:** `gitlab/project/visibility-check@v2/rules` **Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml) **Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego) **Labels:** Gitlab, Project diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md index 57edc0723..6d634f65a 100644 --- a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md @@ -5,7 +5,6 @@ title: Allowed Base Image # Allowed Base Image **Type:** Rule **ID:** `images-allowed-base-image` -**Uses:** `images/allowed-base-image@v2/rules` **Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml) **Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md index 761170e55..db698f395 100644 --- a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md @@ -5,7 +5,6 @@ title: Allowed Main Image Source # Allowed Main Image Source **Type:** Rule **ID:** `images-allowed-image-source` -**Uses:** `images/allowed-image-source@v2/rules` **Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml) **Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/banned-ports.md b/docs/configuration/v2/initiatives/rules/images/banned-ports.md index 67c01b2c2..75931681b 100644 --- a/docs/configuration/v2/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/v2/initiatives/rules/images/banned-ports.md @@ -5,7 +5,6 @@ title: Banned Ports # Banned Ports **Type:** Rule **ID:** `images-banned-ports` -**Uses:** `images/banned-ports@v2/rules` **Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml) **Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/banned-users.md b/docs/configuration/v2/initiatives/rules/images/banned-users.md index 90eebb2e5..44c954d67 100644 --- a/docs/configuration/v2/initiatives/rules/images/banned-users.md +++ b/docs/configuration/v2/initiatives/rules/images/banned-users.md @@ -5,7 +5,6 @@ title: Disallow Specific Users in SBOM # Disallow Specific Users in SBOM **Type:** Rule **ID:** `sbom-disallowed-users` -**Uses:** `images/banned-users@v2/rules` **Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml) **Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego) **Labels:** SBOM, Image diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md index bd0c3fb8e..46a08b9e4 100644 --- a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md @@ -5,7 +5,6 @@ title: Restrict Build Scripts # Restrict Build Scripts **Type:** Rule **ID:** `images-disallowed-build-script` -**Uses:** `images/blocklist-build-scripts@v2/rules` **Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml) **Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md index 1bbd6da22..ec4a36a37 100644 --- a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md @@ -5,7 +5,6 @@ title: Registry Connection HTTPS # Registry Connection HTTPS **Type:** Rule **ID:** `images-registry-https-check` -**Uses:** `images/enforce-https-registry@v2/rules` **Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml) **Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego) **Labels:** Registry, Images diff --git a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md index b7a5d0e07..594222fd6 100644 --- a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md @@ -5,7 +5,6 @@ title: Forbid Large Images # Forbid Large Images **Type:** Rule **ID:** `images-project-large-image` -**Uses:** `images/forbid-large-images@v2/rules` **Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml) **Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md index 3c88f114e..064ced39d 100644 --- a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md @@ -5,7 +5,6 @@ title: Fresh Base Image # Fresh Base Image **Type:** Rule **ID:** `images-fresh-base-image` -**Uses:** `images/fresh-base-image@v2/rules` **Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml) **Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-image.md index fc178cadd..1db34faec 100644 --- a/docs/configuration/v2/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/v2/initiatives/rules/images/fresh-image.md @@ -5,7 +5,6 @@ title: Fresh Image # Fresh Image **Type:** Rule **ID:** `fresh-image` -**Uses:** `images/fresh-image@v2/rules` **Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml) **Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/image-signed.md b/docs/configuration/v2/initiatives/rules/images/image-signed.md index b259a0354..e4aa92051 100644 --- a/docs/configuration/v2/initiatives/rules/images/image-signed.md +++ b/docs/configuration/v2/initiatives/rules/images/image-signed.md @@ -5,7 +5,6 @@ title: Require Signed Container Image # Require Signed Container Image **Type:** Rule **ID:** `images-require-signed-image` -**Uses:** `images/image-signed@v2/rules` **Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml) **Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego) **Labels:** Images, Blueprint diff --git a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md index dd0382473..65a5a3e73 100644 --- a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md @@ -5,7 +5,6 @@ title: Require Healthcheck # Require Healthcheck **Type:** Rule **ID:** `images-require-healthcheck` -**Uses:** `images/require-healthcheck@v2/rules` **Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml) **Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md index 785461656..04b60aa2a 100644 --- a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md @@ -5,7 +5,6 @@ title: Disallow Container Shell Entrypoint # Disallow Container Shell Entrypoint **Type:** Rule **ID:** `images-disallow-shell-access` -**Uses:** `images/restrict-shell-entrypoint@v2/rules` **Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml) **Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md index 7b123def5..04ce31753 100644 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md @@ -5,7 +5,6 @@ title: Require Image Labels # Require Image Labels **Type:** Rule **ID:** `required-image-labels` -**Uses:** `images/verify-labels-exist@v2/rules` **Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml) **Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels.md b/docs/configuration/v2/initiatives/rules/images/verify-labels.md index 0bcd29c13..727fe0a99 100644 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/v2/initiatives/rules/images/verify-labels.md @@ -5,7 +5,6 @@ title: Verify Image Labels # Verify Image Labels **Type:** Rule **ID:** `image-labels` -**Uses:** `images/verify-labels@v2/rules` **Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml) **Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego) **Labels:** SBOM, Images diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md index 62dc5203b..b0fa24114 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -5,7 +5,6 @@ title: Verify Exposed Credentials # Verify Exposed Credentials **Type:** Rule **ID:** `jenkins-exposed-credentials` -**Uses:** `jenkins/folder/exposed-credentials@v2/rules` **Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml) **Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego) **Labels:** Jenkins, Folder diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md index b0bc4951a..9c20b26d6 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md @@ -5,7 +5,6 @@ title: Verify Inactive Users # Verify Inactive Users **Type:** Rule **ID:** `jenkins-inactive-users` -**Uses:** `jenkins/instance/inactive-users@v2/rules` **Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml) **Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego) **Labels:** Jenkins, Instance diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md index b3d4503d2..64d220a56 100644 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md @@ -5,7 +5,6 @@ title: Disallow Unused Users # Disallow Unused Users **Type:** Rule **ID:** `jenkins-unused-users` -**Uses:** `jenkins/instance/unused-users@v2/rules` **Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml) **Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego) **Labels:** Jenkins, Instance diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md index 501d7953a..d093613e4 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md @@ -5,7 +5,6 @@ title: Allowed Container Images # Allowed Container Images **Type:** Rule **ID:** `k8s-namespace-blocked-images` -**Uses:** `k8s/namespace/allowed-images@v2/rules` **Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml) **Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md index 1db90d375..89675409e 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md @@ -5,7 +5,6 @@ title: Allowed Namespace Registries # Allowed Namespace Registries **Type:** Rule **ID:** `k8s-namespace-allowed-registries` -**Uses:** `k8s/namespace/allowed-registries@v2/rules` **Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml) **Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 782dc2aa1..26d7b3f21 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -5,7 +5,6 @@ title: Verify Namespace Runtime Duration # Verify Namespace Runtime Duration **Type:** Rule **ID:** `k8s-namespace-verify-namespace-duration` -**Uses:** `k8s/namespace/verify-namespace-duration@v2/rules` **Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml) **Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 56cfc4b1f..a17d75823 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -5,7 +5,6 @@ title: Verify Namespace Termination # Verify Namespace Termination **Type:** Rule **ID:** `k8s-namespace-verify-namespace-termination` -**Uses:** `k8s/namespace/verify-namespace-termination@v2/rules` **Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml) **Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md index d9795dac1..7e41bc992 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -5,7 +5,6 @@ title: Allowed Namespaces # Allowed Namespaces **Type:** Rule **ID:** `k8s-namespace-white-listed-namespaces` -**Uses:** `k8s/namespace/white-listed-namespaces@v2/rules` **Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml) **Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md index ef3678c53..2d55d651a 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -5,7 +5,6 @@ title: Allowed Pods in Namespace # Allowed Pods in Namespace **Type:** Rule **ID:** `k8s-namespace-white-listed-pod` -**Uses:** `k8s/namespace/white-listed-pod@v2/rules` **Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml) **Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego) **Labels:** K8s, Namespace diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md index 9d8104046..0a0db38ee 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -5,7 +5,6 @@ title: Verify Pod Runtime Duration # Verify Pod Runtime Duration **Type:** Rule **ID:** `k8s-pods-verify-pod-duration` -**Uses:** `k8s/pods/verify-pod-duration@v2/rules` **Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml) **Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego) **Labels:** K8s, Pod diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md index af11c74e5..48ae71a0c 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -5,7 +5,6 @@ title: Verify Pod Termination # Verify Pod Termination **Type:** Rule **ID:** `k8s-pods-verify-pod-termination` -**Uses:** `k8s/pods/verify-pod-termination@v2/rules` **Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml) **Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego) **Labels:** K8s, Pod diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md index 74ba98e01..17e7462e8 100644 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md @@ -5,7 +5,6 @@ title: Allowed Pods # Allowed Pods **Type:** Rule **ID:** `k8s-pods-white-listed-pod` -**Uses:** `k8s/pods/white-listed-pod@v2/rules` **Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml) **Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego) **Labels:** K8s, Pod diff --git a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md index 96fcbc0f3..fa6c0b2bd 100644 --- a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md @@ -5,7 +5,6 @@ title: Verify File Integrity # Verify File Integrity **Type:** Rule **ID:** `file-integrity` -**Uses:** `multievidence/files_integrity@v2/rules` **Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) **Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) **Labels:** SBOM diff --git a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md index 0403f5c38..c3480fabc 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md @@ -5,7 +5,6 @@ title: Verify Artifact Signature Using SARIF Report # Verify Artifact Signature Using SARIF Report **Type:** Rule **ID:** `sarif-artifact-signed` -**Uses:** `sarif/artifact-signed@v2/rules` **Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md index dc21e8d62..d964e62af 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md @@ -5,7 +5,6 @@ title: Verify Required Evidence in SARIF # Verify Required Evidence in SARIF **Type:** Rule **ID:** `required-sarif-evidence` -**Uses:** `sarif/evidence-exists@v2/rules` **Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml) **Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md index 692c3a235..abb7b62cd 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md @@ -5,7 +5,6 @@ title: SARIF Update Needed # SARIF Update Needed **Type:** Rule **ID:** `sarif-update-needed` -**Uses:** `sarif/patcheck/updates-needed@v2/rules` **Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml) **Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md index a0b8ff5be..b5c0cb8cd 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md @@ -5,7 +5,6 @@ title: Verify IaC Misconfiguration Threshold in SARIF # Verify IaC Misconfiguration Threshold in SARIF **Type:** Rule **ID:** `sarif-iac-findings` -**Uses:** `sarif/report-iac-errors@v2/rules` **Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml) **Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md index c83dfa390..01dc70227 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -5,7 +5,6 @@ title: Trivy Blocklist CVE Check # Trivy Blocklist CVE Check **Type:** Rule **ID:** `trivy-blocklist-cve` -**Uses:** `sarif/trivy/blocklist-cve@v2/rules` **Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml) **Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index 809af5970..fc97b9858 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -5,7 +5,6 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF # Verify IaC Misconfiguration Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-iac-findings` -**Uses:** `sarif/trivy/report-trivy-iac-errors@v2/rules` **Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) **Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md index 130808329..f81c69280 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -5,7 +5,6 @@ title: Trivy Vulnerability Findings Check # Trivy Vulnerability Findings Check **Type:** Rule **ID:** `trivy-verify-vulnerability-findings` -**Uses:** `sarif/trivy/verify-cve-severity@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml) **Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 74cc89a1d..54d336702 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -5,7 +5,6 @@ title: Verify Attack Vector Threshold in Trivy SARIF # Verify Attack Vector Threshold in Trivy SARIF **Type:** Rule **ID:** `trivy-attack-vectors` -**Uses:** `sarif/trivy/verify-trivy-attack-vector@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) **Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego) **Labels:** SARIF, Trivy diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md index 09188371d..f1c198303 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -5,7 +5,6 @@ title: Verify Trivy SARIF Report Compliance # Verify Trivy SARIF Report Compliance **Type:** Rule **ID:** `trivy-report` -**Uses:** `sarif/trivy/verify-trivy-report@v2/rules` **Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml) **Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego) **Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md index a4bbd9807..ec085bbf8 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md @@ -5,7 +5,6 @@ title: Verify Attack Vector Exists in SARIF # Verify Attack Vector Exists in SARIF **Type:** Rule **ID:** `sarif-attack-vectors` -**Uses:** `sarif/verify-attack-vector@v2/rules` **Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml) **Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md index 2815b687f..b9d1677ad 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md @@ -5,7 +5,6 @@ title: Verify Rule Compliance in SARIF # Verify Rule Compliance in SARIF **Type:** Rule **ID:** `sarif-policy` -**Uses:** `sarif/verify-sarif@v2/rules` **Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml) **Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md index cefc2845b..98994825d 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md @@ -5,7 +5,6 @@ title: Verify Semgrep Rule in SARIF # Verify Semgrep Rule in SARIF **Type:** Rule **ID:** `sarif-semgrep-report` -**Uses:** `sarif/verify-semgrep-report@v2/rules` **Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) **Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) **Labels:** SARIF, Semgrep diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md index a394777fc..a226b55f9 100644 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md @@ -5,7 +5,6 @@ title: Verify Tool Evidence in SARIF # Verify Tool Evidence in SARIF **Type:** Rule **ID:** `sarif-tool-evidence` -**Uses:** `sarif/verify-tool-evidence@v2/rules` **Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml) **Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego) **Labels:** SARIF diff --git a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md index b7130bbc8..848936c2c 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md @@ -5,7 +5,6 @@ title: NTIA SBOM Compliance Check # NTIA SBOM Compliance Check **Type:** Rule **ID:** `NTIA-compliance` -**Uses:** `sbom/NTIA-compliance@v2/rules` **Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) **Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) **Labels:** SBOM, Compliance, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md index 5d7fc6ea1..3911c25d6 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md @@ -5,7 +5,6 @@ title: Enforce Allowed SBOM Components # Enforce Allowed SBOM Components **Type:** Rule **ID:** `sbom-allowed-components` -**Uses:** `sbom/allowed-components@v2/rules` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) **Labels:** SBOM, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md index 23acfa1c0..d5c073b1b 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md @@ -5,7 +5,6 @@ title: Require SBOM Signature # Require SBOM Signature **Type:** Rule **ID:** `sbom-signed` -**Uses:** `sbom/artifact-signed@v2/rules` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) **Labels:** SBOM, Blueprint, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md index 4c4b74fb6..4dc58a690 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md @@ -5,7 +5,6 @@ title: Restrict Disallowed SBOM Licenses # Restrict Disallowed SBOM Licenses **Type:** Rule **ID:** `sbom-disallowed-licenses` -**Uses:** `sbom/banned-licenses@v2/rules` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) **Labels:** SBOM, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md index a934656ed..1c619722a 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md @@ -5,7 +5,6 @@ title: Restrict Disallowed Dependencies # Restrict Disallowed Dependencies **Type:** Rule **ID:** `sbom-disallow-dependencies` -**Uses:** `sbom/blocklist-packages@v2/rules` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) **Labels:** SBOM, Image, Blueprint, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md index abb1f4f5b..0dd812234 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md @@ -5,7 +5,6 @@ title: Enforce SBOM License Completeness # Enforce SBOM License Completeness **Type:** Rule **ID:** `sbom-require-complete-license-set` -**Uses:** `sbom/complete-licenses@v2/rules` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) **Labels:** SBOM, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md index 370ce178d..a6c8a78fe 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md @@ -5,7 +5,6 @@ title: Enforce SBOM Freshness # Enforce SBOM Freshness **Type:** Rule **ID:** `fresh-sbom` -**Uses:** `sbom/fresh-sbom@v2/rules` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) **Labels:** SBOM, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md index a959dd86d..9d31dc49c 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md @@ -5,7 +5,6 @@ title: Require SBOM Existence # Require SBOM Existence **Type:** Rule **ID:** `require-sbom` -**Uses:** `sbom/require-sbom@v2/rules` **Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) **Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) **Labels:** SBOM, Blueprint, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md index b887d7e6b..8048b8332 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md @@ -5,7 +5,6 @@ title: Enforce SBOM Dependencies # Enforce SBOM Dependencies **Type:** Rule **ID:** `sbom-required-dependencies` -**Uses:** `sbom/required-packages@v2/rules` **Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml) **Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) **Labels:** SBOM, Image diff --git a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md index ec97f6551..ea5b11952 100644 --- a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md @@ -5,7 +5,6 @@ title: Require Specified SBOM Licenses # Require Specified SBOM Licenses **Type:** Rule **ID:** `sbom-hf-license` -**Uses:** `sbom/verify-huggingface-license@v2/rules` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) **Labels:** SBOM, Image, Git diff --git a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md index 26f57432e..1c1d44f4f 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md @@ -5,7 +5,6 @@ title: Disallow dependencies in SLSA Provenance Document # Disallow dependencies in SLSA Provenance Document **Type:** Rule **ID:** `slsa-builder-unallowed-dependencies` -**Uses:** `slsa/banned-builder-deps@v2/rules` **Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml) **Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego) **Labels:** SLSA, Image diff --git a/docs/configuration/v2/initiatives/rules/slsa/build-time.md b/docs/configuration/v2/initiatives/rules/slsa/build-time.md index 571595d85..84443b498 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/v2/initiatives/rules/slsa/build-time.md @@ -5,7 +5,6 @@ title: Verify build time # Verify build time **Type:** Rule **ID:** `slsa-build-time` -**Uses:** `slsa/build-time@v2/rules` **Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml) **Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego) **Labels:** SLSA, Image diff --git a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md index 8892d5d2f..e0bfea3b8 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md @@ -5,7 +5,6 @@ title: SLSA Field Exists in Provenance Document # SLSA Field Exists in Provenance Document **Type:** Rule **ID:** `slsa-field-exists` -**Uses:** `slsa/field-exists@v2/rules` **Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml) **Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego) **Labels:** SLSA, Image diff --git a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md index 56291ff0e..86f1244cd 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md @@ -5,7 +5,6 @@ title: Verify Provenance Document Exists # Verify Provenance Document Exists **Type:** Rule **ID:** `SLSA.L1` -**Uses:** `slsa/l1-provenance-exists@v2/rules` **Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml) **Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego) **Help:** https://slsa.dev/spec/v1.0/requirements diff --git a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md index 3b9bb1411..6be915c55 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -5,7 +5,6 @@ title: Verify that provenance is authenticated # Verify that provenance is authenticated **Type:** Rule **ID:** `SLSA.L2` -**Uses:** `slsa/l2-provenance-authenticated@v2/rules` **Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml) **Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego) **Help:** https://slsa.dev/spec/v1.0/requirements diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md index a69d195fd..55ecede25 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md @@ -5,7 +5,6 @@ title: Verify that artifact was created by the specified builder # Verify that artifact was created by the specified builder **Type:** Rule **ID:** `slsa-verify-builder` -**Uses:** `slsa/verify-builder@v2/rules` **Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml) **Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego) **Labels:** SLSA, Image diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md index 628610063..c5ed5e430 100644 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md @@ -5,7 +5,6 @@ title: Verify that artifact has no disallowed builder dependencies # Verify that artifact has no disallowed builder dependencies **Type:** Rule **ID:** `slsa-verify-byproducts` -**Uses:** `slsa/verify-byproducts@v2/rules` **Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml) **Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego) **Labels:** SLSA, Image diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md index f84ae4836..53f8731f8 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md @@ -5,7 +5,6 @@ title: Enforce 2FA # Enforce 2FA **Type:** Rule **ID:** `PS.1.1` -**Uses:** `ssdf/ps-1-2fa@v2/rules` **Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md index 92ba07249..9f23a8ac5 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -5,7 +5,6 @@ title: Branch protected # Branch protected **Type:** Rule **ID:** `PS.1.2` -**Uses:** `ssdf/ps-1-branch-protection@v2/rules` **Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md index 6ecb48c36..dfac15c63 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -5,7 +5,6 @@ title: Limit admins # Limit admins **Type:** Rule **ID:** `PS.1.3` -**Uses:** `ssdf/ps-1-limit-admins@v2/rules` **Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md index 11502a208..b2e8d4604 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md @@ -5,7 +5,6 @@ title: Repo private # Repo private **Type:** Rule **ID:** `PS.1.4` -**Uses:** `ssdf/ps-1-repo-private@v2/rules` **Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 533da72f4..c238474c6 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -5,7 +5,6 @@ title: Require signoff on web commits # Require signoff on web commits **Type:** Rule **ID:** `PS.1.5` -**Uses:** `ssdf/ps-1-web-commit-signoff@v2/rules` **Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md index 7b217e8a0..33875b4f5 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -5,7 +5,6 @@ title: Image-verifiable # Image-verifiable **Type:** Rule **ID:** `PS.2` -**Uses:** `ssdf/ps-2-image-verifiable@v2/rules` **Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md index 509acc548..55949571f 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -5,7 +5,6 @@ title: Code archived # Code archived **Type:** Rule **ID:** `PS.3.1` -**Uses:** `ssdf/ps-3.1-code-archived@v2/rules` **Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) **Labels:** SSDF diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 6537b2e59..9ec173cac 100644 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -5,7 +5,6 @@ title: SBOM archived # SBOM archived **Type:** Rule **ID:** `PS.3.2` -**Uses:** `ssdf/ps-3.2-archived-sbom@v2/rules` **Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) **Labels:** SSDF diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 540c3f013..d84dd3652 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -307,7 +307,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo ## Rules ### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -324,7 +324,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | ### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -347,7 +347,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/valint/sbom) +**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| @@ -358,7 +358,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | ### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/valint/sarif) +**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| @@ -378,7 +378,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| @@ -386,52 +386,8 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | | [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | -### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | - -### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | - -### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | - -### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | - -### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#dockerhub-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | - ### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -458,7 +414,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | ### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#github-discovery) +**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| @@ -480,7 +436,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -497,7 +453,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | ### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| @@ -540,16 +496,8 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | | [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | -### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#jenkins-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | - ### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -561,7 +509,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| @@ -569,8 +517,60 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | | [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | +### Bitbucket Project Discovery Evidence +**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | + +### Bitbucket Repository Discovery Evidence +**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | + +### Bitbucket Workspace Discovery Evidence +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | + +### Discovery Evidence +**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) + +| Rule Name | Description | +|-----------|-------------| +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | + +### Dockerhub Project Discovery Evidence +**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | + +### Jenkins Instance Discovery Evidence +**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) + +| Rule Name | Description | +|-----------|-------------| +| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | +| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | + ### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/valint/help/valint_slsa) +**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| @@ -583,7 +583,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | ### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/valint/generic) +**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| From 17b2e1b761e04532ea21b766a21863ff7d0da9fe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:36:05 +0200 Subject: [PATCH 145/191] update index location --- .../v2/initiatives/_category_.json | 4 - docs/configuration/v2/initiatives/bp1.md | 261 --------------- docs/configuration/v2/initiatives/index.md | 312 ------------------ .../v2/initiatives/rules/_category_.json | 4 - .../v2/initiatives/rules/api/_category_.json | 4 - .../rules/api/scribe-api-cve-product.md | 36 -- .../initiatives/rules/api/scribe-api-cve.md | 61 ---- .../rules/api/scribe-api-published.md | 54 --- .../v2/initiatives/rules/api/scribe-api.md | 34 -- .../rules/bitbucket/_category_.json | 4 - .../rules/bitbucket/project/_category_.json | 4 - .../rules/bitbucket/project/allow-admins.md | 36 -- .../rules/bitbucket/project/allow-users.md | 36 -- .../bitbucket/project/exposed-credentials.md | 32 -- .../bitbucket/project/long-live-tokens.md | 36 -- .../bitbucket/repository/_category_.json | 4 - .../bitbucket/repository/allow-admins.md | 37 --- .../rules/bitbucket/repository/allow-users.md | 37 --- .../bitbucket/repository/branch-protection.md | 37 --- .../rules/bitbucket/workspace/_category_.json | 4 - .../rules/bitbucket/workspace/allow-admins.md | 37 --- .../rules/bitbucket/workspace/allow-users.md | 37 --- .../rules/dockerhub/_category_.json | 4 - .../rules/dockerhub/token-expiration.md | 48 --- .../rules/dockerhub/token-not-used.md | 42 --- .../initiatives/rules/generic/_category_.json | 4 - .../rules/generic/artifact-signed.md | 37 --- .../rules/generic/evidence-exists.md | 36 -- .../rules/generic/k8s-jailbreak.md | 31 -- .../initiatives/rules/generic/trivy-exists.md | 29 -- .../v2/initiatives/rules/git/_category_.json | 4 - .../initiatives/rules/git/artifact-signed.md | 63 ---- .../rules/git/coding-permissions.md | 59 ---- .../initiatives/rules/git/evidence-exists.md | 45 --- .../rules/git/no-commit-to-main.md | 50 --- .../rules/git/no-unsigned-commits.md | 51 --- .../initiatives/rules/github/_category_.json | 4 - .../rules/github/api/_category_.json | 4 - .../rules/github/api/branch-protection.md | 29 -- .../rules/github/api/signed-commits-list.md | 28 -- .../rules/github/api/signed-commits-range.md | 30 -- .../v2/initiatives/rules/github/org/2fa.md | 57 ---- .../rules/github/org/_category_.json | 4 - .../rules/github/org/advanced-security.md | 37 --- .../rules/github/org/allow-admins.md | 37 --- .../rules/github/org/allow-users.md | 37 --- .../rules/github/org/create-private-repos.md | 37 --- .../rules/github/org/create-repos.md | 37 --- .../rules/github/org/dependabot-alerts.md | 37 --- .../org/dependabot-security-updates-sa.md | 32 -- .../github/org/dependabot-security-updates.md | 37 --- .../rules/github/org/dependency-graph.md | 37 --- .../rules/github/org/max-admins.md | 37 --- .../rules/github/org/old-secrets.md | 37 --- .../rules/github/org/pp-custom-link.md | 37 --- .../rules/github/org/push-protection-sa.md | 32 -- .../rules/github/org/push-protection.md | 38 --- .../rules/github/org/repo-visibility.md | 37 --- .../rules/github/org/secret-scanning-sa.md | 32 -- .../rules/github/org/secret-scanning.md | 37 --- .../rules/github/org/validity-checks-sa.md | 32 -- .../rules/github/org/validity-checks.md | 37 --- .../rules/github/org/web-commit-signoff.md | 32 -- .../rules/github/repository/_category_.json | 4 - .../github/repository/branch-protection.md | 38 --- .../github/repository/branch-verification.md | 37 --- .../github/repository/check-signed-commits.md | 32 -- .../repository/default-branch-protection.md | 32 -- .../rules/github/repository/dependabot.md | 32 -- .../repository/ephemeral-runners-only.md | 32 -- .../rules/github/repository/no-cache-usage.md | 32 -- .../rules/github/repository/no-org-secrets.md | 32 -- .../rules/github/repository/old-secrets.md | 37 --- .../github/repository/push-protection.md | 32 -- .../rules/github/repository/repo-private.md | 32 -- .../github/repository/secret-scanning.md | 32 -- .../rules/github/repository/signed-commits.md | 32 -- .../github/repository/validity-checks.md | 32 -- .../rules/github/repository/visibility.md | 37 --- .../github/repository/web-commit-signoff.md | 32 -- .../initiatives/rules/gitlab/_category_.json | 4 - .../rules/gitlab/api/_category_.json | 4 - .../rules/gitlab/api/push-rules.md | 27 -- .../rules/gitlab/api/signed-commits-list.md | 27 -- .../rules/gitlab/api/signed-commits-range.md | 28 -- .../rules/gitlab/org/_category_.json | 4 - .../rules/gitlab/org/allow-admins.md | 37 --- .../rules/gitlab/org/allow-token-scopes.md | 37 --- .../rules/gitlab/org/allow-users.md | 37 --- .../rules/gitlab/org/blocked-users.md | 37 --- .../rules/gitlab/org/expiring-tokens.md | 37 --- .../rules/gitlab/org/forbid-token-scopes.md | 37 --- .../rules/gitlab/org/inactive-projects.md | 37 --- .../rules/gitlab/org/longlive-tokens.md | 37 --- .../rules/gitlab/org/max-admins.md | 37 --- .../rules/gitlab/org/projects-visibility.md | 37 --- .../rules/gitlab/org/unused-tokens.md | 37 --- .../rules/gitlab/pipeline/_category_.json | 4 - .../gitlab/pipeline/verify-labels-exist.md | 37 --- .../rules/gitlab/pipeline/verify-labels.md | 37 --- .../rules/gitlab/project/_category_.json | 4 - .../rules/gitlab/project/abandoned-project.md | 37 --- .../gitlab/project/approvals-policy-check.md | 38 --- .../project/approvers-per-merge-request.md | 37 --- .../gitlab/project/author-email-regex.md | 37 --- .../rules/gitlab/project/check-cwe.md | 37 --- .../gitlab/project/check-signed-commits.md | 32 -- .../gitlab/project/co-approval-required.md | 37 --- .../project/commit-author-email-check.md | 37 --- .../project/commit-author-name-check.md | 37 --- .../gitlab/project/commit-committer-check.md | 32 -- .../gitlab/project/commit-message-check.md | 37 --- .../rules/gitlab/project/commits-validated.md | 32 -- .../gitlab/project/committer-email-check.md | 37 --- .../gitlab/project/committer-name-check.md | 37 --- .../gitlab/project/critical-severity-limit.md | 37 --- .../project/description-substring-check.md | 37 --- .../project/disallowed-banned-approvers.md | 37 --- .../gitlab/project/force-push-protection.md | 37 --- .../gitlab/project/medium-severity-limit.md | 37 --- .../rules/gitlab/project/member-check.md | 32 -- .../gitlab/project/merge-access-level.md | 38 --- .../project/merge-requests-author-approval.md | 37 --- ...ge-requests-disable-committers-approval.md | 37 --- .../gitlab/project/message-substring-check.md | 37 --- .../gitlab/project/prevent-secrets-check.md | 32 -- .../gitlab/project/protect-ci-secrets.md | 37 --- .../rules/gitlab/project/push-access-level.md | 38 --- .../rules/gitlab/project/push-rules-set.md | 32 -- .../gitlab/project/reject-unsigned-commits.md | 32 -- .../project/require-password-to-approve.md | 37 --- .../project/required-minimal-approvers.md | 32 -- .../gitlab/project/reset-pprovals-on-push.md | 37 --- .../rules/gitlab/project/sast-scan-pass.md | 32 -- .../rules/gitlab/project/sast-scanning.md | 32 -- .../rules/gitlab/project/secrets-scan-pass.md | 32 -- .../rules/gitlab/project/secrets-scanning.md | 32 -- .../project/selective-code-owner-removals.md | 37 --- .../rules/gitlab/project/visibility-check.md | 37 --- .../initiatives/rules/images/_category_.json | 4 - .../rules/images/allowed-base-image.md | 72 ---- .../rules/images/allowed-image-source.md | 69 ---- .../initiatives/rules/images/banned-ports.md | 74 ----- .../initiatives/rules/images/banned-users.md | 67 ---- .../rules/images/blocklist-build-scripts.md | 56 ---- .../rules/images/blocklist-user.md | 38 --- .../rules/images/enforce-https-registry.md | 47 --- .../rules/images/forbid-large-images.md | 63 ---- .../rules/images/fresh-base-image.md | 64 ---- .../initiatives/rules/images/fresh-image.md | 64 ---- .../initiatives/rules/images/image-signed.md | 72 ---- .../rules/images/require-healthcheck.md | 51 --- .../rules/images/restrict-shell-entrypoint.md | 45 --- .../rules/images/verify-labels-exist.md | 68 ---- .../initiatives/rules/images/verify-labels.md | 64 ---- .../initiatives/rules/jenkins/_category_.json | 4 - .../rules/jenkins/folder/_category_.json | 4 - .../jenkins/folder/exposed-credentials.md | 32 -- .../rules/jenkins/instance/_category_.json | 4 - .../rules/jenkins/instance/inactive-users.md | 36 -- .../rules/jenkins/instance/unused-users.md | 31 -- .../v2/initiatives/rules/k8s/_category_.json | 4 - .../rules/k8s/namespace/_category_.json | 4 - .../rules/k8s/namespace/allowed-images.md | 64 ---- .../rules/k8s/namespace/allowed-registries.md | 64 ---- .../namespace/verify-namespace-duration.md | 62 ---- .../namespace/verify-namespace-termination.md | 63 ---- .../k8s/namespace/white-listed-namespaces.md | 54 --- .../rules/k8s/namespace/white-listed-pod.md | 64 ---- .../rules/k8s/pods/_category_.json | 4 - .../rules/k8s/pods/verify-pod-duration.md | 62 ---- .../rules/k8s/pods/verify-pod-termination.md | 48 --- .../rules/k8s/pods/white-listed-pod.md | 67 ---- .../rules/multievidence/_category_.json | 4 - .../rules/multievidence/files_integrity.md | 37 --- .../initiatives/rules/sarif/_category_.json | 4 - .../rules/sarif/artifact-signed.md | 54 --- .../rules/sarif/evidence-exists.md | 42 --- .../rules/sarif/patcheck/_category_.json | 4 - .../rules/sarif/patcheck/updates-needed.md | 31 -- .../rules/sarif/report-iac-errors.md | 61 ---- .../rules/sarif/trivy/_category_.json | 4 - .../rules/sarif/trivy/blocklist-cve.md | 63 ---- .../sarif/trivy/report-trivy-iac-errors.md | 64 ---- .../rules/sarif/trivy/verify-cve-severity.md | 76 ----- .../sarif/trivy/verify-trivy-attack-vector.md | 49 --- .../rules/sarif/trivy/verify-trivy-report.md | 65 ---- .../rules/sarif/verify-attack-vector.md | 72 ---- .../initiatives/rules/sarif/verify-sarif.md | 64 ---- .../rules/sarif/verify-semgrep-report.md | 62 ---- .../rules/sarif/verify-tool-evidence.md | 53 --- .../initiatives/rules/sbom/NTIA-compliance.md | 88 ----- .../v2/initiatives/rules/sbom/_category_.json | 4 - .../rules/sbom/allowed-components.md | 71 ---- .../initiatives/rules/sbom/artifact-signed.md | 44 --- .../initiatives/rules/sbom/banned-licenses.md | 69 ---- .../rules/sbom/blocklist-packages.md | 40 --- .../rules/sbom/complete-licenses.md | 51 --- .../v2/initiatives/rules/sbom/fresh-sbom.md | 64 ---- .../v2/initiatives/rules/sbom/require-sbom.md | 55 --- .../rules/sbom/required-packages.md | 68 ---- .../rules/sbom/verify-huggingface-license.md | 70 ---- .../v2/initiatives/rules/slsa/_category_.json | 4 - .../rules/slsa/banned-builder-deps.md | 35 -- .../v2/initiatives/rules/slsa/build-time.md | 37 --- .../v2/initiatives/rules/slsa/field-exists.md | 36 -- .../rules/slsa/l1-provenance-exists.md | 44 --- .../rules/slsa/l2-provenance-authenticated.md | 50 --- .../initiatives/rules/slsa/verify-builder.md | 36 -- .../rules/slsa/verify-byproducts.md | 35 -- .../v2/initiatives/rules/ssdf/_category_.json | 4 - .../v2/initiatives/rules/ssdf/ps-1-2fa.md | 47 --- .../rules/ssdf/ps-1-branch-protection.md | 32 -- .../rules/ssdf/ps-1-limit-admins.md | 32 -- .../rules/ssdf/ps-1-repo-private.md | 32 -- .../rules/ssdf/ps-1-web-commit-signoff.md | 32 -- .../rules/ssdf/ps-2-image-verifiable.md | 32 -- .../rules/ssdf/ps-3.1-code-archived.md | 37 --- .../rules/ssdf/ps-3.2-archived-sbom.md | 27 -- docs/configuration/v2/initiatives/slsa.l1.md | 48 --- docs/configuration/v2/initiatives/slsa.l2.md | 49 --- .../v2/initiatives/sp-800-190.md | 89 ----- .../configuration/v2/initiatives/sp-800-53.md | 89 ----- docs/configuration/v2/initiatives/ssdf.md | 91 ----- scripts/sync_docs.sh | 2 +- 225 files changed, 1 insertion(+), 8896 deletions(-) delete mode 100644 docs/configuration/v2/initiatives/_category_.json delete mode 100644 docs/configuration/v2/initiatives/bp1.md delete mode 100644 docs/configuration/v2/initiatives/index.md delete mode 100644 docs/configuration/v2/initiatives/rules/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/api/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md delete mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md delete mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api-published.md delete mode 100644 docs/configuration/v2/initiatives/rules/api/scribe-api.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md delete mode 100644 docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md delete mode 100644 docs/configuration/v2/initiatives/rules/generic/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/generic/artifact-signed.md delete mode 100644 docs/configuration/v2/initiatives/rules/generic/evidence-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md delete mode 100644 docs/configuration/v2/initiatives/rules/generic/trivy-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/git/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/git/artifact-signed.md delete mode 100644 docs/configuration/v2/initiatives/rules/git/coding-permissions.md delete mode 100644 docs/configuration/v2/initiatives/rules/git/evidence-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md delete mode 100644 docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/github/api/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/github/api/branch-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/2fa.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/advanced-security.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/allow-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/allow-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/create-repos.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/max-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/old-secrets.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/push-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/validity-checks.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/dependabot.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/push-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/repo-private.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/visibility.md delete mode 100644 docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md delete mode 100644 docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/images/allowed-base-image.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/allowed-image-source.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/banned-ports.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/banned-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/blocklist-user.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/forbid-large-images.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/fresh-base-image.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/fresh-image.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/image-signed.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/require-healthcheck.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md delete mode 100644 docs/configuration/v2/initiatives/rules/images/verify-labels.md delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md delete mode 100644 docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md delete mode 100644 docs/configuration/v2/initiatives/rules/multievidence/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md delete mode 100644 docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/allowed-components.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/require-sbom.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/required-packages.md delete mode 100644 docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/build-time.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/field-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/verify-builder.md delete mode 100644 docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/_category_.json delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md delete mode 100644 docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md delete mode 100644 docs/configuration/v2/initiatives/slsa.l1.md delete mode 100644 docs/configuration/v2/initiatives/slsa.l2.md delete mode 100644 docs/configuration/v2/initiatives/sp-800-190.md delete mode 100644 docs/configuration/v2/initiatives/sp-800-53.md delete mode 100644 docs/configuration/v2/initiatives/ssdf.md diff --git a/docs/configuration/v2/initiatives/_category_.json b/docs/configuration/v2/initiatives/_category_.json deleted file mode 100644 index 6cd81f819..000000000 --- a/docs/configuration/v2/initiatives/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Reference: Policies and Configuration Guide", - "position": 999 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/bp1.md b/docs/configuration/v2/initiatives/bp1.md deleted file mode 100644 index 65d8e12d5..000000000 --- a/docs/configuration/v2/initiatives/bp1.md +++ /dev/null @@ -1,261 +0,0 @@ ---- -sidebar_label: Blueprint for Secure Pipelines -title: Blueprint for Secure Pipelines ---- -# Blueprint for Secure Pipelines -**Type:** Initiative -**ID:** `blueprint-securesoftwarepipeline` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/bp1.yaml) -**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline - -Blueprint for secure pipelines - Gitlab - -## **Description** - -This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [CT-1](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | -| [CT-3](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | -| [CT-4](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | -| [CT-6](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | -| [CT-8](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | -| [CT-9](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | -| [CT-11](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | -| [CT-12](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | -| [CT-13](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | True | - ---- - -# Detailed Controls - -## [CT-1] Restrict administrative access to CI/CD tools - -Restrict administrative access to CI/CD tools - - -### Mitigation -Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. - -### **Description** - -It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls. - -Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication. - -> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [gitlab-org-max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | - -## [CT-2] Only accept commits signed with a developer GPG key - -The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab - - -### Mitigation -Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. - -### **Description** - -Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers. - -> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | - -## [CT-3] Automation access keys expire automatically - -Automation access keys expire automatically - - -### Mitigation -Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. - -### **Description** - -Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised. - -> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | - -## [CT-4] Reduce automation access to read-only - -Reduce automation access to read-only - - -### Mitigation -Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. - -### **Description** - -CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. - -> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | - -## [CT-6] Any critical or high severity vulnerability breaks the build - -Any critical or high severity vulnerability breaks the build - - -### Mitigation -Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. - -### **Description** - -Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged. - -> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored. - -Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process. - -> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | - -## [CT-8] Validate artifact digest - -Validate artifact digest - - -### Mitigation -Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. - -### **Description** - -Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised. - -> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| sbom/evidence-exists@v2 | sbom/evidence-exists@v2 | | - -## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged - -Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged - - -### Mitigation -Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. - -### **Description** - -Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight. - -> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [gitlab-project-merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | - -## [CT-11] Available container images don’t have any high or critical vulnerabilities - -Available container images don’t have any high or critical vulnerabilities - - -### Mitigation -Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. - -### **Description** - -Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities. - -> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | - -## [CT-12] Validate artifact signatures and digests - -Validate artifact signatures and digests - - -### Mitigation -Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. - -### **Description** - -Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment. - -> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | - -## [CT-13] Scan deployed images in production - -Scan deployed images in production - - -### Mitigation -Continuously monitor and scan production images to ensure ongoing compliance with security standards. - -### **Description** - -Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production. - -> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/v2/initiatives/index.md b/docs/configuration/v2/initiatives/index.md deleted file mode 100644 index 1109250b0..000000000 --- a/docs/configuration/v2/initiatives/index.md +++ /dev/null @@ -1,312 +0,0 @@ -# Documentation Index - -## Initiatives - - -| Name | Description | -|------|-------------| -| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | -| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | -| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | - -## Rules - -### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) - -| Rule Name | Description | -|-----------|-------------| -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | -| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | -| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | - -### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) - -| Rule Name | Description | -|-----------|-------------| -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | -| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | -| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | -| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | -| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | - -### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) - -| Rule Name | Description | -|-----------|-------------| -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | -| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | -| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | - -### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | -| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | -| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | -| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | -| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | - -### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) - -| Rule Name | Description | -|-----------|-------------| -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | -| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | -| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | - -### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | -| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | -| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | -| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | -| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | -| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | - -### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | -| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | -| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | -| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | -| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | -| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | - -### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | -| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | -| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | -| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | -| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | - -### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | -| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | -| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | -| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | -| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | -| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | -| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | -| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | -| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | -| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | - -### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | -| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | -| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | -| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | - -### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | -| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | - -### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | - -### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | - -### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | - -### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) - -| Rule Name | Description | -|-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | - -### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | - -### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) - -| Rule Name | Description | -|-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | - -### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) - -| Rule Name | Description | -|-----------|-------------| -| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | -| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | -| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | - -### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) - -| Rule Name | Description | -|-----------|-------------| -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | -| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | -| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | -| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | diff --git a/docs/configuration/v2/initiatives/rules/_category_.json b/docs/configuration/v2/initiatives/rules/_category_.json deleted file mode 100644 index 46c5e5953..000000000 --- a/docs/configuration/v2/initiatives/rules/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Rule Configuration", - "position": 999 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/api/_category_.json b/docs/configuration/v2/initiatives/rules/api/_category_.json deleted file mode 100644 index 01fdec181..000000000 --- a/docs/configuration/v2/initiatives/rules/api/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Scribe API", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md deleted file mode 100644 index bd5f975eb..000000000 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve-product.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Verify No Critical or High Vulnerabilities in Product -title: Verify No Critical or High Vulnerabilities in Product ---- -# Verify No Critical or High Vulnerabilities in Product -**Type:** Rule -**ID:** `scribe-cve-product` -**Source:** [v2/rules/api/scribe-api-cve-product.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve-product.yaml) -**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) -**Labels:** SCA, Blueprint, Scribe - -Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::tip -Rule requires the Scribe API to be enabled. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. - - -## Description -This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. - - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| cve | list | False | List of CVEs to check against the product components. | - diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md deleted file mode 100644 index 0d260a3f7..000000000 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-cve.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -sidebar_label: Verify No Critical or High Vulnerabilities -title: Verify No Critical or High Vulnerabilities ---- -# Verify No Critical or High Vulnerabilities -**Type:** Rule -**ID:** `scribe-cve` -**Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) -**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) -**Labels:** SCA, Blueprint, Scribe - -Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). - -:::note -Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. -::: -:::tip -Rule requires the Scribe API to be enabled. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: api/scribe-api-cve@v2/rules -with: - superset: - cve: - max: 0 - severity: 6 -``` - -## Mitigation -Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. - - -## Description -This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format [cve: [max: int, severity: int]] | - diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md b/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md deleted file mode 100644 index 5d7cbca04..000000000 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api-published.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -sidebar_label: Scribe Published Policy -title: Scribe Published Policy ---- -# Scribe Published Policy -**Type:** Rule -**ID:** `scribe-published-policy` -**Source:** [v2/rules/api/scribe-api-published.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.yaml) -**Rego Source:** [scribe-api-published.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-published.rego) -**Labels:** Scribe - -Verify image Scribe Publish flag is set for container image. - -:::note -Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. -::: -:::tip -Rule requires the Scribe API to be enabled. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: api/scribe-api-published@v2/rules -with: - superset: - published: true -``` - -## Mitigation -Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. - - -## Description -This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format [published: [flag: bool]] | - diff --git a/docs/configuration/v2/initiatives/rules/api/scribe-api.md b/docs/configuration/v2/initiatives/rules/api/scribe-api.md deleted file mode 100644 index b7f531c1d..000000000 --- a/docs/configuration/v2/initiatives/rules/api/scribe-api.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -sidebar_label: Apply Scribe Template Policy -title: Apply Scribe Template Policy ---- -# Apply Scribe Template Policy -**Type:** Rule -**ID:** `scribe-template` -**Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) -**Labels:** Scribe - -Verify XX using the Scribe API template rule. - -:::tip -Rule requires the Scribe API to be enabled. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| predicate_type | https://cyclonedx.org/bom | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| superset | None | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json deleted file mode 100644 index e6515f2ae..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Bitbucket", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json deleted file mode 100644 index a88c9e5b1..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Project", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md deleted file mode 100644 index 567876755..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-admins.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Allowed Project Admins -title: Allowed Project Admins ---- -# Allowed Project Admins -**Type:** Rule -**ID:** `bb-project-allowed-project-admins` -**Source:** [v2/rules/bitbucket/project/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-admins.rego) - -Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. - -:::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md deleted file mode 100644 index f04cf6caa..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/allow-users.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Allowed Project Users -title: Allowed Project Users ---- -# Allowed Project Users -**Type:** Rule -**ID:** `bb-project-allowed-project-users` -**Source:** [v2/rules/bitbucket/project/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/allow-users.rego) - -Verify only users specified in the Allowed List have user access to the Bitbucket project. - -:::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md deleted file mode 100644 index 6a30f3015..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/exposed-credentials.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Prevent Credential Exposure -title: Prevent Credential Exposure ---- -# Prevent Credential Exposure -**Type:** Rule -**ID:** `bb-project-exposed-credentials` -**Source:** [v2/rules/bitbucket/project/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.yaml) -**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/exposed-credentials.rego) -**Labels:** Bitbucket, Project - -Verify access to the Bitbucket project is blocked if exposed credentials are detected. - -:::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md deleted file mode 100644 index e2b078419..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/project/long-live-tokens.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Prevent Long-Lived Tokens -title: Prevent Long-Lived Tokens ---- -# Prevent Long-Lived Tokens -**Type:** Rule -**ID:** `bb-project-long-live-tokens` -**Source:** [v2/rules/bitbucket/project/long-live-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.yaml) -**Rego Source:** [long-live-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/project/long-live-tokens.rego) -**Labels:** Bitbucket, Project - -Verify Bitbucket API tokens expire before the maximum time to live. - -:::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 30 | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json deleted file mode 100644 index e93f68442..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Repository", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md deleted file mode 100644 index c30c716c9..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Repository Admins -title: Allowed Repository Admins ---- -# Allowed Repository Admins -**Type:** Rule -**ID:** `bb-repo-allowed-repository-admins` -**Source:** [v2/rules/bitbucket/repository/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-admins.rego) -**Labels:** Bitbucket, Repository - -Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. - -:::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md deleted file mode 100644 index a24800589..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/allow-users.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Repository Users -title: Allowed Repository Users ---- -# Allowed Repository Users -**Type:** Rule -**ID:** `bb-repo-allowed-repository-users` -**Source:** [v2/rules/bitbucket/repository/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/allow-users.rego) -**Labels:** Bitbucket, Repository - -Verify only users specified in the Allowed List have user access to the Bitbucket repository. - -:::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md deleted file mode 100644 index e27ea2268..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/repository/branch-protection.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Default Branch Protection Setting Is Configured -title: Verify Default Branch Protection Setting Is Configured ---- -# Verify Default Branch Protection Setting Is Configured -**Type:** Rule -**ID:** `bb-repo-branch-protection` -**Source:** [v2/rules/bitbucket/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/repository/branch-protection.rego) -**Labels:** Bitbucket, Repository - -Verify the default branch protection is enabled in the Bitbucket repository. - -:::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branches | ['main'] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json deleted file mode 100644 index ed893c2ea..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Workspace", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md deleted file mode 100644 index b5e2d1c7b..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Workspace Admins -title: Allowed Workspace Admins ---- -# Allowed Workspace Admins -**Type:** Rule -**ID:** `bb-workspace-allowed-workspace-admins` -**Source:** [v2/rules/bitbucket/workspace/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-admins.rego) -**Labels:** Bitbucket, Workspace - -Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. - -:::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=workspace | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | - diff --git a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md deleted file mode 100644 index b3c5e4223..000000000 --- a/docs/configuration/v2/initiatives/rules/bitbucket/workspace/allow-users.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Workspace Users -title: Allowed Workspace Users ---- -# Allowed Workspace Users -**Type:** Rule -**ID:** `bb-workspace-allowed-workspace-users` -**Source:** [v2/rules/bitbucket/workspace/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/bitbucket/workspace/allow-users.rego) -**Labels:** Bitbucket, Workspace - -Verify only users specified in the Allowed List have user access to the Bitbucket workspace. - -:::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=bitbucket
- asset_type=workspace | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json b/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json deleted file mode 100644 index 7c6237a25..000000000 --- a/docs/configuration/v2/initiatives/rules/dockerhub/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Dockerhub", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md deleted file mode 100644 index 87ab4c5ea..000000000 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-expiration.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -sidebar_label: Verify DockerHub Tokens are Active -title: Verify DockerHub Tokens are Active ---- -# Verify DockerHub Tokens are Active -**Type:** Rule -**ID:** `dockerhub-token-expiration` -**Source:** [v2/rules/dockerhub/token-expiration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.yaml) -**Rego Source:** [token-expiration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-expiration.rego) -**Labels:** Dockerhub - -Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. - -:::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. - - -## Description -This rule verifies that all discovered Dockerhub tokens are set to Active in Dockerhub. -It performs the following steps: - -1. Iterates over the Dockerhub tokens in the project. -2. Checks each token's status against the Active status. - - If a token's status is not Active, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project
- platform=dockerhub | - diff --git a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md deleted file mode 100644 index b5a101bb0..000000000 --- a/docs/configuration/v2/initiatives/rules/dockerhub/token-not-used.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -sidebar_label: Verify no unused Dockerhub -title: Verify no unused Dockerhub ---- -# Verify no unused Dockerhub -**Type:** Rule -**ID:** `dockerhub-token-not-used` -**Source:** [v2/rules/dockerhub/token-not-used.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.yaml) -**Rego Source:** [token-not-used.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/dockerhub/token-not-used.rego) -**Labels:** Dockerhub - -Verify that there are no unused Dockerhub. - -:::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Description -This rule verifies that there are no unused Dockerhub. -It performs the following steps: - -1. Iterates over the Dockerhub tokens in the project. -2. Checks each token's last_used is null , the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=project
- platform=dockerhub | - diff --git a/docs/configuration/v2/initiatives/rules/generic/_category_.json b/docs/configuration/v2/initiatives/rules/generic/_category_.json deleted file mode 100644 index ab9d35851..000000000 --- a/docs/configuration/v2/initiatives/rules/generic/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Generic", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md b/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md deleted file mode 100644 index 43014375d..000000000 --- a/docs/configuration/v2/initiatives/rules/generic/artifact-signed.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Generic Artifact Signed -title: Generic Artifact Signed ---- -# Generic Artifact Signed -**Type:** Rule -**ID:** `generic-artifact-signed` -**Source:** [v2/rules/generic/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/artifact-signed.rego) -**Labels:** 3rd-party - -Verify required evidence is signed. - -:::note -This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | True | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | - diff --git a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md b/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md deleted file mode 100644 index 755d64a55..000000000 --- a/docs/configuration/v2/initiatives/rules/generic/evidence-exists.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Required Generic Evidence Exists -title: Required Generic Evidence Exists ---- -# Required Generic Evidence Exists -**Type:** Rule -**ID:** `generic-required-evidence` -**Source:** [v2/rules/generic/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/evidence-exists.rego) -**Labels:** 3rd-party - -Verify required evidence exists. - -:::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/generic/v0.1 | - diff --git a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md deleted file mode 100644 index e109441d6..000000000 --- a/docs/configuration/v2/initiatives/rules/generic/k8s-jailbreak.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -sidebar_label: K8s Jailbreak -title: K8s Jailbreak ---- -# K8s Jailbreak -**Type:** Rule -**ID:** `k8s-jailbreak` -**Source:** [v2/rules/generic/k8s-jailbreak.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.yaml) -**Rego Source:** [k8s-jailbreak.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/k8s-jailbreak.rego) -**Labels:** K8s - -Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| target_type | data | - diff --git a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md b/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md deleted file mode 100644 index 15dcc4d3c..000000000 --- a/docs/configuration/v2/initiatives/rules/generic/trivy-exists.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -sidebar_label: Required Trivy Evidence Exists -title: Required Trivy Evidence Exists ---- -# Required Trivy Evidence Exists -**Type:** Rule -**ID:** `required-trivy-evidence` -**Source:** [v2/rules/generic/trivy-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/trivy-exists.yaml) -**Labels:** 3rd-party - -Verify required Trivy evidence exists - -:::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| content_body_type | generic | -| target_type | data | -| predicate_type | https://aquasecurity.github.io/trivy/v0.42/docs/configuration/reporting/#json | - diff --git a/docs/configuration/v2/initiatives/rules/git/_category_.json b/docs/configuration/v2/initiatives/rules/git/_category_.json deleted file mode 100644 index 2a7a53690..000000000 --- a/docs/configuration/v2/initiatives/rules/git/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Git", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md b/docs/configuration/v2/initiatives/rules/git/artifact-signed.md deleted file mode 100644 index adba441c5..000000000 --- a/docs/configuration/v2/initiatives/rules/git/artifact-signed.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -sidebar_label: Git Artifact Signed -title: Git Artifact Signed ---- -# Git Artifact Signed -**Type:** Rule -**ID:** `git-artifact-signed` -**Source:** [v2/rules/git/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/artifact-signed.rego) -**Labels:** SBOM, Git - -Verify the Git artifact is signed. - -:::note -This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: git/artifact-signed@v2/rules -with: - identity: - emails: - - bob@company.com - - alice@company.com - skip_image_regex: - - .*alpine.* -``` - -## Mitigation -Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. - - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | True | -| content_body_type | cyclonedx-json | -| target_type | git | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| identity | `{'common-names': [], 'emails': []}` | - diff --git a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md b/docs/configuration/v2/initiatives/rules/git/coding-permissions.md deleted file mode 100644 index b4c85592c..000000000 --- a/docs/configuration/v2/initiatives/rules/git/coding-permissions.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -sidebar_label: Restrict Coding Permissions -title: Restrict Coding Permissions ---- -# Restrict Coding Permissions -**Type:** Rule -**ID:** `git-coding-permissions` -**Source:** [v2/rules/git/coding-permissions.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.yaml) -**Rego Source:** [coding-permissions.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/coding-permissions.rego) -**Labels:** SBOM, Git - -Verify only allowed users committed to the repository. - -:::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. - - - -## Description -This rule verifies that only allowed users have committed to the repository. -It performs the following steps: - -1. Iterates over the commits in the repository. -2. Checks each commit's author against the list of allowed user IDs. - - If a commit's author is not in the allowed list, the rule flags it as a violation. -3. Checks each committed file against the list of allowed files. - - If a committed file is not in the allowed list, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | git | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| ids | array | False | The list of user (commit.author) IDs allowed to commit to the repository. | -| files | array | False | The list of files that are allowed to be committed to the repository. | - diff --git a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md b/docs/configuration/v2/initiatives/rules/git/evidence-exists.md deleted file mode 100644 index 1726df4b0..000000000 --- a/docs/configuration/v2/initiatives/rules/git/evidence-exists.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -sidebar_label: Required Git Evidence Exists -title: Required Git Evidence Exists ---- -# Required Git Evidence Exists -**Type:** Rule -**ID:** `required-git-evidence` -**Source:** [v2/rules/git/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/evidence-exists.rego) -**Labels:** SBOM, Git - -Verify required Git evidence exists. - -:::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. - - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | git | - diff --git a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md deleted file mode 100644 index db13bcef5..000000000 --- a/docs/configuration/v2/initiatives/rules/git/no-commit-to-main.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -sidebar_label: Disallow Commits to Main Branch -title: Disallow Commits to Main Branch ---- -# Disallow Commits to Main Branch -**Type:** Rule -**ID:** `git-disallow-commits-to-main` -**Source:** [v2/rules/git/no-commit-to-main.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.yaml) -**Rego Source:** [no-commit-to-main.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-commit-to-main.rego) -**Labels:** SBOM, Git - -Verify commits made directly to the main branch are disallowed. - -:::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. - - -## Description -This rule ensures that no commits are made directly to the main or master branches. -It performs the following steps: - -1. Check SBOM target branch -2. If the target branch is the main or master branch, the rule looks for commit objects. -3. If commit objects are found, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | git | - diff --git a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md deleted file mode 100644 index d24a41b6a..000000000 --- a/docs/configuration/v2/initiatives/rules/git/no-unsigned-commits.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -sidebar_label: Disallow Unsigned Commits -title: Disallow Unsigned Commits ---- -# Disallow Unsigned Commits -**Type:** Rule -**ID:** `git-disallow-unsigned-commits` -**Source:** [v2/rules/git/no-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.yaml) -**Rego Source:** [no-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/git/no-unsigned-commits.rego) -**Labels:** Git - -Verify all commits are signed. - -:::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. - - -## Description -This rule ensures that all commits are signed. -It performs the following steps: - -1. Iterates over the commits in the repository. -2. For each Commit Rule inspects the 'PGPSignature' property of the commit, if it is not present, the rule flags it as a violation. - -**Evidence Requirements:** -- The Source SBOM evidence must be provided in the `cyclonedx-json` format. -- The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. -- The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | git | - diff --git a/docs/configuration/v2/initiatives/rules/github/_category_.json b/docs/configuration/v2/initiatives/rules/github/_category_.json deleted file mode 100644 index 174a64f21..000000000 --- a/docs/configuration/v2/initiatives/rules/github/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "GitHub", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/api/_category_.json b/docs/configuration/v2/initiatives/rules/github/api/_category_.json deleted file mode 100644 index e753985fa..000000000 --- a/docs/configuration/v2/initiatives/rules/github/api/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "GitHub API", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md deleted file mode 100644 index 69b6df675..000000000 --- a/docs/configuration/v2/initiatives/rules/github/api/branch-protection.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -sidebar_label: Branch protection enabled in GitHub repository -title: Branch protection enabled in GitHub repository ---- -# Branch protection enabled in GitHub repository -**Type:** Rule -**ID:** `github-api-branch-protection` -**Source:** [v2/rules/github/api/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/branch-protection.rego) -**Labels:** GitHub - -Verify GitHub branch protection rules - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| api_token | `{{ .Args.Token }}` | -| owner | `{{ .Args.Owner }}` | -| repo | `{{ .Args.Repo }}` | -| branch | `{{ .Args.Branch }}` | -| branch_protection_rules | `{'required_pull_request_reviews.dismiss_stale_reviews': True, 'required_pull_request_reviews.require_code_owner_reviews': False, 'required_pull_request_reviews.require_last_push_approval': False, 'required_pull_request_reviews.required_approving_review_count': 1, 'required_pull_request_reviews.bypass_pull_request_allowances.users': [], 'required_pull_request_reviews.bypass_pull_request_allowances.teams': [], 'required_pull_request_reviews.bypass_pull_request_allowances.apps': [], 'required_pull_request_reviews.dismissal_restrictions.users': [], 'required_pull_request_reviews.dismissal_restrictions.teams': [], 'required_pull_request_reviews.dismissal_restrictions.apps': [], 'required_status_checks.checks': [], 'required_status_checks.strict': False, 'required_status_checks.contexts': [], 'restrictions.users': [], 'restrictions.teams': [], 'restrictions.apps': [], 'required_signatures': False, 'enforce_admins': False, 'required_linear_history': False, 'allow_force_pushes': False, 'allow_deletions': True, 'block_creations': False, 'required_conversation_resolution': False, 'lock_branch': False, 'allow_fork_syncing': False}` | - diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md deleted file mode 100644 index 1baaf80f2..000000000 --- a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-list.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -sidebar_label: Verify Selected Commits Are Signed API -title: Verify Selected Commits Are Signed API ---- -# Verify Selected Commits Are Signed API -**Type:** Rule -**ID:** `github-api-signed-commits-list` -**Source:** [v2/rules/github/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.yaml) -**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-list.rego) -**Labels:** GitHub, API - -Verify selected commits are signed in the GitHub organization. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| commit_id_list | [] | -| access_token | | -| owner | | -| repo | | - diff --git a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md deleted file mode 100644 index af3785ad1..000000000 --- a/docs/configuration/v2/initiatives/rules/github/api/signed-commits-range.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -sidebar_label: Disallow Unsigned Commits In Time Range -title: Disallow Unsigned Commits In Time Range ---- -# Disallow Unsigned Commits In Time Range -**Type:** Rule -**ID:** `signed-commits-range` -**Source:** [v2/rules/github/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.yaml) -**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/api/signed-commits-range.rego) -**Labels:** GitHub - -Verify commits in the specified time range are signed. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| access_token | | -| owner | | -| repo | | -| since | None | -| until | None | -| sha | None | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/2fa.md b/docs/configuration/v2/initiatives/rules/github/org/2fa.md deleted file mode 100644 index ae5da3a0a..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/2fa.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -sidebar_label: Verify two_factor_requirement_enabled setting -title: Verify two_factor_requirement_enabled setting ---- -# Verify two_factor_requirement_enabled setting -**Type:** Rule -**ID:** `github-org-2fa` -**Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) -**Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) -**Labels:** GitHub, Organization - -Verify `two_factor_requirement` is enabled in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - - - -## Description -This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. -It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the -`organization_details.two_factor_requirement_enabled` field against the expected value. - -The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match -the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional -layer of security against unauthorized access. - -### **Evidence Requirements** -- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. -- The data should come from a trusted source (e.g., a GitHub organization scan). -- The evidence must clearly indicate whether 2FA is enabled. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/_category_.json b/docs/configuration/v2/initiatives/rules/github/org/_category_.json deleted file mode 100644 index 1ce17e465..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Org", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md b/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md deleted file mode 100644 index 0f5cb8cc3..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/advanced-security.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify advanced security setting is enabled -title: Verify advanced security setting is enabled ---- -# Verify advanced security setting is enabled -**Type:** Rule -**ID:** `github-org-advanced-security` -**Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) -**Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) -**Labels:** GitHub, Organization - -Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md deleted file mode 100644 index afeb2b2ad..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed GitHub Organization Admins -title: Allowed GitHub Organization Admins ---- -# Allowed GitHub Organization Admins -**Type:** Rule -**ID:** `github-orgallowed-admins` -**Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) -**Labels:** GitHub, Organization - -Verify only users in the Allowed List have admin privileges in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md b/docs/configuration/v2/initiatives/rules/github/org/allow-users.md deleted file mode 100644 index bac4a8911..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/allow-users.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed GitHub Organization Users -title: Allowed GitHub Organization Users ---- -# Allowed GitHub Organization Users -**Type:** Rule -**ID:** `github-org-allowed-users` -**Source:** [v2/rules/github/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-users.rego) -**Labels:** GitHub, Organization - -Verify only users in the Allowed List have user access to the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md deleted file mode 100644 index cfbee5cf9..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/create-private-repos.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify members_can_create_private_repositories setting -title: Verify members_can_create_private_repositories setting ---- -# Verify members_can_create_private_repositories setting -**Type:** Rule -**ID:** `github-org-create-private-repos` -**Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) -**Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) -**Labels:** GitHub, Organization - -Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md b/docs/configuration/v2/initiatives/rules/github/org/create-repos.md deleted file mode 100644 index 72760c946..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/create-repos.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify members_can_create_repositories setting -title: Verify members_can_create_repositories setting ---- -# Verify members_can_create_repositories setting -**Type:** Rule -**ID:** `github-org-create-repos` -**Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) -**Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) -**Labels:** GitHub, Organization - -Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md deleted file mode 100644 index 8181b5b5f..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-alerts.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify dependabot_alerts_enabled_for_new_repositories setting -title: Verify dependabot_alerts_enabled_for_new_repositories setting ---- -# Verify dependabot_alerts_enabled_for_new_repositories setting -**Type:** Rule -**ID:** `github-org-dependabot-alerts` -**Source:** [v2/rules/github/org/dependabot-alerts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.yaml) -**Rego Source:** [dependabot-alerts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-alerts.rego) -**Labels:** GitHub, Organization - -Verify Dependabot alerts for new repositories are enabled in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md deleted file mode 100644 index 56cb07e39..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify dependabot_security_updates setting in security_and_analysis -title: Verify dependabot_security_updates setting in security_and_analysis ---- -# Verify dependabot_security_updates setting in security_and_analysis -**Type:** Rule -**ID:** `github-org-dependabot-security-updates-sa` -**Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) -**Rego Source:** [dependabot-security-updates-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.rego) -**Labels:** GitHub, Organization - -Verify Dependabot security updates are configured in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md deleted file mode 100644 index 59c3eca94..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/dependabot-security-updates.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting -title: Verify dependabot_security_updates_enabled_for_new_repositories setting ---- -# Verify dependabot_security_updates_enabled_for_new_repositories setting -**Type:** Rule -**ID:** `github-org-dependabot-security-updates` -**Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) -**Rego Source:** [dependabot-security-updates.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.rego) -**Labels:** GitHub, Organization - -Verify Dependabot security updates for new repositories are configured in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md deleted file mode 100644 index 1506245b8..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/dependency-graph.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting -title: Verify dependency_graph_enabled_for_new_repositories setting ---- -# Verify dependency_graph_enabled_for_new_repositories setting -**Type:** Rule -**ID:** `github-org-dependency-graph` -**Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) -**Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) -**Labels:** GitHub, Organization - -Verify `dependency_graph` is enabled for new repositories in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md b/docs/configuration/v2/initiatives/rules/github/org/max-admins.md deleted file mode 100644 index 483f73dea..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/max-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Limit Admin Number in GitHub Organization -title: Limit Admin Number in GitHub Organization ---- -# Limit Admin Number in GitHub Organization -**Type:** Rule -**ID:** `github-org-max-admins` -**Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) -**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) -**Labels:** Blueprint, GitHub, Organization - -Verify the maximum number of GitHub organization admins is restricted. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md deleted file mode 100644 index d1df76007..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/old-secrets.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify GitHub Organization Secrets Are Not Too Old -title: Verify GitHub Organization Secrets Are Not Too Old ---- -# Verify GitHub Organization Secrets Are Not Too Old -**Type:** Rule -**ID:** `github-org-old-secrets` -**Source:** [v2/rules/github/org/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.yaml) -**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/old-secrets.rego) -**Labels:** GitHub, Organization - -Verify secrets in the GitHub organization are not older than the specified threshold. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_secret_age | 12 | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md deleted file mode 100644 index cd1d1da56..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/pp-custom-link.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting -title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting ---- -# Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting -**Type:** Rule -**ID:** `github-org-pp-custom-link` -**Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) -**Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md deleted file mode 100644 index c0d62d5c6..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection-sa.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning_Push_Protection Setting -title: Verify Secret_Scanning_Push_Protection Setting ---- -# Verify Secret_Scanning_Push_Protection Setting -**Type:** Rule -**ID:** `github-org-push-protection-sa` -**Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) -**Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning_push_protection` is configured in the GitHub repository. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md b/docs/configuration/v2/initiatives/rules/github/org/push-protection.md deleted file mode 100644 index 1beace40b..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/push-protection.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories - Setting -title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting ---- -# Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting -**Type:** Rule -**ID:** `github-org-push-protection` -**Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) -**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md deleted file mode 100644 index f8bb1c2b7..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/repo-visibility.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Repo Visibility Setting -title: Verify Repo Visibility Setting ---- -# Verify Repo Visibility Setting -**Type:** Rule -**ID:** `github-org-repo-visibility` -**Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) -**Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) -**Labels:** GitHub, Organization - -Verify only repositories in the Allowed List are public in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_repo_names | [] | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md deleted file mode 100644 index 3cd023f4a..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning-sa.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning Setting in Security_And_Analysis -title: Verify Secret_Scanning Setting in Security_And_Analysis ---- -# Verify Secret_Scanning Setting in Security_And_Analysis -**Type:** Rule -**ID:** `github-org-secret-scanning-sa` -**Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) -**Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning` is configured in the GitHub repository. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md deleted file mode 100644 index a13e8a48f..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/secret-scanning.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify secret_scanning_enabled_for_new_repositories setting -title: Verify secret_scanning_enabled_for_new_repositories setting ---- -# Verify secret_scanning_enabled_for_new_repositories setting -**Type:** Rule -**ID:** `github-org-secret-scanning` -**Source:** [v2/rules/github/org/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.yaml) -**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning` is enabled for new repositories in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md deleted file mode 100644 index 90d59da07..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks-sa.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis -title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis ---- -# Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis -**Type:** Rule -**ID:** `github-org-validity-checks-sa` -**Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) -**Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning_validity_checks` is configured in the GitHub organization. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md deleted file mode 100644 index 827210cb7..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/validity-checks.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Secret_Scanning_Validity_Checks_Enabled Setting -title: Verify Secret_Scanning_Validity_Checks_Enabled Setting ---- -# Verify Secret_Scanning_Validity_Checks_Enabled Setting -**Type:** Rule -**ID:** `github-org-validity-checks` -**Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) -**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) -**Labels:** GitHub, Organization - -Verify `secret_scanning_validity_checks` is configured in the GitHub repository. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md deleted file mode 100644 index 5639ddfde..000000000 --- a/docs/configuration/v2/initiatives/rules/github/org/web-commit-signoff.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify GitHub Organization Requires Signoff on Web Commits -title: Verify GitHub Organization Requires Signoff on Web Commits ---- -# Verify GitHub Organization Requires Signoff on Web Commits -**Type:** Rule -**ID:** `github-org-web-commit-signoff` -**Source:** [v2/rules/github/org/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.yaml) -**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) -**Labels:** GitHub, Organization - -Verify contributors sign commits through the GitHub web interface. - -:::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=organization | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/_category_.json b/docs/configuration/v2/initiatives/rules/github/repository/_category_.json deleted file mode 100644 index e93f68442..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Repository", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md deleted file mode 100644 index 315c00f8c..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-protection.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Verify Branch Protection Setting -title: Verify Branch Protection Setting ---- -# Verify Branch Protection Setting -**Type:** Rule -**ID:** `github-repo-branch-protection` -**Source:** [v2/rules/github/repository/branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.yaml) -**Rego Source:** [branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-protection.rego) -**Labels:** GitHub, Repository - -Verify branch protection is configured in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_protected | True | -| branches | ['main', 'master'] | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md deleted file mode 100644 index 723bc3496..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/branch-verification.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Branch Verification Setting -title: Verify Branch Verification Setting ---- -# Verify Branch Verification Setting -**Type:** Rule -**ID:** `github-repo-branch-verification` -**Source:** [v2/rules/github/repository/branch-verification.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.yaml) -**Rego Source:** [branch-verification.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/branch-verification.rego) -**Labels:** GitHub, Repository - -Verify branch verification in the GitHub repository matches the value defined in the configuration file. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_verified | False | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md deleted file mode 100644 index 3d388f009..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/check-signed-commits.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify All Commits Are Signed in Repository -title: Verify All Commits Are Signed in Repository ---- -# Verify All Commits Are Signed in Repository -**Type:** Rule -**ID:** `github-repo-signed-commits` -**Source:** [v2/rules/github/repository/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.yaml) -**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/check-signed-commits.rego) -**Labels:** GitHub, Repository - -Verify all commits in the GitHub repository are signed. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md deleted file mode 100644 index 9b5e1e6e9..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/default-branch-protection.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Default Branch Protection -title: Verify Default Branch Protection ---- -# Verify Default Branch Protection -**Type:** Rule -**ID:** `github-repo-default-branch-protection` -**Source:** [v2/rules/github/repository/default-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.yaml) -**Rego Source:** [default-branch-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/default-branch-protection.rego) -**Labels:** GitHub, Repository - -Verify the default branch protection is configured in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md b/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md deleted file mode 100644 index abbff1459..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/dependabot.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Dependabot security updates setting -title: Verify Dependabot security updates setting ---- -# Verify Dependabot security updates setting -**Type:** Rule -**ID:** `github-repo-dependabot` -**Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) -**Rego Source:** [dependabot.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.rego) -**Labels:** GitHub, Repository - -Verify Dependabot security updates are configured in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md deleted file mode 100644 index 572fbe2b8..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/ephemeral-runners-only.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Only Ephemeral Runners Exist in Repository -title: Verify Only Ephemeral Runners Exist in Repository ---- -# Verify Only Ephemeral Runners Exist in Repository -**Type:** Rule -**ID:** `github-repo-ephemeral-runners-only` -**Source:** [v2/rules/github/repository/ephemeral-runners-only.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.yaml) -**Rego Source:** [ephemeral-runners-only.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/ephemeral-runners-only.rego) -**Labels:** GitHub, Repository - -Verify self-hosted runners are disallowed in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md deleted file mode 100644 index 5562f259f..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-cache-usage.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify No Cache Usage Exists in Repository -title: Verify No Cache Usage Exists in Repository ---- -# Verify No Cache Usage Exists in Repository -**Type:** Rule -**ID:** `github-repo-no-cache-usage` -**Source:** [v2/rules/github/repository/no-cache-usage.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.yaml) -**Rego Source:** [no-cache-usage.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-cache-usage.rego) -**Labels:** GitHub, Repository - -Verify the GitHub repository has no cache usage. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md deleted file mode 100644 index 912288d43..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/no-org-secrets.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify No Organization Secrets Exist in Repository -title: Verify No Organization Secrets Exist in Repository ---- -# Verify No Organization Secrets Exist in Repository -**Type:** Rule -**ID:** `github-repo-no-org-secrets` -**Source:** [v2/rules/github/repository/no-org-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.yaml) -**Rego Source:** [no-org-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/no-org-secrets.rego) -**Labels:** GitHub, Repository - -Verify no organization secrets exist in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md deleted file mode 100644 index 52b136720..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/old-secrets.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify No Old Secrets Exist in Repository -title: Verify No Old Secrets Exist in Repository ---- -# Verify No Old Secrets Exist in Repository -**Type:** Rule -**ID:** `github-repo-old-secrets` -**Source:** [v2/rules/github/repository/old-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.yaml) -**Rego Source:** [old-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/old-secrets.rego) -**Labels:** GitHub, Repository - -Verify secrets in the GitHub repository are not older than the specified threshold. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_secret_age | 12 | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md b/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md deleted file mode 100644 index c8be2eccd..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/push-protection.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Push Protection Setting -title: Verify Push Protection Setting ---- -# Verify Push Protection Setting -**Type:** Rule -**ID:** `github-repo-push-protection` -**Source:** [v2/rules/github/repository/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.yaml) -**Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) -**Labels:** GitHub, Repository - -Verify `secret_scanning_push_protection` is configured in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md b/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md deleted file mode 100644 index 4f643335a..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/repo-private.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Repository Is Private -title: Verify Repository Is Private ---- -# Verify Repository Is Private -**Type:** Rule -**ID:** `github-repo-private` -**Source:** [v2/rules/github/repository/repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.yaml) -**Rego Source:** [repo-private.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/repo-private.rego) -**Labels:** GitHub, Repository - -Verify the GitHub repository is private. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md deleted file mode 100644 index 587ff9ae0..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/secret-scanning.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify secret_scanning setting -title: Verify secret_scanning setting ---- -# Verify secret_scanning setting -**Type:** Rule -**ID:** `github-repo-secret-scanning` -**Source:** [v2/rules/github/repository/secret-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.yaml) -**Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) -**Labels:** GitHub, Repository - -Verify `secret_scanning` is configured in the GitHub repository. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md deleted file mode 100644 index f6e2a27c4..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/signed-commits.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify All Commits Are Signed in Repository -title: Verify All Commits Are Signed in Repository ---- -# Verify All Commits Are Signed in Repository -**Type:** Rule -**ID:** `github-repo-signed-commits` -**Source:** [v2/rules/github/repository/signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.yaml) -**Rego Source:** [signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/signed-commits.rego) -**Labels:** GitHub, Repository - -Verify all commits are signed in a repository attestation. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md deleted file mode 100644 index 190a3af0d..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/validity-checks.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify secret scanning. -title: Verify secret scanning. ---- -# Verify secret scanning. -**Type:** Rule -**ID:** `github-repo-validity-checks` -**Source:** [v2/rules/github/repository/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.yaml) -**Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) -**Labels:** GitHub, Repository - -Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md b/docs/configuration/v2/initiatives/rules/github/repository/visibility.md deleted file mode 100644 index 21aaada2a..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/visibility.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Public Repositories -title: Allowed Public Repositories ---- -# Allowed Public Repositories -**Type:** Rule -**ID:** `github-repo-visibility` -**Source:** [v2/rules/github/repository/visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.yaml) -**Rego Source:** [visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/visibility.rego) -**Labels:** GitHub, Repository - -Verify only GitHub repositories in the Allowed List are public. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_repo_names | [] | - diff --git a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md deleted file mode 100644 index e7d7fe222..000000000 --- a/docs/configuration/v2/initiatives/rules/github/repository/web-commit-signoff.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Repository Requires Commit Signoff -title: Verify Repository Requires Commit Signoff ---- -# Verify Repository Requires Commit Signoff -**Type:** Rule -**ID:** `github-repo-web-commit-signoff` -**Source:** [v2/rules/github/repository/web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.yaml) -**Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/web-commit-signoff.rego) -**Labels:** GitHub, Repository - -Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. - -:::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=github
- asset_type=repository | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/_category_.json deleted file mode 100644 index d41c80a07..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Gitlab", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json deleted file mode 100644 index 1cd6c97e0..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Gitlab API", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md deleted file mode 100644 index 046bd9576..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/push-rules.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -sidebar_label: Set Push Rules in GitLab -title: Set Push Rules in GitLab ---- -# Set Push Rules in GitLab -**Type:** Rule -**ID:** `gitlab-api-push-rules` -**Source:** [v2/rules/gitlab/api/push-rules.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.yaml) -**Rego Source:** [push-rules.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/push-rules.rego) -**Labels:** Gitlab, API - -Verify GitLab push rules are configured via the API. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| api_token | `{{ .Args.Token }}` | -| project | `{{ .Args.Project }}` | -| push_rule | `{'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None}` | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md deleted file mode 100644 index 92e04c992..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-list.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -sidebar_label: Sign Selected Commits in GitLab -title: Sign Selected Commits in GitLab ---- -# Sign Selected Commits in GitLab -**Type:** Rule -**ID:** `gitlab-api-signed-commits-list` -**Source:** [v2/rules/gitlab/api/signed-commits-list.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.yaml) -**Rego Source:** [signed-commits-list.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-list.rego) -**Labels:** Gitlab, API - -Verify the selected commits are signed in the GitLab organization. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| commit_id_list | [] | -| private_token | | -| project_id | | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md deleted file mode 100644 index 4d8cb10e6..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/api/signed-commits-range.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -sidebar_label: Sign Selected Commit Range in GitLab -title: Sign Selected Commit Range in GitLab ---- -# Sign Selected Commit Range in GitLab -**Type:** Rule -**ID:** `gitlab-api-signed-commits-range` -**Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) -**Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) -**Labels:** Gitlab, API - -Verify the selected range of commits is signed via the GitLab API. - -:::tip -Evidence **IS NOT** required for this rule. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| since | | -| until | | -| project_id | | -| private_token | | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json deleted file mode 100644 index 1ce17e465..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Org", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md deleted file mode 100644 index a2f8911a4..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Admins in GitLab Organization -title: Allowed Admins in GitLab Organization ---- -# Allowed Admins in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-allowed-admins` -**Source:** [v2/rules/gitlab/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.yaml) -**Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-admins.rego) -**Labels:** Gitlab, Organization - -Verify only users in the Allowed List have admin privileges in the GitLab organization. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md deleted file mode 100644 index 257f6ca94..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-token-scopes.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Restrict Token Scopes in GitLab -title: Restrict Token Scopes in GitLab ---- -# Restrict Token Scopes in GitLab -**Type:** Rule -**ID:** `gitlab-org-allowed-token-scope` -**Source:** [v2/rules/gitlab/org/allow-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.yaml) -**Rego Source:** [allow-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-token-scopes.rego) -**Labels:** Gitlab, Organization - -Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_token_scopes | ['api', 'read_api', 'read_repository', 'read_registry'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md deleted file mode 100644 index 64bcb0745..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/allow-users.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Users in GitLab Organization -title: Allowed Users in GitLab Organization ---- -# Allowed Users in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-allowed-users` -**Source:** [v2/rules/gitlab/org/allow-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.yaml) -**Rego Source:** [allow-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/allow-users.rego) -**Labels:** Gitlab, Organization - -Verify only users in the Allowed List have access to the GitLab organization. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md deleted file mode 100644 index 614ca946d..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/blocked-users.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Block Users in GitLab Organization -title: Block Users in GitLab Organization ---- -# Block Users in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-blocked-users` -**Source:** [v2/rules/gitlab/org/blocked-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.yaml) -**Rego Source:** [blocked-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/blocked-users.rego) -**Labels:** Gitlab, Organization - -Verify no users in the GitLab organization are on the block list. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocked_users | [] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md deleted file mode 100644 index fbaa4782f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/expiring-tokens.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Prevent Token Expiration in GitLab Organization -title: Prevent Token Expiration in GitLab Organization ---- -# Prevent Token Expiration in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-token-about-to-expire` -**Source:** [v2/rules/gitlab/org/expiring-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.yaml) -**Rego Source:** [expiring-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/expiring-tokens.rego) -**Labels:** Gitlab, Organization - -Verify no GitLab organization tokens are about to expire. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| exiring_in_days | 30 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md deleted file mode 100644 index d194cd96e..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Forbid Token Scopes in GitLab Organization -title: Forbid Token Scopes in GitLab Organization ---- -# Forbid Token Scopes in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-disallowed-token-scope` -**Source:** [v2/rules/gitlab/org/forbid-token-scopes.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.yaml) -**Rego Source:** [forbid-token-scopes.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/forbid-token-scopes.rego) -**Labels:** Blueprint, Gitlab, Organization - -Verify no GitLab organization tokens have disallowed scopes. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| project_scopes | ['write_api', 'write_repository'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md deleted file mode 100644 index 295a1c1a6..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/inactive-projects.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Ensure Active Projects in GitLab Organization -title: Ensure Active Projects in GitLab Organization ---- -# Ensure Active Projects in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-inactive-projects` -**Source:** [v2/rules/gitlab/org/inactive-projects.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.yaml) -**Rego Source:** [inactive-projects.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/inactive-projects.rego) -**Labels:** Gitlab, Organization - -Verify no GitLab organization projects are inactive. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 90 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md deleted file mode 100644 index 6303bf36f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/longlive-tokens.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Forbid Long-Lived Tokens in GitLab Organization -title: Forbid Long-Lived Tokens in GitLab Organization ---- -# Forbid Long-Lived Tokens in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-token-excessive-lifespan` -**Source:** [v2/rules/gitlab/org/longlive-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.yaml) -**Rego Source:** [longlive-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/longlive-tokens.rego) -**Labels:** Blueprint, Gitlab, Organization - -Verify no GitLab organization tokens have an excessively long lifespan. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| exiring_in_days | 365 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md deleted file mode 100644 index 80360d979..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/max-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Limit Admins in GitLab Organization -title: Limit Admins in GitLab Organization ---- -# Limit Admins in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-max-admins` -**Source:** [v2/rules/gitlab/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.yaml) -**Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/max-admins.rego) -**Labels:** Blueprint, GitLab, Organization - -Verify the maximum number of admins for the GitLab project is restricted. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md deleted file mode 100644 index 6f7bbbcdd..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/projects-visibility.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Restrict Public Visibility in GitLab Organization -title: Restrict Public Visibility in GitLab Organization ---- -# Restrict Public Visibility in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-allowed-visible-projects` -**Source:** [v2/rules/gitlab/org/projects-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.yaml) -**Rego Source:** [projects-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/projects-visibility.rego) -**Labels:** Gitlab, Organization - -Verify only allowed projects in the GitLab organization have public visibility. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_public | ['Learn GitLab', 'Scribe Gitlab Test'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md deleted file mode 100644 index 8bf0c8cb6..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/org/unused-tokens.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Forbid Unused Tokens in GitLab Organization -title: Forbid Unused Tokens in GitLab Organization ---- -# Forbid Unused Tokens in GitLab Organization -**Type:** Rule -**ID:** `gitlab-org-unused-tokens` -**Source:** [v2/rules/gitlab/org/unused-tokens.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.yaml) -**Rego Source:** [unused-tokens.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/org/unused-tokens.rego) -**Labels:** Gitlab, Organization - -Verify there are no unused GitLab organization tokens. - -:::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=organization | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| unused_for_days | 90 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json deleted file mode 100644 index a57065cbf..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Pipeline", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md deleted file mode 100644 index 91b4d96cb..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: GitLab pipeline verify labels exist -title: GitLab pipeline verify labels exist ---- -# GitLab pipeline verify labels exist -**Type:** Rule -**ID:** `gitlab-pipeline-verify-labels-exist` -**Source:** [v2/rules/gitlab/pipeline/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.yaml) -**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels-exist.rego) -**Labels:** Gitlab, Pipeline - -Verify the pipeline has all required label keys and values. - -:::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pipeline | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | ['app.kubernetes.io/instance'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md deleted file mode 100644 index ddb89d453..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/pipeline/verify-labels.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify GitLab Pipeline Labels -title: Verify GitLab Pipeline Labels ---- -# Verify GitLab Pipeline Labels -**Type:** Rule -**ID:** `gitlab-pipeline-verify-labels` -**Source:** [v2/rules/gitlab/pipeline/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.yaml) -**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/pipeline/verify-labels.rego) -**Labels:** Gitlab, Pipeline - -Verify the pipeline includes all required label keys and values. - -:::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pipeline | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | `{'app.kubernetes.io/instance': 'defaul1t'}` | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json b/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json deleted file mode 100644 index a88c9e5b1..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Project", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md deleted file mode 100644 index d2c53cd07..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/abandoned-project.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Project Activity -title: Verify Project Activity ---- -# Verify Project Activity -**Type:** Rule -**ID:** `gitlab-project-abandoned-project` -**Source:** [v2/rules/gitlab/project/abandoned-project.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.yaml) -**Rego Source:** [abandoned-project.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/abandoned-project.rego) -**Labels:** Gitlab, Project - -Verify the GitLab project is active for a specified duration. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 30 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md deleted file mode 100644 index 9485a24db..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvals-policy-check.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Merge approval policy check for GitLab project -title: Merge approval policy check for GitLab project ---- -# Merge approval policy check for GitLab project -**Type:** Rule -**ID:** `gitlab-project-merge-approval` -**Source:** [v2/rules/gitlab/project/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.yaml) -**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvals-policy-check.rego) -**Labels:** Blueprint, Gitlab, Project - -Verify the project's merge approval policy complies with requirements. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| name | All Members | -| approvals_required_min | 2 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md deleted file mode 100644 index d6491877b..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Restrict Approvers Per Merge Request -title: Restrict Approvers Per Merge Request ---- -# Restrict Approvers Per Merge Request -**Type:** Rule -**ID:** `gitlab-project-approvers-per-merge-request` -**Source:** [v2/rules/gitlab/project/approvers-per-merge-request.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.yaml) -**Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) -**Labels:** Gitlab, Project - -Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| disable_overriding_approvers_per_merge_request | False | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md deleted file mode 100644 index f0bef95b6..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/author-email-regex.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Set Author Email Regex in GitLab Project -title: Set Author Email Regex in GitLab Project ---- -# Set Author Email Regex in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-author-email-regex` -**Source:** [v2/rules/gitlab/project/author-email-regex.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.yaml) -**Rego Source:** [author-email-regex.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/author-email-regex.rego) -**Labels:** Gitlab, Project - -Verify the `author_email_regex` for the GitLab project is set to the specified value. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| author_email_regex | | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md deleted file mode 100644 index 13a874c4f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-cwe.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Check CWE Compliance -title: Check CWE Compliance ---- -# Check CWE Compliance -**Type:** Rule -**ID:** `gitlab-project-check-cwe` -**Source:** [v2/rules/gitlab/project/check-cwe.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.yaml) -**Rego Source:** [check-cwe.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-cwe.rego) -**Labels:** Gitlab, Project - -Verify that specified CWEs were not detected in the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| cwe_value | 89 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md deleted file mode 100644 index 19358c074..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/check-signed-commits.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Ensure All Commits Are Signed in GitLab Project -title: Ensure All Commits Are Signed in GitLab Project ---- -# Ensure All Commits Are Signed in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-signed-commits` -**Source:** [v2/rules/gitlab/project/check-signed-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.yaml) -**Rego Source:** [check-signed-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/check-signed-commits.rego) -**Labels:** Gitlab, Project - -Verify all commits in the GitLab project are signed. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md deleted file mode 100644 index 1bb6d0a2b..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/co-approval-required.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Require Code Owner Approval in GitLab Project -title: Require Code Owner Approval in GitLab Project ---- -# Require Code Owner Approval in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-code-owner-approval` -**Source:** [v2/rules/gitlab/project/co-approval-required.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.yaml) -**Rego Source:** [co-approval-required.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/co-approval-required.rego) -**Labels:** Gitlab, Project - -Verify code owner approval is required for specific branches in the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md deleted file mode 100644 index 5f2002d5f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-email-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Restrict Commit Authors in GitLab Project -title: Restrict Commit Authors in GitLab Project ---- -# Restrict Commit Authors in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-allowed-commit-authors` -**Source:** [v2/rules/gitlab/project/commit-author-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.yaml) -**Rego Source:** [commit-author-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-email-check.rego) -**Labels:** Gitlab, Project - -Verify only GitLab project users in the Allowed List have commit author permissions. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_authors | ['mail@example.com'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md deleted file mode 100644 index c91db1fa0..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-author-name-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Commit Authors in GitLab Project -title: Allowed Commit Authors in GitLab Project ---- -# Allowed Commit Authors in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-allowed-commit-author-names` -**Source:** [v2/rules/gitlab/project/commit-author-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.yaml) -**Rego Source:** [commit-author-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-author-name-check.rego) -**Labels:** Gitlab, Project - -Verify only users in the Allowed List author commits in the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_authors | ['examplename'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md deleted file mode 100644 index f6e91c841..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-committer-check.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Enable Commit Committer Check in GitLab Project -title: Enable Commit Committer Check in GitLab Project ---- -# Enable Commit Committer Check in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-verify-commit_committer_check` -**Source:** [v2/rules/gitlab/project/commit-committer-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.yaml) -**Rego Source:** [commit-committer-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-committer-check.rego) -**Labels:** Gitlab, Project - -Verify `commit_committer_check` is enabled for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md deleted file mode 100644 index 8497009be..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commit-message-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify Commit Message Format -title: Verify Commit Message Format ---- -# Verify Commit Message Format -**Type:** Rule -**ID:** `gitlab-project-verify-commit_message_check` -**Source:** [v2/rules/gitlab/project/commit-message-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.yaml) -**Rego Source:** [commit-message-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commit-message-check.rego) -**Labels:** Gitlab, Project - -Verify that commit messages in the GitLab project adhere to the specified format template. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| commit_message_regex | .*JIRA-\d+.* | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md deleted file mode 100644 index 729edca82..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/commits-validated.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Validate All Commits in GitLab Project -title: Validate All Commits in GitLab Project ---- -# Validate All Commits in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-all-commits-validated` -**Source:** [v2/rules/gitlab/project/commits-validated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.yaml) -**Rego Source:** [commits-validated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/commits-validated.rego) -**Labels:** Gitlab, Project - -Verify all commits in the GitLab project are validated. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md deleted file mode 100644 index 7a44c7317..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-email-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Committer Emails in GitLab Project -title: Allowed Committer Emails in GitLab Project ---- -# Allowed Committer Emails in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-allowed-committer-emails` -**Source:** [v2/rules/gitlab/project/committer-email-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.yaml) -**Rego Source:** [committer-email-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-email-check.rego) -**Labels:** Gitlab, Project - -Verify only users in the Allowed List use committer email addresses in the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_committers | ['mail@example.com'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md deleted file mode 100644 index 0a6f037b6..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/committer-name-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Allowed Committer Names in GitLab Project -title: Allowed Committer Names in GitLab Project ---- -# Allowed Committer Names in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-allowed-committer-names` -**Source:** [v2/rules/gitlab/project/committer-name-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.yaml) -**Rego Source:** [committer-name-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/committer-name-check.rego) -**Labels:** Gitlab, Project - -Verify only users in the Allowed List commit by name in the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_committers | ['somename'] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md deleted file mode 100644 index dac1fb819..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/critical-severity-limit.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Enforce Critical Severity Limit -title: Enforce Critical Severity Limit ---- -# Enforce Critical Severity Limit -**Type:** Rule -**ID:** `gitlab-project-critical-severity-limit` -**Source:** [v2/rules/gitlab/project/critical-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.yaml) -**Rego Source:** [critical-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/critical-severity-limit.rego) -**Labels:** Gitlab, Project - -Verify the maximum allowed critical severity alerts for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_allowed_vulnerability_count | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md deleted file mode 100644 index c513b4a0d..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/description-substring-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Check Description Substring -title: Check Description Substring ---- -# Check Description Substring -**Type:** Rule -**ID:** `gitlab-project-description-substring-check` -**Source:** [v2/rules/gitlab/project/description-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.yaml) -**Rego Source:** [description-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/description-substring-check.rego) -**Labels:** Gitlab, Project - -Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)insdput | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md deleted file mode 100644 index d29c02ef5..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Disallow Banned Approvers -title: Disallow Banned Approvers ---- -# Disallow Banned Approvers -**Type:** Rule -**ID:** `gitlab-project-disallowed-banned-approvers` -**Source:** [v2/rules/gitlab/project/disallowed-banned-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.yaml) -**Rego Source:** [disallowed-banned-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/disallowed-banned-approvers.rego) -**Labels:** Gitlab, Project - -Verify approvers in the GitLab project are not on the banned list. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| banned_list | [] | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md deleted file mode 100644 index 2cc0a3f81..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/force-push-protection.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Disallow Force Push in GitLab Project -title: Disallow Force Push in GitLab Project ---- -# Disallow Force Push in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-disallow-force-push` -**Source:** [v2/rules/gitlab/project/force-push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.yaml) -**Rego Source:** [force-push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/force-push-protection.rego) -**Labels:** Gitlab, Project - -Verify force pushes in the GitLab project are disallowed to maintain repository integrity. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md deleted file mode 100644 index d657f8634..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/medium-severity-limit.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Enforce Medium Severity Limit -title: Enforce Medium Severity Limit ---- -# Enforce Medium Severity Limit -**Type:** Rule -**ID:** `gitlab-project-medium-severity-limit` -**Source:** [v2/rules/gitlab/project/medium-severity-limit.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.yaml) -**Rego Source:** [medium-severity-limit.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/medium-severity-limit.rego) -**Labels:** Gitlab, Project - -Verify the maximum allowed medium severity alerts for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_allowed_specific_severity | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md deleted file mode 100644 index 090bfe4c1..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/member-check.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Enable Member Check for GitLab Project -title: Enable Member Check for GitLab Project ---- -# Enable Member Check for GitLab Project -**Type:** Rule -**ID:** `gitlab-project-verify-member_check` -**Source:** [v2/rules/gitlab/project/member-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.yaml) -**Rego Source:** [member-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/member-check.rego) -**Labels:** Gitlab, Project - -Verify `member_check` is enabled for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md deleted file mode 100644 index ec045a9db..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-access-level.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Enforce Merge Access Level Policy for GitLab Project -title: Enforce Merge Access Level Policy for GitLab Project ---- -# Enforce Merge Access Level Policy for GitLab Project -**Type:** Rule -**ID:** `gitlab-project-merge-access-level` -**Source:** [v2/rules/gitlab/project/merge-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.yaml) -**Rego Source:** [merge-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-access-level.rego) -**Labels:** Gitlab, Project - -Verify the GitLab project's merge access level complies with requirements. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | -| access_level_description | Maintainers | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md deleted file mode 100644 index 471d12ac7..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Disable Author Approval for Merge Requests in GitLab -title: Disable Author Approval for Merge Requests in GitLab ---- -# Disable Author Approval for Merge Requests in GitLab -**Type:** Rule -**ID:** `gitlab-project-merge-requests-author-approval` -**Source:** [v2/rules/gitlab/project/merge-requests-author-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.yaml) -**Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) -**Labels:** Gitlab, Project - -Verify the binary field `merge_requests_author_approval` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| merge_requests_author_approval | True | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md deleted file mode 100644 index f7d34cdd8..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Disable Committers' Approval for Merge Requests in GitLab -title: Disable Committers' Approval for Merge Requests in GitLab ---- -# Disable Committers' Approval for Merge Requests in GitLab -**Type:** Rule -**ID:** `gitlab-project-merge-requests-disable-committers-approval` -**Source:** [v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.yaml) -**Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) -**Labels:** Gitlab, Project - -Verify `merge_requests_disable_committers_approval` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| merge_requests_disable_committers_approval | False | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md deleted file mode 100644 index 8c78c0e7c..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/message-substring-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Check Message Substring -title: Check Message Substring ---- -# Check Message Substring -**Type:** Rule -**ID:** `gitlab-project-message-substring-check` -**Source:** [v2/rules/gitlab/project/message-substring-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.yaml) -**Rego Source:** [message-substring-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/message-substring-check.rego) -**Labels:** Gitlab, Project - -Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)dghd | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md deleted file mode 100644 index bc27834dd..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Enable Secrets Prevention in GitLab Project -title: Enable Secrets Prevention in GitLab Project ---- -# Enable Secrets Prevention in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-verify-prevent_secrets` -**Source:** [v2/rules/gitlab/project/prevent-secrets-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.yaml) -**Rego Source:** [prevent-secrets-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/prevent-secrets-check.rego) -**Labels:** Gitlab, Project - -Verify `prevent_secrets` is enabled for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md deleted file mode 100644 index 5306a5b84..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Protect CI Secrets in GitLab Project -title: Protect CI Secrets in GitLab Project ---- -# Protect CI Secrets in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-protect-ci-secrets` -**Source:** [v2/rules/gitlab/project/protect-ci-secrets.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.yaml) -**Rego Source:** [protect-ci-secrets.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/protect-ci-secrets.rego) -**Labels:** Gitlab, Project - -Verify secrets in the GitLab project are not shared. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)(token|secret) | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md deleted file mode 100644 index e4b1195b7..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-access-level.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Set Push Access Level in GitLab Project -title: Set Push Access Level in GitLab Project ---- -# Set Push Access Level in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-push-access-level` -**Source:** [v2/rules/gitlab/project/push-access-level.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.yaml) -**Rego Source:** [push-access-level.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-access-level.rego) -**Labels:** Gitlab, Project - -Verify the GitLab project's push access level policy complies with requirements. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | -| access_level_description | Maintainers | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md deleted file mode 100644 index 990c718fa..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/push-rules-set.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Set Push Rules for GitLab Project -title: Set Push Rules for GitLab Project ---- -# Set Push Rules for GitLab Project -**Type:** Rule -**ID:** `gitlab-project-verify-push_rules` -**Source:** [v2/rules/gitlab/project/push-rules-set.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.yaml) -**Rego Source:** [push-rules-set.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/push-rules-set.rego) -**Labels:** Gitlab, Project - -Verify push rules are set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md deleted file mode 100644 index f3d7ffa7f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Reject Unsigned Commits in GitLab Project -title: Reject Unsigned Commits in GitLab Project ---- -# Reject Unsigned Commits in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-disallow-unsigned-commits` -**Source:** [v2/rules/gitlab/project/reject-unsigned-commits.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.yaml) -**Rego Source:** [reject-unsigned-commits.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reject-unsigned-commits.rego) -**Labels:** Blueprint, Gitlab, Project - -Verify `reject_unsigned_commits` is enabled for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md deleted file mode 100644 index 4b4e1b9e2..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/require-password-to-approve.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Require Password for Approvals in GitLab Project -title: Require Password for Approvals in GitLab Project ---- -# Require Password for Approvals in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-require-password-to-approve` -**Source:** [v2/rules/gitlab/project/require-password-to-approve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.yaml) -**Rego Source:** [require-password-to-approve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/require-password-to-approve.rego) -**Labels:** Gitlab, Project - -Verify the binary field `require_password_to_approve` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| require_password_to_approve | True | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md deleted file mode 100644 index 551fdfe42..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Require Minimal Approvers in GitLab Project -title: Require Minimal Approvers in GitLab Project ---- -# Require Minimal Approvers in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-required-minimal-approvers` -**Source:** [v2/rules/gitlab/project/required-minimal-approvers.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.yaml) -**Rego Source:** [required-minimal-approvers.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/required-minimal-approvers.rego) -**Labels:** Gitlab, Project - -Verify the required number of approvers for the GitLab project is met. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md deleted file mode 100644 index 070835191..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Reset Approvals on Push in GitLab Project -title: Reset Approvals on Push in GitLab Project ---- -# Reset Approvals on Push in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-reset-pprovals-on-push` -**Source:** [v2/rules/gitlab/project/reset-pprovals-on-push.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.yaml) -**Rego Source:** [reset-pprovals-on-push.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/reset-pprovals-on-push.rego) -**Labels:** Gitlab, Project - -Verify `reset_approvals_on_push` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| reset_approvals_on_push | True | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md deleted file mode 100644 index d25cd30ae..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scan-pass.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Ensure SAST Scanning Passes -title: Ensure SAST Scanning Passes ---- -# Ensure SAST Scanning Passes -**Type:** Rule -**ID:** `gitlab-project-sast-scan-pass` -**Source:** [v2/rules/gitlab/project/sast-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.yaml) -**Rego Source:** [sast-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scan-pass.rego) -**Labels:** Gitlab, Project - -Verify SAST scanning is successful for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md deleted file mode 100644 index 1d17f8255..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/sast-scanning.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Run SAST Scanning in GitLab Project -title: Run SAST Scanning in GitLab Project ---- -# Run SAST Scanning in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-sast-scanning` -**Source:** [v2/rules/gitlab/project/sast-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.yaml) -**Rego Source:** [sast-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/sast-scanning.rego) -**Labels:** Gitlab, Project - -Verify SAST scanning is performed for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md deleted file mode 100644 index 4b0f92e2f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Ensure Secrets Scanning Passes -title: Ensure Secrets Scanning Passes ---- -# Ensure Secrets Scanning Passes -**Type:** Rule -**ID:** `gitlab-project-secrets-scan-pass` -**Source:** [v2/rules/gitlab/project/secrets-scan-pass.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.yaml) -**Rego Source:** [secrets-scan-pass.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scan-pass.rego) -**Labels:** Gitlab, Project - -Verify secrets scanning is successful for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md deleted file mode 100644 index 27f7be669..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/secrets-scanning.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Run Secrets Scanning in GitLab Project -title: Run Secrets Scanning in GitLab Project ---- -# Run Secrets Scanning in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-secrets-scanning` -**Source:** [v2/rules/gitlab/project/secrets-scanning.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.yaml) -**Rego Source:** [secrets-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/secrets-scanning.rego) -**Labels:** Gitlab, Project - -Verify secrets scanning is performed for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md deleted file mode 100644 index 4947c4d7f..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Restrict Selective Code Owner Removals in GitLab -title: Restrict Selective Code Owner Removals in GitLab ---- -# Restrict Selective Code Owner Removals in GitLab -**Type:** Rule -**ID:** `gitlab-project-selective-code-owner-removals` -**Source:** [v2/rules/gitlab/project/selective-code-owner-removals.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.yaml) -**Rego Source:** [selective-code-owner-removals.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/selective-code-owner-removals.rego) -**Labels:** Gitlab, Project - -Verify `selective_code_owner_removals` is set for the GitLab project. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| selective_code_owner_removals | True | - diff --git a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md deleted file mode 100644 index 93e8da37a..000000000 --- a/docs/configuration/v2/initiatives/rules/gitlab/project/visibility-check.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Set Visibility Level in GitLab Project -title: Set Visibility Level in GitLab Project ---- -# Set Visibility Level in GitLab Project -**Type:** Rule -**ID:** `gitlab-project-project-visibility-level` -**Source:** [v2/rules/gitlab/project/visibility-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.yaml) -**Rego Source:** [visibility-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/visibility-check.rego) -**Labels:** Gitlab, Project - -Verify the GitLab project's visibility matches the required level. - -:::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - platform=gitlab
- asset_type=project | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| visibility | private | - diff --git a/docs/configuration/v2/initiatives/rules/images/_category_.json b/docs/configuration/v2/initiatives/rules/images/_category_.json deleted file mode 100644 index fb18a4fc4..000000000 --- a/docs/configuration/v2/initiatives/rules/images/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Images", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md b/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md deleted file mode 100644 index 6d634f65a..000000000 --- a/docs/configuration/v2/initiatives/rules/images/allowed-base-image.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -sidebar_label: Allowed Base Image -title: Allowed Base Image ---- -# Allowed Base Image -**Type:** Rule -**ID:** `images-allowed-base-image` -**Source:** [v2/rules/images/allowed-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.yaml) -**Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) -**Labels:** SBOM, Images - -Verifies that every base image is from an approved source. The rule returns a summary -including the component names and versions of valid base images, or lists the invalid ones. -This rule requires Dockerfile context; for example, run it with: -`valint my_image --base-image Dockerfile`. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/allowed-base-image@v2/rules -with: - approved_sources: - - "docker.io/library/*" - - "docker.io/my_org/*" -``` - -## Mitigation -Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. - - - -## Description -This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images. -A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true". -For each detected base image, the rule verifies that its name matches one of the approved source patterns defined in the configuration -(via `with.approved_sources`). If a base image does not match any of the approved patterns, it is flagged as invalid. If no base image data -is found, a violation is recorded indicating that the necessary base image information is missing. - -**Evidence Requirements:** - -- The SBOM evidence must be provided in the `cyclonedx-json` format. -- The SBOM should include a `metadata.component.properties` array containing properties that identify base images. -- The approved source patterns must be specified in the `with.approved_sources` parameter. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| approved_sources | array | False | A list of approved base image pattern. | - diff --git a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md b/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md deleted file mode 100644 index db698f395..000000000 --- a/docs/configuration/v2/initiatives/rules/images/allowed-image-source.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -sidebar_label: Allowed Main Image Source -title: Allowed Main Image Source ---- -# Allowed Main Image Source -**Type:** Rule -**ID:** `images-allowed-image-source` -**Source:** [v2/rules/images/allowed-image-source.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.yaml) -**Rego Source:** [allowed-image-source.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-image-source.rego) -**Labels:** SBOM, Images - -Ensures the main container image referenced in the SBOM is from an approved source. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/allowed-image-source@v2/rules -with: - approved_sources: - - "docker.io/library/*" - - "docker.io/my_org/*" -``` - -## Mitigation -Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. - - - -## Description -This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source. -It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`). -The matching is performed using a case-insensitive, anchored regex. - -- If one or more approved source patterns are provided and the image name matches at least one pattern, the image is considered compliant. -- If the image name does not match any approved source, or if no approved source patterns are provided, a violation is recorded. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields. -- The approved source patterns must be specified in `with.approved_sources`. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| approved_sources | array | False | A list of approved Image source patterns. | - diff --git a/docs/configuration/v2/initiatives/rules/images/banned-ports.md b/docs/configuration/v2/initiatives/rules/images/banned-ports.md deleted file mode 100644 index 75931681b..000000000 --- a/docs/configuration/v2/initiatives/rules/images/banned-ports.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -sidebar_label: Banned Ports -title: Banned Ports ---- -# Banned Ports -**Type:** Rule -**ID:** `images-banned-ports` -**Source:** [v2/rules/images/banned-ports.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.yaml) -**Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) -**Labels:** SBOM, Images - -Ensures that the container image does not expose ports that are disallowed by organizational policy. -The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. -It fails if any banned port is exposed or if no banned ports list is provided. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/banned-ports@v2/rules -with: - banned_ports: - - port: "3000" - protocol: "tcp" - - port: "8080" - protocol: "tcp" -``` - -## Mitigation -Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. - - - -## Description -This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed. -It performs the following steps: - -1. Retrieves all properties from the SBOM's `metadata.component.properties` whose names start with "imageExposedPorts_". -2. Expects each property value to be formatted as "port/protocol" (e.g., "3000/tcp") and splits the value into its components. -3. Compares each exposed port against the list of banned ports provided in the configuration (`with.banned_ports`). - - If a banned port (and, if specified, protocol) is detected, the rule flags it as a violation. -4. If no banned ports list is provided, the rule also fails. - -**Evidence Requirements:** - -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a `metadata.component.properties` array with entries for exposed ports. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| banned_ports | array | False | A list of banned ports and protocols. Each entry should be a dictionary with 'port' and 'protocol' keys. | - diff --git a/docs/configuration/v2/initiatives/rules/images/banned-users.md b/docs/configuration/v2/initiatives/rules/images/banned-users.md deleted file mode 100644 index 44c954d67..000000000 --- a/docs/configuration/v2/initiatives/rules/images/banned-users.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -sidebar_label: Disallow Specific Users in SBOM -title: Disallow Specific Users in SBOM ---- -# Disallow Specific Users in SBOM -**Type:** Rule -**ID:** `sbom-disallowed-users` -**Source:** [v2/rules/images/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.yaml) -**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-users.rego) -**Labels:** SBOM, Image - -Verify specific users are not allowed in an SBOM. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/banned-users@v2/rules -with: - users: - - root -``` - -## Mitigation -Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured -to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property -with the name "user". The value of this property is then compared against a list of disallowed users specified in -the configuration (via `with.users`). If the image is found to be running as a banned user (for example, "root"), -a violation is recorded. - -**Evidence Requirements:** - -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user". -- The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| users | array | False | A list of disallowed users. Each entry should be a string representing a username. | - diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md deleted file mode 100644 index 46a08b9e4..000000000 --- a/docs/configuration/v2/initiatives/rules/images/blocklist-build-scripts.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -sidebar_label: Restrict Build Scripts -title: Restrict Build Scripts ---- -# Restrict Build Scripts -**Type:** Rule -**ID:** `images-disallowed-build-script` -**Source:** [v2/rules/images/blocklist-build-scripts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.yaml) -**Rego Source:** [blocklist-build-scripts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/blocklist-build-scripts.rego) -**Labels:** SBOM, Images - -Verify no build scripts commands appear in block list. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: images/blocklist-build-scripts@v2/rules -with: - blocklist: - - "wget" - - "curl" -``` - -## Mitigation -Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. - - - -## Description -This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". -It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. -If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| blocklist | array | False | A list of disallowed build script commands. Each entry should be a string representing a command or substring. | - diff --git a/docs/configuration/v2/initiatives/rules/images/blocklist-user.md b/docs/configuration/v2/initiatives/rules/images/blocklist-user.md deleted file mode 100644 index 9acd11cac..000000000 --- a/docs/configuration/v2/initiatives/rules/images/blocklist-user.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Blocklist Container User -title: Blocklist Container User ---- -# Blocklist Container User -**Type:** Rule -**ID:** `images-blocklist-user` -**Uses:** `images/blocklist-user@v2/rules` -**Source:** [v2/rules/images/blocklist-user.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.yaml) -**Rego Source:** [blocklist-user.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.rego) -**Labels:** SBOM, Images - -Ensures that the container image does not use a user in the blocklist. -We look for a SBOM property named "user" in metadata.component.properties. -If it matches any username from the 'users' list, we fail. - - -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| users | [] | diff --git a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md deleted file mode 100644 index ec4a36a37..000000000 --- a/docs/configuration/v2/initiatives/rules/images/enforce-https-registry.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -sidebar_label: Registry Connection HTTPS -title: Registry Connection HTTPS ---- -# Registry Connection HTTPS -**Type:** Rule -**ID:** `images-registry-https-check` -**Source:** [v2/rules/images/enforce-https-registry.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.yaml) -**Rego Source:** [enforce-https-registry.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/enforce-https-registry.rego) -**Labels:** Registry, Images - -Checks if the container's registry scheme is HTTPS - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Description -This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection -is secure. It does so by scanning the `metadata.component.properties` array for a property named -'registry_scheme'. If the value of this property is exactly 'https', the rule passes; otherwise, it fails, -indicating that the image may have been pulled from an insecure registry. - -**Evidence Requirements:** - -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['product', 'target'] | - diff --git a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md b/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md deleted file mode 100644 index 594222fd6..000000000 --- a/docs/configuration/v2/initiatives/rules/images/forbid-large-images.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -sidebar_label: Forbid Large Images -title: Forbid Large Images ---- -# Forbid Large Images -**Type:** Rule -**ID:** `images-project-large-image` -**Source:** [v2/rules/images/forbid-large-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.yaml) -**Rego Source:** [forbid-large-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/forbid-large-images.rego) -**Labels:** SBOM, Images - -Verify the image size is below the specified threshold. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: images/forbid-large-images@v2/rules -with: - max_size: 77819980 -``` - -## Mitigation -Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components -to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically -looks for the size property when the associated "index" property is "0" (which typically represents the overall image size). -The extracted size is then converted to a numeric value and compared against the maximum size specified in the rule's configuration (`max_size`). - -- If the image size is less than or equal to the specified `max_size`, the rule passes and the image is considered acceptable. -- If the image size exceeds the threshold, a violation is recorded with a message indicating the actual image size and the maximum allowed size. - -### **Evidence Requirements** - -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0". - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| max_size | integer | True | The maximum allowed image size in bytes. | - diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md deleted file mode 100644 index 064ced39d..000000000 --- a/docs/configuration/v2/initiatives/rules/images/fresh-base-image.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Fresh Base Image -title: Fresh Base Image ---- -# Fresh Base Image -**Type:** Rule -**ID:** `images-fresh-base-image` -**Source:** [v2/rules/images/fresh-base-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.yaml) -**Rego Source:** [fresh-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-base-image.rego) -**Labels:** SBOM, Images - -Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/fresh-base-image@v2/rules -with: - max_days: 183 -``` - -## Mitigation -Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. - - - -## Description -This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. -It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". -The rule then extracts the "created" timestamp from these components and calculates the image’s age against the allowed threshold specified in `with.max_days`. -If any base image is older than the allowed age, or if no base image data is found, the rule records a violation. - -**Evidence Requirements:** -- Evidence must be provided in CycloneDX JSON format. -- The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| max_days | integer | True | The maximum allowed age of the base image in days. | - diff --git a/docs/configuration/v2/initiatives/rules/images/fresh-image.md b/docs/configuration/v2/initiatives/rules/images/fresh-image.md deleted file mode 100644 index 1db34faec..000000000 --- a/docs/configuration/v2/initiatives/rules/images/fresh-image.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Fresh Image -title: Fresh Image ---- -# Fresh Image -**Type:** Rule -**ID:** `fresh-image` -**Source:** [v2/rules/images/fresh-image.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.yaml) -**Rego Source:** [fresh-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/fresh-image.rego) -**Labels:** SBOM, Images - -Verify the image is not older than the specified threshold. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Usage example - -```yaml -uses: images/fresh-image@v2/rules -with: - max_days: 183 -``` - -## Mitigation -Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. - - - -## Description -This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" -within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339. - -The rule compares the current time with the sum of the creation time and the maximum allowed age (by days). If the current time exceeds this sum, -the rule flags the image as too old and generates a violation with details on the calculated maximum allowed time. - -### **Evidence Requirements** -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| max_days | integer | True | The maximum allowed age of the image in days. | - diff --git a/docs/configuration/v2/initiatives/rules/images/image-signed.md b/docs/configuration/v2/initiatives/rules/images/image-signed.md deleted file mode 100644 index e4aa92051..000000000 --- a/docs/configuration/v2/initiatives/rules/images/image-signed.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -sidebar_label: Require Signed Container Image -title: Require Signed Container Image ---- -# Require Signed Container Image -**Type:** Rule -**ID:** `images-require-signed-image` -**Source:** [v2/rules/images/image-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.yaml) -**Rego Source:** [image-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/image-signed.rego) -**Labels:** Images, Blueprint - -Enforces that container images (target_type=container) are cryptographically signed. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: images/image-signed@v2/rules -with: - identity: - emails: - - bob@company.com - - alice@company.com - skip_image_regex: - - .*alpine.* -``` - -## Mitigation -Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. - - - -## Description -This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the -environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the -image name matches any pattern specified in `with.skip_image_regex`, the signature check is skipped, allowing flexibility -for images that do not require a signature. Otherwise, if the evidence does not indicate a valid signature, the rule fails. - -**Evidence Requirements:** - -- Evidence must be provided in CycloneDX JSON format with a `content_body_type` of "cyclonedx-json". -- The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json"). -- The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| target_type | container | -| signed | False | -| filter-by | ['product', 'target'] | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| identity | object | False | Identity information for the signers | -| skip_image_regex | array | False | Patterns to bypass the signature requirement for certain images | - diff --git a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md b/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md deleted file mode 100644 index 65a5a3e73..000000000 --- a/docs/configuration/v2/initiatives/rules/images/require-healthcheck.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -sidebar_label: Require Healthcheck -title: Require Healthcheck ---- -# Require Healthcheck -**Type:** Rule -**ID:** `images-require-healthcheck` -**Source:** [v2/rules/images/require-healthcheck.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.yaml) -**Rego Source:** [require-healthcheck.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/require-healthcheck.rego) -**Labels:** SBOM, Images - -Checks that the container image includes at least one healthcheck property. - - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by target and product. -::: - -## Mitigation -Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. - - - -## Description -This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined. -It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, -starts with "imagehealthcheck_". If at least one such property is found, the image is considered compliant; -otherwise, a violation is recorded indicating a missing healthcheck. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | -| filter-by | ['target', 'product'] | - diff --git a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md deleted file mode 100644 index 04b60aa2a..000000000 --- a/docs/configuration/v2/initiatives/rules/images/restrict-shell-entrypoint.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -sidebar_label: Disallow Container Shell Entrypoint -title: Disallow Container Shell Entrypoint ---- -# Disallow Container Shell Entrypoint -**Type:** Rule -**ID:** `images-disallow-shell-access` -**Source:** [v2/rules/images/restrict-shell-entrypoint.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.yaml) -**Rego Source:** [restrict-shell-entrypoint.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/restrict-shell-entrypoint.rego) -**Labels:** SBOM, Images - -Verify the container image disallows shell entrypoint. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. - - - -## Description -This rule ensures that container images do not allow shell access by verifying their configured entrypoint. -Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. -This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). - -### **Evidence Requirements** -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md deleted file mode 100644 index 04ce31753..000000000 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels-exist.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -sidebar_label: Require Image Labels -title: Require Image Labels ---- -# Require Image Labels -**Type:** Rule -**ID:** `required-image-labels` -**Source:** [v2/rules/images/verify-labels-exist.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.yaml) -**Rego Source:** [verify-labels-exist.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels-exist.rego) -**Labels:** SBOM, Images - -Verify the image has the specified labels. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: images/verify-labels-exist@v2/rules -with: - labels: - - "org.opencontainers.image.created" - - "org.opencontainers.image.revision" - - "org.opencontainers.image.title" - - "org.opencontainers.image.vendor" - - "org.opencontainers.image.version" -``` - -## Mitigation -Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. - - - -## Description -This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label -(as defined in the `with.labels` parameter) exists with the correct value. - -1. The rule iterates over the list of required labels provided in the `with.labels` configuration. -2. For each required label, it examines the `metadata.component.properties` array in the SBOM. -3. It looks for a property where the name starts with "label_" and ends with the required label key, and - where the property value matches the expected value. -4. If such a property is not found, a violation is recorded with the missing label and expected value details. - -### **Evidence Requirements** -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM should include a `metadata.component.properties` array that contains label information. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| labels | array | False | A list of required labels. | - diff --git a/docs/configuration/v2/initiatives/rules/images/verify-labels.md b/docs/configuration/v2/initiatives/rules/images/verify-labels.md deleted file mode 100644 index 727fe0a99..000000000 --- a/docs/configuration/v2/initiatives/rules/images/verify-labels.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Verify Image Labels -title: Verify Image Labels ---- -# Verify Image Labels -**Type:** Rule -**ID:** `image-labels` -**Source:** [v2/rules/images/verify-labels.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.yaml) -**Rego Source:** [verify-labels.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/verify-labels.rego) -**Labels:** SBOM, Images - -Verify specified labels key-value pairs exist in the image. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: images/verify-labels@v2/rules -with: - labels: - - "org.opencontainers.image.vendor=my_vendor" -``` - -## Mitigation -Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. - - - -## Description -This rule checks the CycloneDX SBOM evidence for the container image to verify that each -required label (as defined in the `with.labels` parameter) exists with the correct value. - -1. The rule iterates over the list of required labels provided in the `with.labels` configuration. -2. For each required label, it examines the `metadata.component.properties` array in the SBOM. -3. It looks for a property where the name starts with "label_" and ends with the required label key, and - where the property value matches the expected value. -4. If such a property is not found, a violation is recorded with the missing label and expected value details. - -### **Evidence Requirements** -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM should include a `metadata.component.properties` array that contains label information. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| labels | array | False | A list of required labels. | - diff --git a/docs/configuration/v2/initiatives/rules/jenkins/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/_category_.json deleted file mode 100644 index a1e606da6..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Jenkins", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json deleted file mode 100644 index 5a7c99815..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/folder/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Folder", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md deleted file mode 100644 index b0fa24114..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/folder/exposed-credentials.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Verify Exposed Credentials -title: Verify Exposed Credentials ---- -# Verify Exposed Credentials -**Type:** Rule -**ID:** `jenkins-exposed-credentials` -**Source:** [v2/rules/jenkins/folder/exposed-credentials.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.yaml) -**Rego Source:** [exposed-credentials.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/folder/exposed-credentials.rego) -**Labels:** Jenkins, Folder - -Verify there are no exposed credentials. - -:::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=folder | - diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json b/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json deleted file mode 100644 index 194968062..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Instance", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md deleted file mode 100644 index 9c20b26d6..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/inactive-users.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Verify Inactive Users -title: Verify Inactive Users ---- -# Verify Inactive Users -**Type:** Rule -**ID:** `jenkins-inactive-users` -**Source:** [v2/rules/jenkins/instance/inactive-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.yaml) -**Rego Source:** [inactive-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/inactive-users.rego) -**Labels:** Jenkins, Instance - -Verify there are no inactive users. - -:::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=instance
- platform=jenkins | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 90 | - diff --git a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md deleted file mode 100644 index 64d220a56..000000000 --- a/docs/configuration/v2/initiatives/rules/jenkins/instance/unused-users.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -sidebar_label: Disallow Unused Users -title: Disallow Unused Users ---- -# Disallow Unused Users -**Type:** Rule -**ID:** `jenkins-unused-users` -**Source:** [v2/rules/jenkins/instance/unused-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.yaml) -**Rego Source:** [unused-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/jenkins/instance/unused-users.rego) -**Labels:** Jenkins, Instance - -Verify there are no users with zero activity. - -:::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=instance
- platform=jenkins | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/_category_.json deleted file mode 100644 index 8b1cd3ce2..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "K8S", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json deleted file mode 100644 index 3ea66151d..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Namespace", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md deleted file mode 100644 index d093613e4..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-images.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Allowed Container Images -title: Allowed Container Images ---- -# Allowed Container Images -**Type:** Rule -**ID:** `k8s-namespace-blocked-images` -**Source:** [v2/rules/k8s/namespace/allowed-images.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-images.yaml) -**Rego Source:** [blocked-images.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/blocked-images.rego) -**Labels:** K8s, Namespace - -Verify only container images specified in the Allowed List run within the Kubernetes namespace. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/namespace/allowed-images@v2/rules -with: - images_to_include: - - docker.io/my_org/my_image1 - - docker.io/my_org/my_image2 -``` - -## Mitigation -Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. - - - -## Description -This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace. -It performs the following steps: - -1. Iterates over the container images running in the namespace. -2. Checks each image against the allowed list specified in the `with.images_to_include` configuration. - - If an image is not in the allowed list, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| images_to_include | array | False | List of allowed container images. | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md deleted file mode 100644 index 89675409e..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/allowed-registries.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Allowed Namespace Registries -title: Allowed Namespace Registries ---- -# Allowed Namespace Registries -**Type:** Rule -**ID:** `k8s-namespace-allowed-registries` -**Source:** [v2/rules/k8s/namespace/allowed-registries.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.yaml) -**Rego Source:** [allowed-registries.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/allowed-registries.rego) -**Labels:** K8s, Namespace - -Verify container images in Kubernetes namespaces originate from registries in the Allowed List. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/namespace/allowed-registries@v2/rules -with: - allowed_registries: - - docker.io/* - - gcr.io/* -``` - -## Mitigation -Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. - - - -## Description -This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace. -It performs the following steps: - -1. Iterates over the container images running in the namespace. -2. Checks each image's registry against the allowed registries specified in the `with.allowed_registries` configuration. - - If an image's registry is not in the allowed list, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| allowed_registries | array | False | A list of allowed container registries Regex patterns. | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md deleted file mode 100644 index 26d7b3f21..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -sidebar_label: Verify Namespace Runtime Duration -title: Verify Namespace Runtime Duration ---- -# Verify Namespace Runtime Duration -**Type:** Rule -**ID:** `k8s-namespace-verify-namespace-duration` -**Source:** [v2/rules/k8s/namespace/verify-namespace-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.yaml) -**Rego Source:** [verify-namespace-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-duration.rego) -**Labels:** K8s, Namespace - -Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/namespace/verify-namespace-duration@v2/rules -with: - threshold_date: "1970-01-01T00:00:00Z" -``` - -## Mitigation -Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. - - - -## Description -This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit. -It performs the following steps: - -1. Iterates over the namespaces in the cluster. -2. Checks each namespace's duration against the limit specified in the `with.threshold_date` configuration. - - If a namespace's duration exceeds the limit, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| threshold_date | string | False | The threshold date for namespace duration (supports regex). | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md deleted file mode 100644 index a17d75823..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -sidebar_label: Verify Namespace Termination -title: Verify Namespace Termination ---- -# Verify Namespace Termination -**Type:** Rule -**ID:** `k8s-namespace-verify-namespace-termination` -**Source:** [v2/rules/k8s/namespace/verify-namespace-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.yaml) -**Rego Source:** [verify-namespace-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/verify-namespace-termination.rego) -**Labels:** K8s, Namespace - -Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/namespace/verify-namespace-termination@v2/rules -with: - namespaces: - - ".*" -``` - -## Mitigation -Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. - - - -## Description -This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. -It performs the following steps: - -1. Iterates over the namespaces marked for termination in the cluster. -2. Checks each namespace's termination time against the limit specified in the `with.max_termination_time` configuration. - - If a namespace's termination time exceeds the limit, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| namespaces | array | False | A list of namespaces to verify (supports regex). | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md deleted file mode 100644 index 7e41bc992..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -sidebar_label: Allowed Namespaces -title: Allowed Namespaces ---- -# Allowed Namespaces -**Type:** Rule -**ID:** `k8s-namespace-white-listed-namespaces` -**Source:** [v2/rules/k8s/namespace/white-listed-namespaces.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.yaml) -**Rego Source:** [white-listed-namespaces.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-namespaces.rego) -**Labels:** K8s, Namespace - -Verify only namespaces specified in the Allowed List are allowed within the cluster. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces. - - - -## Description -This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster. -It performs the following steps: - -1. Iterates over the namespaces in the cluster. -2. Checks each namespace against the whitelist specified in the `with.namespaces` configuration. - - If a namespace is not in the whitelist, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| namespaces | array | False | A list of allowed namespaces. | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md deleted file mode 100644 index 2d55d651a..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/namespace/white-listed-pod.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Allowed Pods in Namespace -title: Allowed Pods in Namespace ---- -# Allowed Pods in Namespace -**Type:** Rule -**ID:** `k8s-namespace-white-listed-pod` -**Source:** [v2/rules/k8s/namespace/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.yaml) -**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/namespace/white-listed-pod.rego) -**Labels:** K8s, Namespace - -Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. - -:::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/namespace/white-listed-pod@v2/rules -with: - white_listed_pod: - - my-pod-1.* - - my-pod-2.* -``` - -## Mitigation -Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods. - - - -## Description -This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace. -It performs the following steps: - -1. Iterates over the pods in the namespace. -2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. - - If a pod is not in the whitelist, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=namespace
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| white_listed_pod | array | True | A list of allowed pods (supports regex). | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json b/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json deleted file mode 100644 index d22e47cb4..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Pods", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md deleted file mode 100644 index 0a0db38ee..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-duration.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -sidebar_label: Verify Pod Runtime Duration -title: Verify Pod Runtime Duration ---- -# Verify Pod Runtime Duration -**Type:** Rule -**ID:** `k8s-pods-verify-pod-duration` -**Source:** [v2/rules/k8s/pods/verify-pod-duration.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.yaml) -**Rego Source:** [verify-pod-duration.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-duration.rego) -**Labels:** K8s, Pod - -Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. - -:::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/pods/verify-pod-duration@v2/rules -with: - max_days: 30 -``` - -## Mitigation -Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. - - - -## Description -This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit. -It performs the following steps: - -1. Iterates over the pods in the cluster. -2. Checks each pod's duration against the limit specified in the `with.max_days` configuration. - - If a pod's duration exceeds the limit, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| max_days | integer | False | The maximum allowed duration for pods in days. | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md deleted file mode 100644 index 48ae71a0c..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/verify-pod-termination.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -sidebar_label: Verify Pod Termination -title: Verify Pod Termination ---- -# Verify Pod Termination -**Type:** Rule -**ID:** `k8s-pods-verify-pod-termination` -**Source:** [v2/rules/k8s/pods/verify-pod-termination.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.yaml) -**Rego Source:** [verify-pod-termination.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/verify-pod-termination.rego) -**Labels:** K8s, Pod - -Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. - -:::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. - - - -## Description -This rule verifies that pods in Kubernetes are terminated properly within the specified time frame. -It performs the following steps: - -1. Iterates over the pods marked for termination in the cluster. -2. Checks each pod's termination status is present, if such a status is present, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod
- platform=k8s | - diff --git a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md deleted file mode 100644 index 17e7462e8..000000000 --- a/docs/configuration/v2/initiatives/rules/k8s/pods/white-listed-pod.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -sidebar_label: Allowed Pods -title: Allowed Pods ---- -# Allowed Pods -**Type:** Rule -**ID:** `k8s-pods-white-listed-pod` -**Source:** [v2/rules/k8s/pods/white-listed-pod.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.yaml) -**Rego Source:** [white-listed-pod.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/k8s/pods/white-listed-pod.rego) -**Labels:** K8s, Pod - -Verify only pods explicitly listed in the Allowed List are allowed to run. - -:::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: k8s/pods/white-listed-pod@v2/rules -with: - white_listed_pod: - - my-pod-1.* - - my-pod-2.* - verify_namespaces: - - ".*" -``` - -## Mitigation -Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods. - - - -## Description -This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster. -It performs the following steps: - -1. Iterates over the pods in the cluster. -2. Checks each pod against the whitelist specified in the `with.white_listed_pod` configuration. - - If a pod is not in the whitelist, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | -| labels | - asset_type=pod
- platform=k8s | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| white_listed_pod | array | True | A list of allowed pods (supports regex). | -| verify_namespaces | array | True | A list of namespaces to verify (supports regex). | - diff --git a/docs/configuration/v2/initiatives/rules/multievidence/_category_.json b/docs/configuration/v2/initiatives/rules/multievidence/_category_.json deleted file mode 100644 index 9696ec52e..000000000 --- a/docs/configuration/v2/initiatives/rules/multievidence/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Multievidence", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md deleted file mode 100644 index fa6c0b2bd..000000000 --- a/docs/configuration/v2/initiatives/rules/multievidence/files_integrity.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify File Integrity -title: Verify File Integrity ---- -# Verify File Integrity -**Type:** Rule -**ID:** `file-integrity` -**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) -**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) -**Labels:** SBOM - -Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. - -:::note -This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | True | -| content_body_type | cyclonedx-json | -| target_type | container | -| labels | - new_evidence | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | -| path_prefix | pkg:file/ | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/_category_.json deleted file mode 100644 index 1d0527158..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SARIF", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md deleted file mode 100644 index c3480fabc..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/artifact-signed.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -sidebar_label: Verify Artifact Signature Using SARIF Report -title: Verify Artifact Signature Using SARIF Report ---- -# Verify Artifact Signature Using SARIF Report -**Type:** Rule -**ID:** `sarif-artifact-signed` -**Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.rego) -**Labels:** SARIF - -Verify the artifact referenced in the SARIF report is signed to confirm its integrity. - -:::note -This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. - - - -## Description -This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed. -It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists. -The rule checks that the evidence indicates the artifact is signed, ensuring that it has not been modified since its creation. -Additionally, the rule validates that the signature corresponds to one of the expected identities as defined in the configuration. - -### **Evidence Requirements** -- Evidence must be provided in a generic format conforming to SARIF 2.1.0. -- The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true). -- The signer's identity should match one of the specified common names or emails in the configuration. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | True | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md deleted file mode 100644 index d964e62af..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/evidence-exists.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -sidebar_label: Verify Required Evidence in SARIF -title: Verify Required Evidence in SARIF ---- -# Verify Required Evidence in SARIF -**Type:** Rule -**ID:** `required-sarif-evidence` -**Source:** [v2/rules/sarif/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.yaml) -**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/evidence-exists.rego) -**Labels:** SARIF - -Verify all required evidence exists as defined by the SARIF policy. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. - - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json deleted file mode 100644 index 4a0cbea05..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/patcheck/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Patcheck", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md deleted file mode 100644 index abb7b62cd..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/patcheck/updates-needed.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -sidebar_label: SARIF Update Needed -title: SARIF Update Needed ---- -# SARIF Update Needed -**Type:** Rule -**ID:** `sarif-update-needed` -**Source:** [v2/rules/sarif/patcheck/updates-needed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.yaml) -**Rego Source:** [updates-needed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/patcheck/updates-needed.rego) -**Labels:** SARIF - -Verify no security packages require updates. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md deleted file mode 100644 index b5c0cb8cd..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/report-iac-errors.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -sidebar_label: Verify IaC Misconfiguration Threshold in SARIF -title: Verify IaC Misconfiguration Threshold in SARIF ---- -# Verify IaC Misconfiguration Threshold in SARIF -**Type:** Rule -**ID:** `sarif-iac-findings` -**Source:** [v2/rules/sarif/report-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.yaml) -**Rego Source:** [report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/report-iac-errors.rego) -**Labels:** SARIF - -Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: sarif/report-iac-errors@v2/rules -with: - violations_threshold: 2 -``` - -## Mitigation -Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - - - -## Description -This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match -a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving -the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. -If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes -details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. - -### **Evidence Requirements** - -Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json b/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json deleted file mode 100644 index 54def2fba..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Trivy", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md deleted file mode 100644 index 01dc70227..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/blocklist-cve.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -sidebar_label: Trivy Blocklist CVE Check -title: Trivy Blocklist CVE Check ---- -# Trivy Blocklist CVE Check -**Type:** Rule -**ID:** `trivy-blocklist-cve` -**Source:** [v2/rules/sarif/trivy/blocklist-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/blocklist-cve.yaml) -**Rego Source:** [../blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../blocklist-report.rego) -**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example -**Labels:** SARIF, Trivy - -Verify a CVE Blocklist against a SARIF report - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by product. -::: - -## Mitigation -Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. - - - -## Description -This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities -matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows: - -The rule iterates over the vulnerability results in the SARIF report (located under -`input.evidence.predicate.content.runs[0].results`), and for each result, retrieves the corresponding rule definition from -`input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. It then checks if the result's -ruleId contains any of the CVE identifiers provided in the `with.rule_ids` configuration parameter. If the total number of such -findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded with details including -the rule ID, severity (extracted from the rule’s properties), and the location where the vulnerability was detected. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. -- The SARIF report should be generated by the "Trivy Vulnerability Scanner". -- Evidence filtering based on the product must be applied as defined in the configuration. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| tool | Trivy Vulnerability Scanner | -| filter-by | ['product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| rule_ids | array | False | List of CVE identifiers to check for in the Trivy SARIF report. | -| violations_threshold | integer | False | The maximum number of allowed violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md deleted file mode 100644 index fc97b9858..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Verify IaC Misconfiguration Threshold in Trivy SARIF -title: Verify IaC Misconfiguration Threshold in Trivy SARIF ---- -# Verify IaC Misconfiguration Threshold in Trivy SARIF -**Type:** Rule -**ID:** `trivy-iac-findings` -**Source:** [v2/rules/sarif/trivy/report-trivy-iac-errors.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/report-trivy-iac-errors.yaml) -**Rego Source:** [../report-iac-errors.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../report-iac-errors.rego) -**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example -**Labels:** SARIF, Trivy - -Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by product. -::: - -## Usage example - -```yaml -uses: sarif/trivy/report-trivy-iac-errors@v2/rules -with: - violations_threshold: 2 -``` - -## Mitigation -Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - - - -## Description -This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match -a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving -the corresponding rule definitions, and checking if the rule IDs contain any of the CVEs listed in the configuration. -If the total number of matching vulnerabilities exceeds the allowed threshold, the rule records a violation that includes -details such as the CVE identifier, its severity, and the location (artifact URI) where it was detected. - -### **Evidence Requirements** - -Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| tool | Trivy Vulnerability Scanner | -| filter-by | ['product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| violations_threshold | integer | False | The maximum number of allowed IaC misconfiguration errors. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md deleted file mode 100644 index f81c69280..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -sidebar_label: Trivy Vulnerability Findings Check -title: Trivy Vulnerability Findings Check ---- -# Trivy Vulnerability Findings Check -**Type:** Rule -**ID:** `trivy-verify-vulnerability-findings` -**Source:** [v2/rules/sarif/trivy/verify-cve-severity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.yaml) -**Rego Source:** [verify-cve-severity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-cve-severity.rego) -**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example -**Labels:** SARIF, Trivy - -Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed -the defined severity threshold. - - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by product. -::: - -## Usage example - -```yaml -uses: sarif/trivy/verify-cve-severity@v2/rules -with: - severity_threshold: 2 -``` - -## Mitigation -Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - - - -## Description -This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it -complies with a set of predefined rules. The evaluation is based on several configurable parameters: - -The rule iterates over the vulnerability results in the SARIF report (provided under -`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding -rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's -ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified -threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. -- The SARIF report should be generated by the "Trivy Vulnerability Scanner". - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| tool | Trivy Vulnerability Scanner | -| filter-by | ['product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| severity_threshold | integer | True | The maximum severity level allowed for vulnerabilities. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md deleted file mode 100644 index 54d336702..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -sidebar_label: Verify Attack Vector Threshold in Trivy SARIF -title: Verify Attack Vector Threshold in Trivy SARIF ---- -# Verify Attack Vector Threshold in Trivy SARIF -**Type:** Rule -**ID:** `trivy-attack-vectors` -**Source:** [v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-attack-vector.yaml) -**Rego Source:** [../verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-attack-vector.rego) -**Labels:** SARIF, Trivy - -Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by product. -::: - -## Usage example - -```yaml -uses: sarif/trivy/verify-trivy-attack-vector@v2/rules -with: - attack_vectors: - - "stack buffer overflow" - violations_threshold: 2 -``` - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| tool | Trivy Vulnerability Scanner | -| filter-by | ['product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| attack_vectors | array | False | List of attack vectors to check for in the Trivy SARIF report. | -| violations_threshold | integer | False | The maximum number of allowed attack vector violations in the Trivy SARIF report. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md deleted file mode 100644 index f1c198303..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -sidebar_label: Verify Trivy SARIF Report Compliance -title: Verify Trivy SARIF Report Compliance ---- -# Verify Trivy SARIF Report Compliance -**Type:** Rule -**ID:** `trivy-report` -**Source:** [v2/rules/sarif/trivy/verify-trivy-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/verify-trivy-report.yaml) -**Rego Source:** [../verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/trivy/../verify-sarif.rego) -**Help:** https://scribe-security.netlify.app/docs/valint/generic#trivy-integration-example -**Labels:** SARIF, Trivy - -Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by product. -::: - -## Mitigation -Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - - - -## Description -This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it -complies with a set of predefined rules. The evaluation is based on several configurable parameters: - -The rule iterates over the vulnerability results in the SARIF report (provided under -`input.evidence.predicate.content.runs[0].results`), and for each result, it retrieves the corresponding -rule definition from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's -ruleIndex. It then evaluates whether the severity (extracted from the rule’s properties) exceeds the specified -threshold. If the number of such violations exceeds the allowed maximum, a violation is recorded. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. -- The SARIF report should be generated by the "Trivy Vulnerability Scanner". -- The evidence must include proper filtering based on the product as defined in the configuration. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | -| tool | Trivy Vulnerability Scanner | -| filter-by | ['product'] | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| rule_level | array | False | List of rule levels to check for in the Trivy SARIF report. | -| precision | array | False | List of precision levels to check for in the Trivy SARIF report. | -| rule_ids | array | False | List of rule IDs to check for in the Trivy SARIF report. | -| ignore | array | False | List of rule IDs to ignore in the Trivy SARIF report. | -| max_allowed | integer | False | The maximum number of allowed violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md deleted file mode 100644 index ec085bbf8..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-attack-vector.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -sidebar_label: Verify Attack Vector Exists in SARIF -title: Verify Attack Vector Exists in SARIF ---- -# Verify Attack Vector Exists in SARIF -**Type:** Rule -**ID:** `sarif-attack-vectors` -**Source:** [v2/rules/sarif/verify-attack-vector.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.yaml) -**Rego Source:** [verify-attack-vector.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-attack-vector.rego) -**Labels:** SARIF - -Verify required evidence validates attack vectors in the SARIF report. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: sarif/verify-attack-vector@v2/rules -with: - attack_vectors: - - "stack buffer overflow" - violations_threshold: 2 -``` - -## Mitigation -Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. - - - -## Description -This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities -associated with specific attack vectors are properly identified. The rule works as follows: - -1. It iterates over the vulnerability results in the SARIF report (from `input.evidence.predicate.content.runs[0].results`). -2. For each result, it retrieves the corresponding rule definition from - `input.evidence.predicate.content.runs[0].tool.driver.rules` based on the result's ruleIndex. -3. The rule checks if the rule’s full description contains the phrase "The attack vector is" and whether it - includes any of the attack vectors specified in the configuration (`with.attack_vectors`). -4. If such a vulnerability is found and the total number of matching findings exceeds the configured threshold - (`with.violations_threshold`), a violation is recorded. The violation includes the rule identifier and the - associated description. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. -- The SARIF report should be generated by a tool like the Vulnerability Scanner. -- The report must include detailed rule definitions and descriptions that mention attack vectors. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| attack_vectors | array | False | List of attack vectors to check for in the SARIF report. | -| violations_threshold | integer | False | The maximum number of allowed attack vector violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md deleted file mode 100644 index b9d1677ad..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-sarif.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Verify Rule Compliance in SARIF -title: Verify Rule Compliance in SARIF ---- -# Verify Rule Compliance in SARIF -**Type:** Rule -**ID:** `sarif-policy` -**Source:** [v2/rules/sarif/verify-sarif.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.yaml) -**Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) -**Labels:** SARIF - -Verify the SARIF report complies with defined generic rules for compliance and security. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. - - - -## Description -This rule evaluates the SARIF report provided as evidence to verify that it meets a set of predefined generic rules. -It does so by using helper functions from the `data.sarif` module to: - -1. Check that the vulnerability results in the report (found under `input.evidence.predicate.content.runs[0].results`) - conform to the expected type and severity level as defined by configuration parameters (such as `rule_level`, `precision`, - `rule_ids`, and `ignore`). -2. Ensure that the total number of reported violations does not exceed the maximum allowed (`with.max_allowed`). - -If the number of violations exceeds the threshold, a violation is recorded with details including the rule identifier, -severity, and the corresponding location in the artifact. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format that adheres to the SARIF 2.1.0 schema. -- The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions. -- The evaluation uses the configuration parameters provided in the `with` section to guide the verification process. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| rule_level | array | False | List of rule levels to check for in the SARIF report. | -| precision | array | False | List of precision levels to check for in the SARIF report. | -| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | -| ignore | array | False | List of rule IDs to ignore in the SARIF report. | -| max_allowed | integer | False | The maximum number of allowed violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md deleted file mode 100644 index 98994825d..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-semgrep-report.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -sidebar_label: Verify Semgrep Rule in SARIF -title: Verify Semgrep Rule in SARIF ---- -# Verify Semgrep Rule in SARIF -**Type:** Rule -**ID:** `sarif-semgrep-report` -**Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) -**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) -**Labels:** SARIF, Semgrep - -Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. - - - -## Description -This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules. -It iterates over the vulnerability results in the SARIF report (located under -`input.evidence.predicate.content.runs[0].results`) and retrieves the corresponding rule definitions -from `input.evidence.predicate.content.runs[0].tool.driver.rules` based on each result's ruleIndex. - -The rule checks whether the result’s ruleId contains any of the identifiers specified in the configuration (`with.rule_ids`). -If the total number of matching findings exceeds the allowed threshold (specified by `with.violations_threshold`), a violation is recorded. -Each violation includes details such as the rule identifier, the extracted severity, and the location of the finding. - -### **Evidence Requirements** - -- Evidence must be provided in a generic format conforming to the SARIF 2.1.0 schema. -- The SARIF report should be generated by Semgrep. -- The report must include detailed rule definitions and descriptions that support matching against the specified blocklist. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| rule_level | array | False | List of rule levels to check for in the SARIF report. | -| precision | array | False | List of precision levels to check for in the SARIF report. | -| rule_ids | array | False | List of rule IDs to check for in the SARIF report. | -| ignore | array | False | List of rule IDs to ignore in the SARIF report. | -| max_allowed | integer | False | The maximum number of allowed violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md deleted file mode 100644 index a226b55f9..000000000 --- a/docs/configuration/v2/initiatives/rules/sarif/verify-tool-evidence.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -sidebar_label: Verify Tool Evidence in SARIF -title: Verify Tool Evidence in SARIF ---- -# Verify Tool Evidence in SARIF -**Type:** Rule -**ID:** `sarif-tool-evidence` -**Source:** [v2/rules/sarif/verify-tool-evidence.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.yaml) -**Rego Source:** [verify-tool-evidence.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-tool-evidence.rego) -**Labels:** SARIF - -Verify required tools were used to generate the SARIF report. - -:::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. - - - -## Description -This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner -(e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: -the `tool` field must equal the expected scanner name to ensure the report is generated by the correct tool. -A mismatch indicates that the report may not be reliable. - -### **Evidence Requirements** -- Evidence must adhere to the SARIF 2.1.0 schema. -- The report must include a valid `tool` field. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | generic | -| target_type | data | -| predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md deleted file mode 100644 index 848936c2c..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/NTIA-compliance.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -sidebar_label: NTIA SBOM Compliance Check -title: NTIA SBOM Compliance Check ---- -# NTIA SBOM Compliance Check -**Type:** Rule -**ID:** `NTIA-compliance` -**Source:** [v2/rules/sbom/NTIA-compliance.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.yaml) -**Rego Source:** [NTIA-compliance.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/NTIA-compliance.rego) -**Labels:** SBOM, Compliance, Image, Git - -Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. - - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::note -Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. - -For example, -```yaml -valint bom my_company/my_image:latest \ - --author-name "bob" \ - --author-email bob@my_company.com \ - --author-phone "123-456-7890" \ - --supplier-email bob@my_company.com \ - --supplier-name "alice" \ - --supplier-url "https://my_company.com" \ - --supplier-phone "123-456-7890" -``` - -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/NTIA-compliance@v2/rules -with: - required_author: - name: "bom" - email: "bob@company.com" - required_supplier: - name: "alice" - -``` - -## Mitigation -Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers. - - - -## Description -This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers. -It performs the following steps: - -1. Checks that authors exist, are non-empty, and each author has both a name and email. -2. Checks that the supplier exists with a non-empty name, URL, and contact. At least one contact must have a non-empty email. -3. Optionally enforces a required author (case-insensitive match for name/email). -4. Optionally enforces a required supplier (case-insensitive match for supplier name). - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include metadata for authors and suppliers. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| required_author | object | False | The required author (case-insensitive match for name/email). | -| required_supplier | object | False | The required supplier (case-insensitive match for supplier name). | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/_category_.json b/docs/configuration/v2/initiatives/rules/sbom/_category_.json deleted file mode 100644 index cdfd70c71..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SBOM", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md b/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md deleted file mode 100644 index 3911c25d6..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/allowed-components.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -sidebar_label: Enforce Allowed SBOM Components -title: Enforce Allowed SBOM Components ---- -# Enforce Allowed SBOM Components -**Type:** Rule -**ID:** `sbom-allowed-components` -**Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) -**Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image, Git - -Verify the artifact contains only allowed components. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::note -Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/allowed-components@v2/rules -with: - types: - - library - - operating-system -``` - -## Mitigation -Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components. -It performs the following steps: - -1. Iterates over the components listed in the SBOM. -2. Checks each component's type against the allowed types specified in the `with.types` configuration. -3. Compares each component's name against the allowlist provided in the `with.allowlist` configuration. - - If a component's type or name is not allowed, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a list of components with their types and names. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| types | array | True | A list of allowed component types. | -| allowlist | array | True | A list of allowed components. | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md deleted file mode 100644 index d5c073b1b..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/artifact-signed.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -sidebar_label: Require SBOM Signature -title: Require SBOM Signature ---- -# Require SBOM Signature -**Type:** Rule -**ID:** `sbom-signed` -**Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) -**Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint, Git - -Verify the SBOM is signed. - -:::note -This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| content_body_type | cyclonedx-json | -| signed | True | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| identity | `{'common-names': [], 'emails': []}` | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md deleted file mode 100644 index 4dc58a690..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/banned-licenses.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -sidebar_label: Restrict Disallowed SBOM Licenses -title: Restrict Disallowed SBOM Licenses ---- -# Restrict Disallowed SBOM Licenses -**Type:** Rule -**ID:** `sbom-disallowed-licenses` -**Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) -**Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image, Git - -Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/banned-licenses@v2/rules -with: - blocklist: - - "GPL-2.0" - - "GPL-3.0" - blocklisted_limit: 1 -``` - -## Mitigation -Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses -remains below the specified threshold. It performs the following steps: - -1. Iterates over the components listed in the SBOM. -2. Checks each component's license against the blocklist provided in the `with.blocklist` configuration. -3. Counts the number of components with disallowed licenses. - - If the count exceeds the specified `with.blocklisted_limit`, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a list of components with their licenses. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| blocklist | array | False | A list of disallowed licenses. | -| blocklisted_limit | integer | False | The maximum number of components with disallowed licenses allowed. | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md deleted file mode 100644 index 1c619722a..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/blocklist-packages.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -sidebar_label: Restrict Disallowed Dependencies -title: Restrict Disallowed Dependencies ---- -# Restrict Disallowed Dependencies -**Type:** Rule -**ID:** `sbom-disallow-dependencies` -**Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) -**Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint, Git - -Verify the number of disallowed dependencies remains below the specified threshold. - -:::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocklist | [] | -| blocklisted_limit | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md deleted file mode 100644 index 0dd812234..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/complete-licenses.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -sidebar_label: Enforce SBOM License Completeness -title: Enforce SBOM License Completeness ---- -# Enforce SBOM License Completeness -**Type:** Rule -**ID:** `sbom-require-complete-license-set` -**Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) -**Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image, Git - -Verify all dependencies in the artifact have a license. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses. -It performs the following steps: - -1. Iterates over the dependencies listed in the SBOM. -2. Checks each dependency for the presence of a license. - - If a dependency does not have a license, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a list of dependencies with their licenses. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md deleted file mode 100644 index a6c8a78fe..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/fresh-sbom.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -sidebar_label: Enforce SBOM Freshness -title: Enforce SBOM Freshness ---- -# Enforce SBOM Freshness -**Type:** Rule -**ID:** `fresh-sbom` -**Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) -**Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM, Image, Git - -Verify the SBOM is not older than the specified duration. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/fresh-sbom@v2/rules -with: - max_days: 30 -``` - -## Mitigation -Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components. - - - -## Description -This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration. -It performs the following steps: - -1. Checks the creation date of the SBOM. -2. Compares the creation date against the maximum allowed age specified in the `with.max_days` configuration. - - If the SBOM is older than the allowed duration, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a creation date. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| max_days | integer | False | The maximum allowed age of the SBOM in days. | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md b/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md deleted file mode 100644 index 9d31dc49c..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/require-sbom.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -sidebar_label: Require SBOM Existence -title: Require SBOM Existence ---- -# Require SBOM Existence -**Type:** Rule -**ID:** `require-sbom` -**Source:** [v2/rules/sbom/require-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.yaml) -**Rego Source:** [require-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/require-sbom.rego) -**Labels:** SBOM, Blueprint, Image, Git - -Verify the SBOM exists as evidence. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies. - - - -## Description -This rule verifies the existence of an SBOM as evidence. -It performs the following steps: - -1. Checks for the presence of an SBOM. - - If the SBOM is missing, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| content_body_type | cyclonedx-json | -| signed | False | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md b/docs/configuration/v2/initiatives/rules/sbom/required-packages.md deleted file mode 100644 index 8048b8332..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/required-packages.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -sidebar_label: Enforce SBOM Dependencies -title: Enforce SBOM Dependencies ---- -# Enforce SBOM Dependencies -**Type:** Rule -**ID:** `sbom-required-dependencies` -**Source:** [v2/rules/sbom/required-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.yaml) -**Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) -**Labels:** SBOM, Image - -Verify the artifact includes all required dependencies specified as a list of PURLs. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/required-packages@v2/rules -with: - required_pkgs: - - "pkg:maven/org.apache.commons/commons-lang3@3.9" - - "pkg:npm/lodash@4.17.15" - violations_limit: 0 -``` - -## Mitigation -Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements. - - - -## Description -This rule verifies that the artifact includes all required dependencies as specified. -It performs the following steps: - -1. Iterates over the dependencies listed in the SBOM. -2. Checks each dependency against the required dependencies specified in the `with.required_pkgs` configuration. - - If a required dependency is missing, the rule flags it as a violation. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a list of dependencies. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| required_pkgs | array | True | A list of required dependencies specified as PURLs. | -| violations_limit | integer | False | The maximum number of allowed violations. | - diff --git a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md deleted file mode 100644 index ea5b11952..000000000 --- a/docs/configuration/v2/initiatives/rules/sbom/verify-huggingface-license.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -sidebar_label: Require Specified SBOM Licenses -title: Require Specified SBOM Licenses ---- -# Require Specified SBOM Licenses -**Type:** Rule -**ID:** `sbom-hf-license` -**Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) -**Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image, Git - -Verify the artifact includes all specified licenses. - -:::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. -::: -:::note -Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Usage example - -```yaml -uses: sbom/verify-huggingface-license@v2/rules -with: - licenses: - - "MIT" - - "Apache-2.0" -``` - -## Mitigation -Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses. - - - -## Description -This rule verifies that the artifact includes all specified licenses. -It performs the following steps: - -1. Iterates over the dependencies listed in the SBOM. -2. Checks each dependency for the presence of the specified licenses in the `with.licenses` configuration. - - If a specified license is missing, the rule flags it as a violation. -3. Accesses the Hugging Face API to validate the licenses. - -**Evidence Requirements:** -- Evidence must be provided in the CycloneDX JSON format. -- The SBOM must include a list of dependencies with their licenses. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | cyclonedx-json | - -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| licenses | array | True | A list of specified licenses. | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/_category_.json b/docs/configuration/v2/initiatives/rules/slsa/_category_.json deleted file mode 100644 index da652e8f6..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SLSA", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md deleted file mode 100644 index 1c1d44f4f..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/banned-builder-deps.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -sidebar_label: Disallow dependencies in SLSA Provenance Document -title: Disallow dependencies in SLSA Provenance Document ---- -# Disallow dependencies in SLSA Provenance Document -**Type:** Rule -**ID:** `slsa-builder-unallowed-dependencies` -**Source:** [v2/rules/slsa/banned-builder-deps.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.yaml) -**Rego Source:** [banned-builder-deps.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/banned-builder-deps.rego) -**Labels:** SLSA, Image - -Verify that dependencies in the block list do not appear in the SLSA Proveance document. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | slsa | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocklist | [] | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/build-time.md b/docs/configuration/v2/initiatives/rules/slsa/build-time.md deleted file mode 100644 index 84443b498..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/build-time.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Verify build time -title: Verify build time ---- -# Verify build time -**Type:** Rule -**ID:** `slsa-build-time` -**Source:** [v2/rules/slsa/build-time.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.yaml) -**Rego Source:** [build-time.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/build-time.rego) -**Labels:** SLSA, Image - -Verify the artifact was created within the specified time window. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | slsa | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| start_hour | 8 | -| end_hour | 20 | -| workdays | ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday'] | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md b/docs/configuration/v2/initiatives/rules/slsa/field-exists.md deleted file mode 100644 index e0bfea3b8..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/field-exists.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: SLSA Field Exists in Provenance Document -title: SLSA Field Exists in Provenance Document ---- -# SLSA Field Exists in Provenance Document -**Type:** Rule -**ID:** `slsa-field-exists` -**Source:** [v2/rules/slsa/field-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.yaml) -**Rego Source:** [field-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/field-exists.rego) -**Labels:** SLSA, Image - -Verify the specified field exists in the provenance document. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | slsa | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| paths | [] | -| violations_threshold | 0 | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md deleted file mode 100644 index 86f1244cd..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/l1-provenance-exists.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -sidebar_label: Verify Provenance Document Exists -title: Verify Provenance Document Exists ---- -# Verify Provenance Document Exists -**Type:** Rule -**ID:** `SLSA.L1` -**Source:** [v2/rules/slsa/l1-provenance-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.yaml) -**Rego Source:** [l1-provenance-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l1-provenance-exists.rego) -**Help:** https://slsa.dev/spec/v1.0/requirements -**Labels:** SLSA - -Verify that the Provenance document evidence exists. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | False | -| content_body_type | slsa | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md deleted file mode 100644 index 6be915c55..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/l2-provenance-authenticated.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -sidebar_label: Verify that provenance is authenticated -title: Verify that provenance is authenticated ---- -# Verify that provenance is authenticated -**Type:** Rule -**ID:** `SLSA.L2` -**Source:** [v2/rules/slsa/l2-provenance-authenticated.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.yaml) -**Rego Source:** [l2-provenance-authenticated.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/l2-provenance-authenticated.rego) -**Help:** https://slsa.dev/spec/v1.0/requirements -**Labels:** SLSA - -Verify the artifact is signed. - -:::note -This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: -:::info -Rule is scoped by product and target. -::: - -## Mitigation -Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. - - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['product', 'target'] | -| signed | True | -| content_body_type | slsa | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| identity | `{'common-names': [], 'emails': []}` | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md b/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md deleted file mode 100644 index 55ecede25..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-builder.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -sidebar_label: Verify that artifact was created by the specified builder -title: Verify that artifact was created by the specified builder ---- -# Verify that artifact was created by the specified builder -**Type:** Rule -**ID:** `slsa-verify-builder` -**Source:** [v2/rules/slsa/verify-builder.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.yaml) -**Rego Source:** [verify-builder.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-builder.rego) -**Labels:** SLSA, Image - -Verify the artifact was created by the specified builder. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::info -Rule is scoped by pipeline and product. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| filter-by | ['pipeline', 'product'] | -| signed | False | -| content_body_type | slsa | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| id | `{{ .Env.HOSTNAME }}` | - diff --git a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md deleted file mode 100644 index c5ed5e430..000000000 --- a/docs/configuration/v2/initiatives/rules/slsa/verify-byproducts.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -sidebar_label: Verify that artifact has no disallowed builder dependencies -title: Verify that artifact has no disallowed builder dependencies ---- -# Verify that artifact has no disallowed builder dependencies -**Type:** Rule -**ID:** `slsa-verify-byproducts` -**Source:** [v2/rules/slsa/verify-byproducts.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.yaml) -**Rego Source:** [verify-byproducts.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-byproducts.rego) -**Labels:** SLSA, Image - -Verify the artifact has no disallowed builder dependencies. - -:::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | slsa | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| byproducts | [] | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/_category_.json b/docs/configuration/v2/initiatives/rules/ssdf/_category_.json deleted file mode 100644 index dc1b66dcb..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SSDF", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md deleted file mode 100644 index 53f8731f8..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-2fa.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -sidebar_label: Enforce 2FA -title: Enforce 2FA ---- -# Enforce 2FA -**Type:** Rule -**ID:** `PS.1.1` -**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) -**Labels:** SSDF - -PS.1 Require 2FA for accessing code - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - - - -## Description -This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. -It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the -`organization_details.two_factor_requirement_enabled` field against the expected value. - -The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match -the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional -layer of security against unauthorized access. - -### **Evidence Requirements** -- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. -- The data should come from a trusted source (e.g., a GitHub organization scan). -- The evidence must clearly indicate whether 2FA is enabled. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md deleted file mode 100644 index 9f23a8ac5..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-branch-protection.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Branch protected -title: Branch protected ---- -# Branch protected -**Type:** Rule -**ID:** `PS.1.2` -**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) -**Labels:** SSDF - -PS.1 Require branch protection for the repository - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. - - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_protected | True | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md deleted file mode 100644 index dfac15c63..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-limit-admins.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Limit admins -title: Limit admins ---- -# Limit admins -**Type:** Rule -**ID:** `PS.1.3` -**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) -**Labels:** SSDF - -PS.1 Restrict the maximum number of organization admins - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. - - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 3 | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md deleted file mode 100644 index b2e8d4604..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-repo-private.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Repo private -title: Repo private ---- -# Repo private -**Type:** Rule -**ID:** `PS.1.4` -**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) -**Labels:** SSDF - -PS.1 Assure the repository is private - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. - - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md deleted file mode 100644 index c238474c6..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Require signoff on web commits -title: Require signoff on web commits ---- -# Require signoff on web commits -**Type:** Rule -**ID:** `PS.1.5` -**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) -**Labels:** SSDF - -PS.1 Require contributors to sign when committing to Github through the web interface - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. - - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md deleted file mode 100644 index 33875b4f5..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: Image-verifiable -title: Image-verifiable ---- -# Image-verifiable -**Type:** Rule -**ID:** `PS.2` -**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) -**Labels:** SSDF - -PS.2 Provide a mechanism to verify the integrity of the image - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. - - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| target_type | container | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md deleted file mode 100644 index 55949571f..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Code archived -title: Code archived ---- -# Code archived -**Type:** Rule -**ID:** `PS.3.1` -**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) -**Labels:** SSDF - -PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository - - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Archives code changes to maintain a secure, immutable history for auditing and traceability. - - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allow | True | -| short_description | Code is archived. | -| description | Since the code is within a repository, it is archived. | -| reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. | - diff --git a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md deleted file mode 100644 index 9ec173cac..000000000 --- a/docs/configuration/v2/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -sidebar_label: SBOM archived -title: SBOM archived ---- -# SBOM archived -**Type:** Rule -**ID:** `PS.3.2` -**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) -**Labels:** SSDF - -PS.3.2 Archive SBOM - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Mitigation -Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. - - - diff --git a/docs/configuration/v2/initiatives/slsa.l1.md b/docs/configuration/v2/initiatives/slsa.l1.md deleted file mode 100644 index 05c938eff..000000000 --- a/docs/configuration/v2/initiatives/slsa.l1.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -sidebar_label: SLSA L1 Framework -title: SLSA L1 Framework ---- -# SLSA L1 Framework -**Type:** Initiative -**ID:** `SLSA.L1` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/slsa.l1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml) -**Help:** https://slsa.dev/ - -Evaluate SLSA Level 1 - -## **Description** - -This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. - - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [prov_exists](#prov_exists-provenance-exists) | Provenance exists | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | False | - ---- - -# Detailed Controls - -## [prov_exists] Provenance exists - -This control verifies that essential provenance metadata is present for each build artifact. - - -### Mitigation -Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/v2/initiatives/slsa.l2.md b/docs/configuration/v2/initiatives/slsa.l2.md deleted file mode 100644 index a4debb87e..000000000 --- a/docs/configuration/v2/initiatives/slsa.l2.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -sidebar_label: SLSA L2 Framework -title: SLSA L2 Framework ---- -# SLSA L2 Framework -**Type:** Initiative -**ID:** `SLSA.L2` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/slsa.l2.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml) -**Help:** https://slsa.dev/ - -Evaluate SLSA Level 2 - -## **Description** - -Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." - - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [prov_authn](#prov_authn-provenance-authenticated) | Provenance authenticated | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | False | - ---- - -# Detailed Controls - -## [prov_authn] Provenance authenticated - -Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. - - -### Mitigation -Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/v2/initiatives/sp-800-190.md b/docs/configuration/v2/initiatives/sp-800-190.md deleted file mode 100644 index c69918607..000000000 --- a/docs/configuration/v2/initiatives/sp-800-190.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -sidebar_label: NIST Application Container Security Initiative -title: NIST Application Container Security Initiative ---- -# NIST Application Container Security Initiative -**Type:** Initiative -**ID:** `SP-800-190` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/sp-800-190.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-190.yaml) -**Help:** https://csrc.nist.gov/publications/detail/sp/800-190/final - -This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. - - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [4.1](#41-41-image-countermeasures) | 4.1 IMAGE COUNTERMEASURES | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. - | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. - | -| [4.2](#42-42-registry-countermeasures) | 4.2 REGISTRY COUNTERMEASURES | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. - | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. - | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | False | - ---- - -# Detailed Controls - -## [4.1] 4.1 IMAGE COUNTERMEASURES - -Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. - - - -### Mitigation -Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. - | -| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. - | -| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. - | -| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. - | -| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. - | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. - | -| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. - | -| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. - | -| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. - | - -## [4.2] 4.2 REGISTRY COUNTERMEASURES - -Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. - - - -### Mitigation -Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. - | -| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. - | -| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. - | diff --git a/docs/configuration/v2/initiatives/sp-800-53.md b/docs/configuration/v2/initiatives/sp-800-53.md deleted file mode 100644 index f0dddaf2b..000000000 --- a/docs/configuration/v2/initiatives/sp-800-53.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -sidebar_label: NIST Supply Chain Integrity Initiative -title: NIST Supply Chain Integrity Initiative ---- -# NIST Supply Chain Integrity Initiative -**Type:** Initiative -**ID:** `SP-800-53` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/sp-800-53.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sp-800-53.yaml) -**Help:** https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final - -This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, - addressing requirements from SR-4 and CM-8. - - Provenance data to support architectural traceability, as outlined in SA-8. -Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. - - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [SR4_CM8](#sr4_cm8-sbom-requirement-sr-4-cm-8) | SBOM Requirement (SR-4 / CM-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. - | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | -| [SA8](#sa8-provenance-requirement-sa-8) | Provenance Requirement (SA-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. - | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | -| [SA12](#sa12-sbom-signature-enforcement-sa-12) | SBOM Signature Enforcement (SA-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. - | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | False | - ---- - -# Detailed Controls - -## [SR4_CM8] SBOM Requirement (SR-4 / CM-8) - -Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. - - - -### Mitigation -Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: - | -| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. - | - -## [SA8] Provenance Requirement (SA-8) - -Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. - - - -### Mitigation -Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | - -## [SA12] SBOM Signature Enforcement (SA-12) - -Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. - - - -### Mitigation -Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/v2/initiatives/ssdf.md b/docs/configuration/v2/initiatives/ssdf.md deleted file mode 100644 index 9c0a66d9e..000000000 --- a/docs/configuration/v2/initiatives/ssdf.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -sidebar_label: SSDF Client Initiative -title: SSDF Client Initiative ---- -# SSDF Client Initiative -**Type:** Initiative -**ID:** `SSDF` -**Version:** `1.0.0` -**Bundle-Version:** `v2` -**Source:** [v2/initiatives/ssdf.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/ssdf.yaml) -**Help:** https://csrc.nist.gov/pubs/sp/800/218/final - -Evaluate PS rules from the SSDF initiative - -## **Description** - -This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. - - -## Controls Overview - -| Control ID | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| -| [SSDF-IMAGE](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. - | -| [SSDF-ORG](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. - | -| [SSDF-REPO](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. - | - -## Evidence Defaults - -| Field | Value | -|-------|-------| -| signed | False | - ---- - -# Detailed Controls - -## SSDF-IMAGE - -Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. - - -### Mitigation -Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [PS.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | - -## SSDF-ORG - -Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. - - -### Mitigation -Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [PS.1.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | - -## SSDF-REPO - -Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. - - -### Mitigation -Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. - - -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository - | -| [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index 367cc7507..4f9f46d6d 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -261,7 +261,7 @@ import_sample-policies() { dst_dir="docs/guides" # Copy sample policy docs - cp -r "${repo_dir}/docs/v2/" "docs/configuration/" + cp -r "${repo_dir}/docs/v2/*" "docs/configuration/" # Create a temporary file to hold the table content from index.md tmpfile=$(mktemp) From e5dd12914b127d18a980fc0d60a82421964c7dd2 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:47:57 +0200 Subject: [PATCH 146/191] update index location --- docs/configuration/initiatives/bp1.md | 22 ++++++++++---------- docs/configuration/initiatives/slsa.l1.md | 4 ++-- docs/configuration/initiatives/slsa.l2.md | 4 ++-- docs/configuration/initiatives/sp-800-190.md | 6 +++--- docs/configuration/initiatives/sp-800-53.md | 8 +++---- docs/configuration/initiatives/ssdf.md | 8 +++---- 6 files changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 65d8e12d5..c7a3ebd24 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -18,18 +18,18 @@ This initiative defines a set of best practices and technical guidelines designe ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [CT-1](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [CT-2](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | Only accept commits signed with a developer GPG key | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | -| [CT-3](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | -| [CT-4](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | -| [CT-6](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | -| [CT-8](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | -| [CT-9](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | -| [CT-11](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | -| [CT-12](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | -| [CT-13](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | +| [[CT-1] Restrict administrative access to CI/CD tools](#restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [[CT-2] Only accept commits signed with a developer GPG key](#only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [[CT-3] Automation access keys expire automatically](#automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [[CT-4] Reduce automation access to read-only](#reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [[CT-6] Any critical or high severity vulnerability breaks the build](#any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CT-8] Validate artifact digest](#validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [[CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CT-11] Available container images don’t have any high or critical vulnerabilities](#available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [[CT-12] Validate artifact signatures and digests](#validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [[CT-13] Scan deployed images in production](#scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 05c938eff..05212de6f 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -19,9 +19,9 @@ This initiative ensures that every critical build artifact includes the minimum ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [prov_exists](#prov_exists-provenance-exists) | Provenance exists | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | +| [[prov_exists] Provenance exists](#provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index a4debb87e..e022c85ce 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -19,9 +19,9 @@ Evaluate SLSA L2 and ensure that provenance information is both recorded and aut ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [prov_authn](#prov_authn-provenance-authenticated) | Provenance authenticated | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | +| [[prov_authn] Provenance authenticated](#provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index c69918607..b9aaa3160 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -15,12 +15,12 @@ This initiative enforces container security controls as outlined in NIST SP 800 ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [4.1](#41-41-image-countermeasures) | 4.1 IMAGE COUNTERMEASURES | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. +| [[4.1] 4.1 IMAGE COUNTERMEASURES](#41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | -| [4.2](#42-42-registry-countermeasures) | 4.2 REGISTRY COUNTERMEASURES | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. +| [[4.2] 4.2 REGISTRY COUNTERMEASURES](#42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index f0dddaf2b..3423acf83 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -19,13 +19,13 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [SR4_CM8](#sr4_cm8-sbom-requirement-sr-4-cm-8) | SBOM Requirement (SR-4 / CM-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. +| [[SR4_CM8] SBOM Requirement (SR-4 / CM-8)](#sbom-requirement-sr-4-cm-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | -| [SA8](#sa8-provenance-requirement-sa-8) | Provenance Requirement (SA-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. +| [[SA8] Provenance Requirement (SA-8)](#provenance-requirement-sa-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | -| [SA12](#sa12-sbom-signature-enforcement-sa-12) | SBOM Signature Enforcement (SA-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. +| [[SA12] SBOM Signature Enforcement (SA-12)](#sbom-signature-enforcement-sa-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 9c0a66d9e..3c349bd22 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -19,13 +19,13 @@ This initiative enforces key controls from the Secure Software Development Frame ## Controls Overview -| Control ID | Control Name | Control Description | Mitigation | +| Control Name | Control Description | Mitigation | |------------|--------------|---------------------|------------| -| [SSDF-IMAGE](#ssdf-image) | SSDF-IMAGE | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. +| [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. | -| [SSDF-ORG](#ssdf-org) | SSDF-ORG | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. +| [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. | -| [SSDF-REPO](#ssdf-repo) | SSDF-REPO | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. +| [SSDF-REPO](#ssdf-repo) | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. | ## Evidence Defaults From a63f97bcb2a89b60b6b92e831f311763c774e864 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:50:56 +0200 Subject: [PATCH 147/191] update index location --- docs/configuration/initiatives/bp1.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 2 +- docs/configuration/initiatives/sp-800-190.md | 2 +- docs/configuration/initiatives/sp-800-53.md | 2 +- docs/configuration/initiatives/ssdf.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index c7a3ebd24..5d2e66d4c 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -19,7 +19,7 @@ This initiative defines a set of best practices and technical guidelines designe ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [[CT-1] Restrict administrative access to CI/CD tools](#restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | | [[CT-2] Only accept commits signed with a developer GPG key](#only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | | [[CT-3] Automation access keys expire automatically](#automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 05212de6f..a2bf6ab17 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -20,7 +20,7 @@ This initiative ensures that every critical build artifact includes the minimum ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [[prov_exists] Provenance exists](#provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index e022c85ce..08225e50a 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -20,7 +20,7 @@ Evaluate SLSA L2 and ensure that provenance information is both recorded and aut ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [[prov_authn] Provenance authenticated](#provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index b9aaa3160..c8026eb01 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -16,7 +16,7 @@ This initiative enforces container security controls as outlined in NIST SP 800 ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [[4.1] 4.1 IMAGE COUNTERMEASURES](#41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 3423acf83..dc4a500ae 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -20,7 +20,7 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [[SR4_CM8] SBOM Requirement (SR-4 / CM-8)](#sbom-requirement-sr-4-cm-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | | [[SA8] Provenance Requirement (SA-8)](#provenance-requirement-sa-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 3c349bd22..cf2ce087f 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -20,7 +20,7 @@ This initiative enforces key controls from the Secure Software Development Frame ## Controls Overview | Control Name | Control Description | Mitigation | -|------------|--------------|---------------------|------------| +|--------------|---------------------|------------| | [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. | | [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. From 5641f820e6a51a9ea7c9298d8a586fec26c382ec Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:55:01 +0200 Subject: [PATCH 148/191] update index location --- docs/configuration/initiatives/bp1.md | 20 ++++++++++---------- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 2 +- docs/configuration/initiatives/sp-800-190.md | 4 ++-- docs/configuration/initiatives/sp-800-53.md | 6 +++--- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 5d2e66d4c..93340f10f 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -20,16 +20,16 @@ This initiative defines a set of best practices and technical guidelines designe | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[CT-1] Restrict administrative access to CI/CD tools](#restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [[CT-2] Only accept commits signed with a developer GPG key](#only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | -| [[CT-3] Automation access keys expire automatically](#automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | -| [[CT-4] Reduce automation access to read-only](#reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | -| [[CT-6] Any critical or high severity vulnerability breaks the build](#any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | -| [[CT-8] Validate artifact digest](#validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | -| [[CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | -| [[CT-11] Available container images don’t have any high or critical vulnerabilities](#available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | -| [[CT-12] Validate artifact signatures and digests](#validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | -| [[CT-13] Scan deployed images in production](#scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | +| [[CT-1] Restrict administrative access to CI/CD tools](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [[CT-2] Only accept commits signed with a developer GPG key](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [[CT-3] Automation access keys expire automatically](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [[CT-4] Reduce automation access to read-only](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [[CT-6] Any critical or high severity vulnerability breaks the build](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CT-8] Validate artifact digest](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [[CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CT-11] Available container images don’t have any high or critical vulnerabilities](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [[CT-12] Validate artifact signatures and digests](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [[CT-13] Scan deployed images in production](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index a2bf6ab17..31f927eec 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -21,7 +21,7 @@ This initiative ensures that every critical build artifact includes the minimum | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[prov_exists] Provenance exists](#provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | +| [[prov_exists] Provenance exists](#prov_exists-provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 08225e50a..8803d85d1 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -21,7 +21,7 @@ Evaluate SLSA L2 and ensure that provenance information is both recorded and aut | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[prov_authn] Provenance authenticated](#provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | +| [[prov_authn] Provenance authenticated](#prov_authn-provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | ## Evidence Defaults diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index c8026eb01..aa2e12efd 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -17,10 +17,10 @@ This initiative enforces container security controls as outlined in NIST SP 800 | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[4.1] 4.1 IMAGE COUNTERMEASURES](#41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. +| [[4.1] 4.1 IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | -| [[4.2] 4.2 REGISTRY COUNTERMEASURES](#42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. +| [[4.2] 4.2 REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index dc4a500ae..e34fd54ae 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -21,11 +21,11 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[SR4_CM8] SBOM Requirement (SR-4 / CM-8)](#sbom-requirement-sr-4-cm-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. +| [[SR4_CM8] SBOM Requirement (SR-4 / CM-8)](#sr4_cm8-sbom-requirement-sr-4-cm-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | -| [[SA8] Provenance Requirement (SA-8)](#provenance-requirement-sa-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. +| [[SA8] Provenance Requirement (SA-8)](#sa8-provenance-requirement-sa-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | -| [[SA12] SBOM Signature Enforcement (SA-12)](#sbom-signature-enforcement-sa-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. +| [[SA12] SBOM Signature Enforcement (SA-12)](#sa12-sbom-signature-enforcement-sa-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | ## Evidence Defaults From 0a5d1a84f2488648dd30773b31ecb6a95eb9f987 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 11:59:45 +0200 Subject: [PATCH 149/191] update index location --- docs/configuration/initiatives/sp-800-190.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index aa2e12efd..981667a68 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -17,10 +17,10 @@ This initiative enforces container security controls as outlined in NIST SP 800 | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[4.1] 4.1 IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. +| [[4.1] IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | -| [[4.2] 4.2 REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. +| [[4.2] REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | From 1f2d3692215644ea629569e6a3c98c8375a7976f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 12:32:44 +0200 Subject: [PATCH 150/191] update --- .../configuration/initiatives/rules/generic/artifact-signed.md | 3 --- .../configuration/initiatives/rules/generic/evidence-exists.md | 3 --- docs/configuration/initiatives/rules/git/artifact-signed.md | 3 --- docs/configuration/initiatives/rules/git/evidence-exists.md | 3 --- docs/configuration/initiatives/rules/sarif/artifact-signed.md | 3 --- docs/configuration/initiatives/rules/sarif/evidence-exists.md | 3 --- .../initiatives/rules/sarif/trivy/verify-cve-severity.md | 3 --- .../initiatives/rules/sarif/verify-tool-evidence.md | 3 --- docs/configuration/initiatives/rules/sbom/artifact-signed.md | 3 --- docs/configuration/initiatives/rules/sbom/require-sbom.md | 3 --- .../initiatives/rules/slsa/l1-provenance-exists.md | 3 --- .../initiatives/rules/slsa/l2-provenance-authenticated.md | 3 --- 12 files changed, 36 deletions(-) diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 43014375d..d806ee6a5 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -18,9 +18,6 @@ This rule requires Signed Generic Statement. See [here](https://deploy-preview-2 > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 755d64a55..d0f288ebe 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -18,9 +18,6 @@ This rule requires Generic Statement. See [here](https://deploy-preview-299--scr > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index adba441c5..a59cb928c 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -18,9 +18,6 @@ This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scrib > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 1726df4b0..511e004bb 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -18,9 +18,6 @@ This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-secur > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index c3480fabc..5d20c12a5 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -18,9 +18,6 @@ This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299- > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index d964e62af..4c8261a27 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -18,9 +18,6 @@ This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index f81c69280..c6d2c8656 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -21,9 +21,6 @@ This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::info diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index a226b55f9..b7c87eb91 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -18,9 +18,6 @@ This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index d5c073b1b..4c8b9c04f 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -18,9 +18,6 @@ This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-se > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 9d31dc49c..5a7bcdcf2 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -18,9 +18,6 @@ This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security. > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 86f1244cd..89d8b1649 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -19,9 +19,6 @@ This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scrib > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. ::: :::warning diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 6be915c55..ac7ed54ea 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -19,9 +19,6 @@ This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299 > Evidence **IS** required for this rule and will fail if missing. ::: :::tip -> Evidence **IS** required for this rule and will fail if missing. -::: -:::tip Signed Evidence for this rule **IS** required by default. ::: :::warning From c07235cee99d221a0e4f917bf8afafbe74b9d645 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 16 Mar 2025 12:49:14 +0200 Subject: [PATCH 151/191] update --- .../initiatives/rules/api/scribe-api-cve-product.md | 6 ++++++ docs/configuration/initiatives/rules/api/scribe-api-cve.md | 2 +- .../initiatives/rules/api/scribe-api-published.md | 2 +- docs/configuration/initiatives/rules/api/scribe-api.md | 6 ++++++ .../initiatives/rules/bitbucket/project/allow-admins.md | 6 ++++++ .../initiatives/rules/bitbucket/project/allow-users.md | 6 ++++++ .../rules/bitbucket/project/exposed-credentials.md | 6 ++++++ .../initiatives/rules/bitbucket/project/long-live-tokens.md | 6 ++++++ .../initiatives/rules/bitbucket/repository/allow-admins.md | 6 ++++++ .../initiatives/rules/bitbucket/repository/allow-users.md | 6 ++++++ .../rules/bitbucket/repository/branch-protection.md | 6 ++++++ .../initiatives/rules/bitbucket/workspace/allow-admins.md | 6 ++++++ .../initiatives/rules/bitbucket/workspace/allow-users.md | 6 ++++++ .../initiatives/rules/dockerhub/token-expiration.md | 6 ++++++ .../initiatives/rules/dockerhub/token-not-used.md | 6 ++++++ .../initiatives/rules/generic/artifact-signed.md | 6 ++++++ .../initiatives/rules/generic/evidence-exists.md | 6 ++++++ .../initiatives/rules/generic/k8s-jailbreak.md | 6 ++++++ .../configuration/initiatives/rules/generic/trivy-exists.md | 6 ++++++ docs/configuration/initiatives/rules/git/artifact-signed.md | 2 +- .../initiatives/rules/git/coding-permissions.md | 6 ++++++ docs/configuration/initiatives/rules/git/evidence-exists.md | 6 ++++++ .../initiatives/rules/git/no-commit-to-main.md | 6 ++++++ .../initiatives/rules/git/no-unsigned-commits.md | 6 ++++++ .../initiatives/rules/github/api/branch-protection.md | 6 ++++++ .../initiatives/rules/github/api/signed-commits-list.md | 6 ++++++ .../initiatives/rules/github/api/signed-commits-range.md | 6 ++++++ docs/configuration/initiatives/rules/github/org/2fa.md | 6 ++++++ .../initiatives/rules/github/org/advanced-security.md | 6 ++++++ .../initiatives/rules/github/org/allow-admins.md | 6 ++++++ .../initiatives/rules/github/org/allow-users.md | 6 ++++++ .../initiatives/rules/github/org/create-private-repos.md | 6 ++++++ .../initiatives/rules/github/org/create-repos.md | 6 ++++++ .../initiatives/rules/github/org/dependabot-alerts.md | 6 ++++++ .../rules/github/org/dependabot-security-updates-sa.md | 6 ++++++ .../rules/github/org/dependabot-security-updates.md | 6 ++++++ .../initiatives/rules/github/org/dependency-graph.md | 6 ++++++ .../initiatives/rules/github/org/max-admins.md | 6 ++++++ .../initiatives/rules/github/org/old-secrets.md | 6 ++++++ .../initiatives/rules/github/org/pp-custom-link.md | 6 ++++++ .../initiatives/rules/github/org/push-protection-sa.md | 6 ++++++ .../initiatives/rules/github/org/push-protection.md | 6 ++++++ .../initiatives/rules/github/org/repo-visibility.md | 6 ++++++ .../initiatives/rules/github/org/secret-scanning-sa.md | 6 ++++++ .../initiatives/rules/github/org/secret-scanning.md | 6 ++++++ .../initiatives/rules/github/org/validity-checks-sa.md | 6 ++++++ .../initiatives/rules/github/org/validity-checks.md | 6 ++++++ .../initiatives/rules/github/org/web-commit-signoff.md | 6 ++++++ .../rules/github/repository/branch-protection.md | 6 ++++++ .../rules/github/repository/branch-verification.md | 6 ++++++ .../rules/github/repository/check-signed-commits.md | 6 ++++++ .../rules/github/repository/default-branch-protection.md | 6 ++++++ .../initiatives/rules/github/repository/dependabot.md | 6 ++++++ .../rules/github/repository/ephemeral-runners-only.md | 6 ++++++ .../initiatives/rules/github/repository/no-cache-usage.md | 6 ++++++ .../initiatives/rules/github/repository/no-org-secrets.md | 6 ++++++ .../initiatives/rules/github/repository/old-secrets.md | 6 ++++++ .../initiatives/rules/github/repository/push-protection.md | 6 ++++++ .../initiatives/rules/github/repository/repo-private.md | 6 ++++++ .../initiatives/rules/github/repository/secret-scanning.md | 6 ++++++ .../initiatives/rules/github/repository/signed-commits.md | 6 ++++++ .../initiatives/rules/github/repository/validity-checks.md | 6 ++++++ .../initiatives/rules/github/repository/visibility.md | 6 ++++++ .../rules/github/repository/web-commit-signoff.md | 6 ++++++ .../initiatives/rules/gitlab/api/push-rules.md | 6 ++++++ .../initiatives/rules/gitlab/api/signed-commits-list.md | 6 ++++++ .../initiatives/rules/gitlab/api/signed-commits-range.md | 6 ++++++ .../initiatives/rules/gitlab/org/allow-admins.md | 6 ++++++ .../initiatives/rules/gitlab/org/allow-token-scopes.md | 6 ++++++ .../initiatives/rules/gitlab/org/allow-users.md | 6 ++++++ .../initiatives/rules/gitlab/org/blocked-users.md | 6 ++++++ .../initiatives/rules/gitlab/org/expiring-tokens.md | 6 ++++++ .../initiatives/rules/gitlab/org/forbid-token-scopes.md | 6 ++++++ .../initiatives/rules/gitlab/org/inactive-projects.md | 6 ++++++ .../initiatives/rules/gitlab/org/longlive-tokens.md | 6 ++++++ .../initiatives/rules/gitlab/org/max-admins.md | 6 ++++++ .../initiatives/rules/gitlab/org/projects-visibility.md | 6 ++++++ .../initiatives/rules/gitlab/org/unused-tokens.md | 6 ++++++ .../rules/gitlab/pipeline/verify-labels-exist.md | 6 ++++++ .../initiatives/rules/gitlab/pipeline/verify-labels.md | 6 ++++++ .../initiatives/rules/gitlab/project/abandoned-project.md | 6 ++++++ .../rules/gitlab/project/approvals-policy-check.md | 6 ++++++ .../rules/gitlab/project/approvers-per-merge-request.md | 6 ++++++ .../initiatives/rules/gitlab/project/author-email-regex.md | 6 ++++++ .../initiatives/rules/gitlab/project/check-cwe.md | 6 ++++++ .../rules/gitlab/project/check-signed-commits.md | 6 ++++++ .../rules/gitlab/project/co-approval-required.md | 6 ++++++ .../rules/gitlab/project/commit-author-email-check.md | 6 ++++++ .../rules/gitlab/project/commit-author-name-check.md | 6 ++++++ .../rules/gitlab/project/commit-committer-check.md | 6 ++++++ .../rules/gitlab/project/commit-message-check.md | 6 ++++++ .../initiatives/rules/gitlab/project/commits-validated.md | 6 ++++++ .../rules/gitlab/project/committer-email-check.md | 6 ++++++ .../rules/gitlab/project/committer-name-check.md | 6 ++++++ .../rules/gitlab/project/critical-severity-limit.md | 6 ++++++ .../rules/gitlab/project/description-substring-check.md | 6 ++++++ .../rules/gitlab/project/disallowed-banned-approvers.md | 6 ++++++ .../rules/gitlab/project/force-push-protection.md | 6 ++++++ .../rules/gitlab/project/medium-severity-limit.md | 6 ++++++ .../initiatives/rules/gitlab/project/member-check.md | 6 ++++++ .../initiatives/rules/gitlab/project/merge-access-level.md | 6 ++++++ .../rules/gitlab/project/merge-requests-author-approval.md | 6 ++++++ .../project/merge-requests-disable-committers-approval.md | 6 ++++++ .../rules/gitlab/project/message-substring-check.md | 6 ++++++ .../rules/gitlab/project/prevent-secrets-check.md | 6 ++++++ .../initiatives/rules/gitlab/project/protect-ci-secrets.md | 6 ++++++ .../initiatives/rules/gitlab/project/push-access-level.md | 6 ++++++ .../initiatives/rules/gitlab/project/push-rules-set.md | 6 ++++++ .../rules/gitlab/project/reject-unsigned-commits.md | 6 ++++++ .../rules/gitlab/project/require-password-to-approve.md | 6 ++++++ .../rules/gitlab/project/required-minimal-approvers.md | 6 ++++++ .../rules/gitlab/project/reset-pprovals-on-push.md | 6 ++++++ .../initiatives/rules/gitlab/project/sast-scan-pass.md | 6 ++++++ .../initiatives/rules/gitlab/project/sast-scanning.md | 6 ++++++ .../initiatives/rules/gitlab/project/secrets-scan-pass.md | 6 ++++++ .../initiatives/rules/gitlab/project/secrets-scanning.md | 6 ++++++ .../rules/gitlab/project/selective-code-owner-removals.md | 6 ++++++ .../initiatives/rules/gitlab/project/visibility-check.md | 6 ++++++ .../initiatives/rules/images/allowed-base-image.md | 2 +- .../initiatives/rules/images/allowed-image-source.md | 2 +- docs/configuration/initiatives/rules/images/banned-ports.md | 2 +- docs/configuration/initiatives/rules/images/banned-users.md | 2 +- .../initiatives/rules/images/blocklist-build-scripts.md | 2 +- .../initiatives/rules/images/enforce-https-registry.md | 6 ++++++ .../initiatives/rules/images/forbid-large-images.md | 2 +- .../initiatives/rules/images/fresh-base-image.md | 2 +- docs/configuration/initiatives/rules/images/fresh-image.md | 2 +- docs/configuration/initiatives/rules/images/image-signed.md | 2 +- .../initiatives/rules/images/require-healthcheck.md | 6 ++++++ .../initiatives/rules/images/restrict-shell-entrypoint.md | 6 ++++++ .../initiatives/rules/images/verify-labels-exist.md | 2 +- .../configuration/initiatives/rules/images/verify-labels.md | 2 +- .../initiatives/rules/jenkins/folder/exposed-credentials.md | 6 ++++++ .../initiatives/rules/jenkins/instance/inactive-users.md | 6 ++++++ .../initiatives/rules/jenkins/instance/unused-users.md | 6 ++++++ .../initiatives/rules/k8s/namespace/allowed-images.md | 2 +- .../initiatives/rules/k8s/namespace/allowed-registries.md | 2 +- .../rules/k8s/namespace/verify-namespace-duration.md | 2 +- .../rules/k8s/namespace/verify-namespace-termination.md | 2 +- .../rules/k8s/namespace/white-listed-namespaces.md | 6 ++++++ .../initiatives/rules/k8s/namespace/white-listed-pod.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-duration.md | 2 +- .../initiatives/rules/k8s/pods/verify-pod-termination.md | 6 ++++++ .../initiatives/rules/k8s/pods/white-listed-pod.md | 2 +- .../initiatives/rules/multievidence/files_integrity.md | 6 ++++++ .../initiatives/rules/sarif/artifact-signed.md | 6 ++++++ .../initiatives/rules/sarif/evidence-exists.md | 6 ++++++ .../initiatives/rules/sarif/patcheck/updates-needed.md | 6 ++++++ .../initiatives/rules/sarif/report-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/blocklist-cve.md | 6 ++++++ .../rules/sarif/trivy/report-trivy-iac-errors.md | 2 +- .../initiatives/rules/sarif/trivy/verify-cve-severity.md | 2 +- .../rules/sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../initiatives/rules/sarif/trivy/verify-trivy-report.md | 6 ++++++ .../initiatives/rules/sarif/verify-attack-vector.md | 2 +- docs/configuration/initiatives/rules/sarif/verify-sarif.md | 6 ++++++ .../initiatives/rules/sarif/verify-semgrep-report.md | 6 ++++++ .../initiatives/rules/sarif/verify-tool-evidence.md | 6 ++++++ .../configuration/initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../initiatives/rules/sbom/allowed-components.md | 2 +- .../configuration/initiatives/rules/sbom/artifact-signed.md | 6 ++++++ .../configuration/initiatives/rules/sbom/banned-licenses.md | 2 +- .../initiatives/rules/sbom/blocklist-packages.md | 6 ++++++ .../initiatives/rules/sbom/complete-licenses.md | 6 ++++++ docs/configuration/initiatives/rules/sbom/fresh-sbom.md | 2 +- docs/configuration/initiatives/rules/sbom/require-sbom.md | 6 ++++++ .../initiatives/rules/sbom/required-packages.md | 2 +- .../initiatives/rules/sbom/verify-huggingface-license.md | 2 +- .../initiatives/rules/slsa/banned-builder-deps.md | 6 ++++++ docs/configuration/initiatives/rules/slsa/build-time.md | 6 ++++++ docs/configuration/initiatives/rules/slsa/field-exists.md | 6 ++++++ .../initiatives/rules/slsa/l1-provenance-exists.md | 6 ++++++ .../initiatives/rules/slsa/l2-provenance-authenticated.md | 6 ++++++ docs/configuration/initiatives/rules/slsa/verify-builder.md | 6 ++++++ .../initiatives/rules/slsa/verify-byproducts.md | 6 ++++++ docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md | 6 ++++++ .../initiatives/rules/ssdf/ps-1-branch-protection.md | 6 ++++++ .../initiatives/rules/ssdf/ps-1-limit-admins.md | 6 ++++++ .../initiatives/rules/ssdf/ps-1-repo-private.md | 6 ++++++ .../initiatives/rules/ssdf/ps-1-web-commit-signoff.md | 6 ++++++ .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 6 ++++++ .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 6 ++++++ .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 6 ++++++ 183 files changed, 938 insertions(+), 32 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index bd5f975eb..ea097106e 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -21,6 +21,12 @@ Rule requires the Scribe API to be enabled. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: api/scribe-api-cve-product@v2 +``` + ## Mitigation Ensure that all critical or high severity vulnerabilities are addressed before delivering the product. diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 0d260a3f7..5eea032db 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -30,7 +30,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: api/scribe-api-cve@v2/rules +uses: api/scribe-api-cve@v2 with: superset: cve: diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index 5d7cbca04..cef94dc1b 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -27,7 +27,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: api/scribe-api-published@v2/rules +uses: api/scribe-api-published@v2 with: superset: published: true diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index b7f531c1d..caf804aeb 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: api/scribe-api@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 567876755..3df87c89b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/project/allow-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index f04cf6caa..77c237ddd 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/project/allow-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 6a30f3015..a6b5dcc7b 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/project/exposed-credentials@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index e2b078419..ae2aa2ea2 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/project/long-live-tokens@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index c30c716c9..03e5eab98 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/repository/allow-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index a24800589..e8efd9a1a 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/repository/allow-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index e27ea2268..562ade505 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/repository/branch-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index b5e2d1c7b..437a06062 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/workspace/allow-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index b3c5e4223..e6fb4ce41 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: bitbucket/workspace/allow-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 87ab4c5ea..b56b65203 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: dockerhub/token-expiration@v2 +``` + ## Mitigation Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index b5a101bb0..89483d5ef 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: dockerhub/token-not-used@v2 +``` + ## Description This rule verifies that there are no unused Dockerhub. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index d806ee6a5..5c5e18bff 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -24,6 +24,12 @@ Signed Evidence for this rule **IS** required by default. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: generic/artifact-signed@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index d0f288ebe..35e2b42d6 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -24,6 +24,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: generic/evidence-exists@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index e109441d6..61c4f1af0 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: generic/k8s-jailbreak@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 15dcc4d3c..1cfdda67b 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: generic/trivy-exists@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index a59cb928c..0f8571afb 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -30,7 +30,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: git/artifact-signed@v2/rules +uses: git/artifact-signed@v2 with: identity: emails: diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index b4c85592c..8044f0f80 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -24,6 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: git/coding-permissions@v2 +``` + ## Mitigation Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 511e004bb..cb74ee78a 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -27,6 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: git/evidence-exists@v2 +``` + ## Mitigation By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index db13bcef5..652cd0cfb 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -24,6 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: git/no-commit-to-main@v2 +``` + ## Mitigation Enforcing no commits to the main branch ensures that changes are made through pull requests, allowing for code review and approval before merging. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index d24a41b6a..c92cfa8bd 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -24,6 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: git/no-unsigned-commits@v2 +``` + ## Mitigation Enforcing signed commits ensures reduced risk of unauthorized changes to the repository. diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 69b6df675..fba798de4 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/api/branch-protection@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 1baaf80f2..6befd0e49 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/api/signed-commits-list@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index af3785ad1..d3e57b532 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/api/signed-commits-range@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index ae5da3a0a..cdab61dd3 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/2fa@v2 +``` + ## Mitigation Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 0f5cb8cc3..54f1b690b 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/advanced-security@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index afeb2b2ad..03ab497d3 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/allow-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index bac4a8911..820a103a2 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/allow-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index cfbee5cf9..b5348fd11 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/create-private-repos@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 72760c946..ff267a852 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/create-repos@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 8181b5b5f..939875284 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/dependabot-alerts@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 56cb07e39..40b8ab3ae 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/dependabot-security-updates-sa@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 59c3eca94..3785aa7da 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/dependabot-security-updates@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 1506245b8..bbbb0d6c8 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/dependency-graph@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 483f73dea..ec4464502 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/max-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index d1df76007..3169fa22b 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/old-secrets@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index cd1d1da56..7007a8219 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/pp-custom-link@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index c0d62d5c6..89e9125b1 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/push-protection-sa@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 1beace40b..720df224a 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -22,6 +22,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/push-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index f8bb1c2b7..ceb05ba03 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/repo-visibility@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 3cd023f4a..d225f738f 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/secret-scanning-sa@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index a13e8a48f..6092de767 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/secret-scanning@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 90d59da07..f801617a0 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/validity-checks-sa@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 827210cb7..54cce6642 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/validity-checks@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 5639ddfde..5da1116c1 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/org/web-commit-signoff@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 315c00f8c..3876724e6 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/branch-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 723bc3496..6d2fac34f 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/branch-verification@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 3d388f009..5496dbb8d 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/check-signed-commits@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 9b5e1e6e9..a4d53644c 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/default-branch-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index abbff1459..22d61c633 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/dependabot@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 572fbe2b8..7374b1519 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/ephemeral-runners-only@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 5562f259f..01e018824 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/no-cache-usage@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 912288d43..67bf1106a 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/no-org-secrets@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 52b136720..1cb1e191f 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/old-secrets@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index c8be2eccd..49eb63ddf 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/push-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 4f643335a..81f9f23af 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/repo-private@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 587ff9ae0..19d7ca296 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/secret-scanning@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index f6e2a27c4..7aa97a4c5 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/signed-commits@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 190a3af0d..b74bc7644 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/validity-checks@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 21aaada2a..5f9d685e5 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/visibility@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index e7d7fe222..1e4648a75 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: github/repository/web-commit-signoff@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 046bd9576..a135d348f 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/api/push-rules@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 92e04c992..b2704318b 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/api/signed-commits-list@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 4d8cb10e6..80e6cb2d5 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -18,6 +18,12 @@ Evidence **IS NOT** required for this rule. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/api/signed-commits-range@v2 +``` + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index a2f8911a4..b581f64c4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/allow-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 257f6ca94..32cb22c8f 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/allow-token-scopes@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 64bcb0745..1c0d18659 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/allow-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 614ca946d..5047069f6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/blocked-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index fbaa4782f..d33f2615e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/expiring-tokens@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index d194cd96e..870a599b4 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/forbid-token-scopes@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 295a1c1a6..a867b2505 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/inactive-projects@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 6303bf36f..04e334572 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/longlive-tokens@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 80360d979..d4f22160e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/max-admins@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 6f7bbbcdd..1253964f1 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/projects-visibility@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 8bf0c8cb6..723251b2e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/org/unused-tokens@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 91b4d96cb..0f49e0007 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/pipeline/verify-labels-exist@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index ddb89d453..1a4f2c69e 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/pipeline/verify-labels@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index d2c53cd07..51e8f4a73 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/abandoned-project@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 9485a24db..e7dfabb97 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/approvals-policy-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index d6491877b..4950d6c43 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/approvers-per-merge-request@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index f0bef95b6..e76b7529a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/author-email-regex@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 13a874c4f..b69783815 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/check-cwe@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 19358c074..a706a928d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/check-signed-commits@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 1bb6d0a2b..5d4e11218 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/co-approval-required@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 5f2002d5f..82fcd7c67 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/commit-author-email-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index c91db1fa0..1b34bcf66 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/commit-author-name-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index f6e91c841..7efcbf57f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/commit-committer-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 8497009be..2ff5032ee 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/commit-message-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 729edca82..e8eb0f6f7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/commits-validated@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 7a44c7317..72e935632 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/committer-email-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 0a6f037b6..427fa5e59 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/committer-name-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index dac1fb819..6fdfc2a39 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/critical-severity-limit@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index c513b4a0d..d19d13753 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/description-substring-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index d29c02ef5..05ab7a67c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/disallowed-banned-approvers@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 2cc0a3f81..e539e3569 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/force-push-protection@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index d657f8634..7d5039fd1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/medium-severity-limit@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 090bfe4c1..bae203db9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/member-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index ec045a9db..55621b099 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/merge-access-level@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 471d12ac7..68a2bf64c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/merge-requests-author-approval@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index f7d34cdd8..ec58106ad 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/merge-requests-disable-committers-approval@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 8c78c0e7c..dc45189a1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/message-substring-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index bc27834dd..13381e2d3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/prevent-secrets-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 5306a5b84..209a1ad6a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/protect-ci-secrets@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index e4b1195b7..8e1bbc20f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/push-access-level@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 990c718fa..1e0a48975 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/push-rules-set@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index f3d7ffa7f..d25407ae6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/reject-unsigned-commits@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 4b4e1b9e2..3012177a7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/require-password-to-approve@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 551fdfe42..1862664d5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/required-minimal-approvers@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index 070835191..a09543ee2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/reset-pprovals-on-push@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index d25cd30ae..9049680c1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/sast-scan-pass@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 1d17f8255..c9c1007f1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/sast-scanning@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 4b0f92e2f..908d6fe41 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/secrets-scan-pass@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 27f7be669..d59c7ae54 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/secrets-scanning@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 4947c4d7f..4e991f6ed 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/selective-code-owner-removals@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 93e8da37a..aac93c55d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: gitlab/project/visibility-check@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 6d634f65a..71741dbc3 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -31,7 +31,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/allowed-base-image@v2/rules +uses: images/allowed-base-image@v2 with: approved_sources: - "docker.io/library/*" diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index db698f395..beeb2e1ac 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -28,7 +28,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/allowed-image-source@v2/rules +uses: images/allowed-image-source@v2 with: approved_sources: - "docker.io/library/*" diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 75931681b..c99e8555a 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -30,7 +30,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/banned-ports@v2/rules +uses: images/banned-ports@v2 with: banned_ports: - port: "3000" diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 44c954d67..19c310453 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -27,7 +27,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/banned-users@v2/rules +uses: images/banned-users@v2 with: users: - root diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 46a08b9e4..cd12e35cd 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: images/blocklist-build-scripts@v2/rules +uses: images/blocklist-build-scripts@v2 with: blocklist: - "wget" diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index ec4a36a37..f2ca44eb0 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -25,6 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: images/enforce-https-registry@v2 +``` + ## Description This rule examines the CycloneDX SBOM evidence for a container image to verify that the registry connection is secure. It does so by scanning the `metadata.component.properties` array for a property named diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 594222fd6..bf3a13c5f 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: images/forbid-large-images@v2/rules +uses: images/forbid-large-images@v2 with: max_size: 77819980 ``` diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 064ced39d..c084f3acb 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -28,7 +28,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/fresh-base-image@v2/rules +uses: images/fresh-base-image@v2 with: max_days: 183 ``` diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 1db34faec..4b7197c7a 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -27,7 +27,7 @@ Rule is scoped by target and product. ## Usage example ```yaml -uses: images/fresh-image@v2/rules +uses: images/fresh-image@v2 with: max_days: 183 ``` diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index e4aa92051..221fb3685 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -28,7 +28,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: images/image-signed@v2/rules +uses: images/image-signed@v2 with: identity: emails: diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 65a5a3e73..2af193c6a 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -25,6 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by target and product. ::: +## Usage example + +```yaml +uses: images/require-healthcheck@v2 +``` + ## Mitigation Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 04b60aa2a..e9035680f 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: images/restrict-shell-entrypoint@v2 +``` + ## Mitigation Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 04ce31753..90b137f8d 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: images/verify-labels-exist@v2/rules +uses: images/verify-labels-exist@v2 with: labels: - "org.opencontainers.image.created" diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 727fe0a99..86b05d88e 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: images/verify-labels@v2/rules +uses: images/verify-labels@v2 with: labels: - "org.opencontainers.image.vendor=my_vendor" diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index b0fa24114..879c4ecd1 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: jenkins/folder/exposed-credentials@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 9c20b26d6..0cdab37a7 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: jenkins/instance/inactive-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 64d220a56..ac0c8ad67 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: jenkins/instance/unused-users@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index d093613e4..c5bc05ee6 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/namespace/allowed-images@v2/rules +uses: k8s/namespace/allowed-images@v2 with: images_to_include: - docker.io/my_org/my_image1 diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 89675409e..947b57cf2 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/namespace/allowed-registries@v2/rules +uses: k8s/namespace/allowed-registries@v2 with: allowed_registries: - docker.io/* diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 26d7b3f21..d5a4b0d18 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/namespace/verify-namespace-duration@v2/rules +uses: k8s/namespace/verify-namespace-duration@v2 with: threshold_date: "1970-01-01T00:00:00Z" ``` diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index a17d75823..e6eb871a6 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/namespace/verify-namespace-termination@v2/rules +uses: k8s/namespace/verify-namespace-termination@v2 with: namespaces: - ".*" diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 7e41bc992..7ee836995 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/namespace/white-listed-namespaces@v2 +``` + ## Mitigation Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 2d55d651a..978e32cd0 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/namespace/white-listed-pod@v2/rules +uses: k8s/namespace/white-listed-pod@v2 with: white_listed_pod: - my-pod-1.* diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 0a0db38ee..ad1346c10 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/pods/verify-pod-duration@v2/rules +uses: k8s/pods/verify-pod-duration@v2 with: max_days: 30 ``` diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 48ae71a0c..41657c526 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: k8s/pods/verify-pod-termination@v2 +``` + ## Mitigation Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index 17e7462e8..e09ba4ced 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: k8s/pods/white-listed-pod@v2/rules +uses: k8s/pods/white-listed-pod@v2 with: white_listed_pod: - my-pod-1.* diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index fa6c0b2bd..d059f7018 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS** required by default. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: multievidence/files_integrity@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 5d20c12a5..9c8f700c6 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -24,6 +24,12 @@ Signed Evidence for this rule **IS** required by default. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/artifact-signed@v2 +``` + ## Mitigation Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 4c8261a27..27a4ad030 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -24,6 +24,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/evidence-exists@v2 +``` + ## Mitigation By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index abb7b62cd..33cf6453f 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/patcheck/updates-needed@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index b5c0cb8cd..e68b486af 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: sarif/report-iac-errors@v2/rules +uses: sarif/report-iac-errors@v2 with: violations_threshold: 2 ``` diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 01dc70227..1dd3db09e 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -22,6 +22,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Usage example + +```yaml +uses: sarif/trivy/blocklist-cve@v2 +``` + ## Mitigation Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index fc97b9858..b7cd99590 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -25,7 +25,7 @@ Rule is scoped by product. ## Usage example ```yaml -uses: sarif/trivy/report-trivy-iac-errors@v2/rules +uses: sarif/trivy/report-trivy-iac-errors@v2 with: violations_threshold: 2 ``` diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index c6d2c8656..23582aea0 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -30,7 +30,7 @@ Rule is scoped by product. ## Usage example ```yaml -uses: sarif/trivy/verify-cve-severity@v2/rules +uses: sarif/trivy/verify-cve-severity@v2 with: severity_threshold: 2 ``` diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 54d336702..984dabaa1 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -24,7 +24,7 @@ Rule is scoped by product. ## Usage example ```yaml -uses: sarif/trivy/verify-trivy-attack-vector@v2/rules +uses: sarif/trivy/verify-trivy-attack-vector@v2 with: attack_vectors: - "stack buffer overflow" diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index f1c198303..8d4a0d2b7 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -22,6 +22,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by product. ::: +## Usage example + +```yaml +uses: sarif/trivy/verify-trivy-report@v2 +``` + ## Mitigation Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index ec085bbf8..7bd67fa2a 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -24,7 +24,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ## Usage example ```yaml -uses: sarif/verify-attack-vector@v2/rules +uses: sarif/verify-attack-vector@v2 with: attack_vectors: - "stack buffer overflow" diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index b9d1677ad..4394f7e1c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/verify-sarif@v2 +``` + ## Mitigation Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 98994825d..fb4224f2c 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/verify-semgrep-report@v2 +``` + ## Mitigation Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index b7c87eb91..2a784084a 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -24,6 +24,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: sarif/verify-tool-evidence@v2 +``` + ## Mitigation Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 848936c2c..57e2b37c5 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -44,7 +44,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/NTIA-compliance@v2/rules +uses: sbom/NTIA-compliance@v2 with: required_author: name: "bom" diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index 3911c25d6..bff895f14 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -30,7 +30,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/allowed-components@v2/rules +uses: sbom/allowed-components@v2 with: types: - library diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 4c8b9c04f..ffe4b291e 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -27,6 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/artifact-signed@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 4dc58a690..142aed6d5 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -27,7 +27,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/banned-licenses@v2/rules +uses: sbom/banned-licenses@v2 with: blocklist: - "GPL-2.0" diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 1c619722a..c41f19802 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -24,6 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/blocklist-packages@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 0dd812234..91ef861f7 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -24,6 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/complete-licenses@v2 +``` + ## Mitigation Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index a6c8a78fe..d6c4b814e 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -27,7 +27,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/fresh-sbom@v2/rules +uses: sbom/fresh-sbom@v2 with: max_days: 30 ``` diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 5a7bcdcf2..96e7ed6f8 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -27,6 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: sbom/require-sbom@v2 +``` + ## Mitigation Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 8048b8332..479309778 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -27,7 +27,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/required-packages@v2/rules +uses: sbom/required-packages@v2 with: required_pkgs: - "pkg:maven/org.apache.commons/commons-lang3@3.9" diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index ea5b11952..c86ec14e9 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -30,7 +30,7 @@ Rule is scoped by product and target. ## Usage example ```yaml -uses: sbom/verify-huggingface-license@v2/rules +uses: sbom/verify-huggingface-license@v2 with: licenses: - "MIT" diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 1c1d44f4f..5a1ce8f08 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: slsa/banned-builder-deps@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 84443b498..3544a7642 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: slsa/build-time@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index e0bfea3b8..0895f0509 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: slsa/field-exists@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 89d8b1649..74d5688c9 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -28,6 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: slsa/l1-provenance-exists@v2 +``` + ## Mitigation Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index ac7ed54ea..cc8de239c 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -28,6 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl Rule is scoped by product and target. ::: +## Usage example + +```yaml +uses: slsa/l2-provenance-authenticated@v2 +``` + ## Mitigation Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 55ecede25..2bc163454 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule is scoped by pipeline and product. ::: +## Usage example + +```yaml +uses: slsa/verify-builder@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index c5ed5e430..7477a84e8 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -21,6 +21,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: slsa/verify-byproducts@v2 +``` + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index 53f8731f8..a7917520e 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-1-2fa@v2 +``` + ## Mitigation Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index 9f23a8ac5..a433e3f07 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-1-branch-protection@v2 +``` + ## Mitigation Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index dfac15c63..6ff8bbad6 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-1-limit-admins@v2 +``` + ## Mitigation Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index b2e8d4604..d3918b290 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-1-repo-private@v2 +``` + ## Mitigation Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index c238474c6..03cc59dde 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-1-web-commit-signoff@v2 +``` + ## Mitigation Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 33875b4f5..78476e0cd 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-2-image-verifiable@v2 +``` + ## Mitigation Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 55949571f..27e096510 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -22,6 +22,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-3.1-code-archived@v2 +``` + ## Mitigation Archives code changes to maintain a secure, immutable history for auditing and traceability. diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 9ec173cac..547e73da4 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -20,6 +20,12 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +## Usage example + +```yaml +uses: ssdf/ps-3.2-archived-sbom@v2 +``` + ## Mitigation Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. From 440199d6a5936ff1d6bda4df37dc37b522436997 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 12:56:59 +0200 Subject: [PATCH 152/191] update --- .../rules/bitbucket/project/exposed-credentials.md | 5 +++++ .../initiatives/rules/dockerhub/token-expiration.md | 5 +++++ .../initiatives/rules/dockerhub/token-not-used.md | 5 +++++ .../initiatives/rules/generic/artifact-signed.md | 5 +++++ .../initiatives/rules/generic/evidence-exists.md | 5 +++++ .../configuration/initiatives/rules/generic/k8s-jailbreak.md | 5 +++++ docs/configuration/initiatives/rules/generic/trivy-exists.md | 5 +++++ docs/configuration/initiatives/rules/git/evidence-exists.md | 5 +++++ .../configuration/initiatives/rules/git/no-commit-to-main.md | 5 +++++ .../initiatives/rules/git/no-unsigned-commits.md | 5 +++++ .../rules/github/org/dependabot-security-updates-sa.md | 5 +++++ .../initiatives/rules/github/org/push-protection-sa.md | 5 +++++ .../initiatives/rules/github/org/secret-scanning-sa.md | 5 +++++ .../initiatives/rules/github/org/validity-checks-sa.md | 5 +++++ .../rules/github/repository/check-signed-commits.md | 5 +++++ .../rules/github/repository/default-branch-protection.md | 5 +++++ .../initiatives/rules/github/repository/dependabot.md | 5 +++++ .../rules/github/repository/ephemeral-runners-only.md | 5 +++++ .../initiatives/rules/github/repository/no-cache-usage.md | 5 +++++ .../initiatives/rules/github/repository/no-org-secrets.md | 5 +++++ .../initiatives/rules/github/repository/push-protection.md | 5 +++++ .../initiatives/rules/github/repository/secret-scanning.md | 5 +++++ .../initiatives/rules/github/repository/signed-commits.md | 5 +++++ .../initiatives/rules/github/repository/validity-checks.md | 5 +++++ .../initiatives/rules/gitlab/project/check-signed-commits.md | 5 +++++ .../rules/gitlab/project/commit-committer-check.md | 5 +++++ .../initiatives/rules/gitlab/project/commits-validated.md | 5 +++++ .../initiatives/rules/gitlab/project/member-check.md | 5 +++++ .../rules/gitlab/project/prevent-secrets-check.md | 5 +++++ .../initiatives/rules/gitlab/project/push-rules-set.md | 5 +++++ .../rules/gitlab/project/reject-unsigned-commits.md | 5 +++++ .../rules/gitlab/project/required-minimal-approvers.md | 5 +++++ .../initiatives/rules/gitlab/project/sast-scan-pass.md | 5 +++++ .../initiatives/rules/gitlab/project/sast-scanning.md | 5 +++++ .../initiatives/rules/gitlab/project/secrets-scan-pass.md | 5 +++++ .../initiatives/rules/gitlab/project/secrets-scanning.md | 5 +++++ .../initiatives/rules/images/restrict-shell-entrypoint.md | 5 +++++ .../initiatives/rules/jenkins/folder/exposed-credentials.md | 5 +++++ .../initiatives/rules/jenkins/instance/unused-users.md | 5 +++++ .../initiatives/rules/k8s/pods/verify-pod-termination.md | 5 +++++ .../configuration/initiatives/rules/sarif/artifact-signed.md | 5 +++++ .../configuration/initiatives/rules/sarif/evidence-exists.md | 5 +++++ .../initiatives/rules/sarif/patcheck/updates-needed.md | 5 +++++ .../initiatives/rules/sarif/verify-tool-evidence.md | 5 +++++ .../initiatives/rules/sbom/complete-licenses.md | 5 +++++ docs/configuration/initiatives/rules/sbom/require-sbom.md | 5 +++++ .../initiatives/rules/slsa/l1-provenance-exists.md | 5 +++++ .../initiatives/rules/ssdf/ps-2-image-verifiable.md | 5 +++++ .../initiatives/rules/ssdf/ps-3.2-archived-sbom.md | 5 +++++ 49 files changed, 245 insertions(+) diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index a6b5dcc7b..3399698c3 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/project/exposed-credentials@v2 + +## Usage example + +```yaml +with: bitbucket/project/exposed-credentials@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index b56b65203..28c47637d 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: dockerhub/token-expiration@v2 + +## Usage example + +```yaml +with: dockerhub/token-expiration@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 89483d5ef..88c81fe10 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: dockerhub/token-not-used@v2 + +## Usage example + +```yaml +with: dockerhub/token-not-used@v2 ``` ## Description diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 5c5e18bff..9a20985c9 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -28,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/artifact-signed@v2 + +## Usage example + +```yaml +with: generic/artifact-signed@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 35e2b42d6..6f20f76be 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -28,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/evidence-exists@v2 + +## Usage example + +```yaml +with: generic/evidence-exists@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 61c4f1af0..528e787b1 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/k8s-jailbreak@v2 + +## Usage example + +```yaml +with: generic/k8s-jailbreak@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 1cfdda67b..5dd7b8eb2 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -24,6 +24,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/trivy-exists@v2 + +## Usage example + +```yaml +with: generic/trivy-exists@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index cb74ee78a..cbef8c0bd 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -31,6 +31,11 @@ Rule is scoped by product and target. ```yaml uses: git/evidence-exists@v2 + +## Usage example + +```yaml +with: git/evidence-exists@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 652cd0cfb..433f0f81c 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -28,6 +28,11 @@ Rule is scoped by product and target. ```yaml uses: git/no-commit-to-main@v2 + +## Usage example + +```yaml +with: git/no-commit-to-main@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index c92cfa8bd..ac1fe583c 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -28,6 +28,11 @@ Rule is scoped by product and target. ```yaml uses: git/no-unsigned-commits@v2 + +## Usage example + +```yaml +with: git/no-unsigned-commits@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 40b8ab3ae..15009ce11 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependabot-security-updates-sa@v2 + +## Usage example + +```yaml +with: github/org/dependabot-security-updates-sa@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 89e9125b1..b2a661f61 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/push-protection-sa@v2 + +## Usage example + +```yaml +with: github/org/push-protection-sa@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index d225f738f..bb458be44 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/secret-scanning-sa@v2 + +## Usage example + +```yaml +with: github/org/secret-scanning-sa@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index f801617a0..903d61c1e 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/validity-checks-sa@v2 + +## Usage example + +```yaml +with: github/org/validity-checks-sa@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 5496dbb8d..1187a9950 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/check-signed-commits@v2 + +## Usage example + +```yaml +with: github/repository/check-signed-commits@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index a4d53644c..12ae2eec9 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/default-branch-protection@v2 + +## Usage example + +```yaml +with: github/repository/default-branch-protection@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 22d61c633..8cda18e42 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/dependabot@v2 + +## Usage example + +```yaml +with: github/repository/dependabot@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 7374b1519..71067461c 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/ephemeral-runners-only@v2 + +## Usage example + +```yaml +with: github/repository/ephemeral-runners-only@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 01e018824..45a28df7d 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/no-cache-usage@v2 + +## Usage example + +```yaml +with: github/repository/no-cache-usage@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 67bf1106a..90aead5bf 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/no-org-secrets@v2 + +## Usage example + +```yaml +with: github/repository/no-org-secrets@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 49eb63ddf..fb25bdf45 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/push-protection@v2 + +## Usage example + +```yaml +with: github/repository/push-protection@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 19d7ca296..d491461a1 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/secret-scanning@v2 + +## Usage example + +```yaml +with: github/repository/secret-scanning@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 7aa97a4c5..767e03735 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/signed-commits@v2 + +## Usage example + +```yaml +with: github/repository/signed-commits@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index b74bc7644..2c406df16 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/validity-checks@v2 + +## Usage example + +```yaml +with: github/repository/validity-checks@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index a706a928d..b9b5e6a5b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/check-signed-commits@v2 + +## Usage example + +```yaml +with: gitlab/project/check-signed-commits@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 7efcbf57f..1f7c31a34 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commit-committer-check@v2 + +## Usage example + +```yaml +with: gitlab/project/commit-committer-check@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index e8eb0f6f7..900bfee6f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commits-validated@v2 + +## Usage example + +```yaml +with: gitlab/project/commits-validated@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index bae203db9..18690dc68 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/member-check@v2 + +## Usage example + +```yaml +with: gitlab/project/member-check@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 13381e2d3..908ecae81 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/prevent-secrets-check@v2 + +## Usage example + +```yaml +with: gitlab/project/prevent-secrets-check@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 1e0a48975..79d93961b 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/push-rules-set@v2 + +## Usage example + +```yaml +with: gitlab/project/push-rules-set@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index d25407ae6..ea3280cfd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/reject-unsigned-commits@v2 + +## Usage example + +```yaml +with: gitlab/project/reject-unsigned-commits@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 1862664d5..ad9761fb9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/required-minimal-approvers@v2 + +## Usage example + +```yaml +with: gitlab/project/required-minimal-approvers@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 9049680c1..6d743081a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/sast-scan-pass@v2 + +## Usage example + +```yaml +with: gitlab/project/sast-scan-pass@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index c9c1007f1..0e0ac5269 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/sast-scanning@v2 + +## Usage example + +```yaml +with: gitlab/project/sast-scanning@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 908d6fe41..a011cd292 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/secrets-scan-pass@v2 + +## Usage example + +```yaml +with: gitlab/project/secrets-scan-pass@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index d59c7ae54..ba35c6d90 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/secrets-scanning@v2 + +## Usage example + +```yaml +with: gitlab/project/secrets-scanning@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index e9035680f..14c8dc493 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: images/restrict-shell-entrypoint@v2 + +## Usage example + +```yaml +with: images/restrict-shell-entrypoint@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 879c4ecd1..4684fcbcc 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: jenkins/folder/exposed-credentials@v2 + +## Usage example + +```yaml +with: jenkins/folder/exposed-credentials@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index ac0c8ad67..0b736c042 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: jenkins/instance/unused-users@v2 + +## Usage example + +```yaml +with: jenkins/instance/unused-users@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 41657c526..921bda88e 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: k8s/pods/verify-pod-termination@v2 + +## Usage example + +```yaml +with: k8s/pods/verify-pod-termination@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 9c8f700c6..1559c8730 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -28,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/artifact-signed@v2 + +## Usage example + +```yaml +with: sarif/artifact-signed@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 27a4ad030..26d124d4c 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -28,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/evidence-exists@v2 + +## Usage example + +```yaml +with: sarif/evidence-exists@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 33cf6453f..6bb403a1e 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -25,6 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/patcheck/updates-needed@v2 + +## Usage example + +```yaml +with: sarif/patcheck/updates-needed@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 2a784084a..bfdb0bae8 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -28,6 +28,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/verify-tool-evidence@v2 + +## Usage example + +```yaml +with: sarif/verify-tool-evidence@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 91ef861f7..6600101aa 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -28,6 +28,11 @@ Rule is scoped by product and target. ```yaml uses: sbom/complete-licenses@v2 + +## Usage example + +```yaml +with: sbom/complete-licenses@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 96e7ed6f8..ff3aa0338 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -31,6 +31,11 @@ Rule is scoped by product and target. ```yaml uses: sbom/require-sbom@v2 + +## Usage example + +```yaml +with: sbom/require-sbom@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 74d5688c9..5f2c9b6d3 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -32,6 +32,11 @@ Rule is scoped by product and target. ```yaml uses: slsa/l1-provenance-exists@v2 + +## Usage example + +```yaml +with: slsa/l1-provenance-exists@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 78476e0cd..652f24081 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -24,6 +24,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: ssdf/ps-2-image-verifiable@v2 + +## Usage example + +```yaml +with: ssdf/ps-2-image-verifiable@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index 547e73da4..e656e8fd1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -24,6 +24,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: ssdf/ps-3.2-archived-sbom@v2 + +## Usage example + +```yaml +with: ssdf/ps-3.2-archived-sbom@v2 ``` ## Mitigation From 699113b78a62457fe503b8dcbaa6d3ef386972a3 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 13:58:58 +0200 Subject: [PATCH 153/191] update --- docs/configuration/initiatives/index.md | 38 ++++++------- .../rules/github/api/branch-protection.md | 55 +++++++++++++++++++ .../rules/github/api/signed-commits-list.md | 33 ++++++++--- .../rules/github/api/signed-commits-range.md | 40 +++++++++++--- .../rules/github/org/advanced-security.md | 28 ++++++++-- .../rules/github/org/allow-admins.md | 30 ++++++++-- .../rules/github/org/allow-users.md | 30 ++++++++-- .../rules/github/org/create-private-repos.md | 38 ++++++++++--- .../rules/github/org/create-repos.md | 38 ++++++++++--- .../rules/github/org/dependabot-alerts.md | 28 ++++++++-- .../org/dependabot-security-updates-sa.md | 33 ++++++++--- .../github/org/dependabot-security-updates.md | 33 ++++++++--- .../rules/github/org/dependency-graph.md | 35 +++++++++--- .../rules/github/org/max-admins.md | 37 ++++++++++--- .../rules/github/org/old-secrets.md | 27 +++++++-- .../rules/github/org/pp-custom-link.md | 33 ++++++++--- .../rules/github/org/push-protection-sa.md | 24 ++++++-- .../rules/github/org/push-protection.md | 33 ++++++++--- .../rules/github/org/repo-visibility.md | 36 +++++++++--- .../rules/github/org/secret-scanning-sa.md | 18 +++++- .../rules/github/org/secret-scanning.md | 18 +++++- .../rules/github/org/validity-checks-sa.md | 24 ++++++-- .../rules/github/org/validity-checks.md | 18 +++++- .../rules/github/org/web-commit-signoff.md | 22 +++++++- .../github/repository/branch-protection.md | 32 +++++++++-- .../github/repository/branch-verification.md | 16 ++++++ .../github/repository/check-signed-commits.md | 16 ++++++ .../repository/default-branch-protection.md | 16 ++++++ .../rules/github/repository/dependabot.md | 22 +++++++- .../repository/ephemeral-runners-only.md | 16 ++++++ .../rules/github/repository/no-cache-usage.md | 16 ++++++ .../rules/github/repository/no-org-secrets.md | 16 ++++++ .../rules/github/repository/old-secrets.md | 15 +++++ .../github/repository/push-protection.md | 17 +++++- .../rules/github/repository/repo-private.md | 21 +++++++ .../github/repository/secret-scanning.md | 17 +++++- .../rules/github/repository/signed-commits.md | 15 +++++ .../github/repository/validity-checks.md | 17 +++++- .../rules/github/repository/visibility.md | 28 ++++++++-- .../github/repository/web-commit-signoff.md | 20 +++++++ 40 files changed, 898 insertions(+), 151 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 1109250b0..caafdf830 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -99,27 +99,27 @@ | Rule Name | Description | |-----------|-------------| -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Verify Validity checks are configured and enabled in the GitHub organization.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify Validity checks are configured and enabled in the GitHub organization. | | [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | -| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify Secret Scanning Push Protection Custom Link Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify Secret Scanning Push Protection Enabled in Security and Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is enabled in the security and analysis settings of the GitHub organization. | +| [Create Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify that only allowed users can create repositories in the GitHub organization. | +| [Verify Maximum Number of Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify that the number of admins in the GitHub organization does not exceed the specified maximum. | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify Web Commit Signoff is configured and enabled in the GitHub organization. | +| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured and enabled in the GitHub organization. | +| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Ensure Validity Checks are configured and enabled in the GitHub repository. | | [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify Repository Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify that the repository visibility setting is configured correctly in the GitHub organization. | | [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify Dependabot Security Updates Enabled for New Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | | [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify Dependency Graph Enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify that the dependency graph is enabled in the GitHub organization. | +| [Verify Secret Scanning Push Protection Enabled for New Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | | [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Create Private Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify that only allowed users can create private repositories in the GitHub organization. | | [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | +| [Verify Dependabot Security Updates Setting in Security and Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Ensure `secret_scanning` is configured and enabled in the GitHub repository. | ### Github Repository Discovery Evidence **Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) @@ -129,19 +129,19 @@ | [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | | [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | | [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | -| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Dependabot Security Updates Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | | [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | | [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | | [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both Secret Scanning Validity Checks and Security and Analysis Setting are configured in the GitHub organization and all the repositories. | | [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | | [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | | [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify Secret Scanning Push Protection Setting is configured in the GitHub repository. | | [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | | [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | | [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify Secret Scanning Setting is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence **Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index fba798de4..92ae26bf1 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -22,8 +22,63 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/api/branch-protection@v2 +with: + owner: "my-org" + repo: "my-repo" + branch: "main" + branch_protection_rules: + required_pull_request_reviews.dismiss_stale_reviews: true + required_pull_request_reviews.require_code_owner_reviews: true + required_pull_request_reviews.require_last_push_approval: true + required_pull_request_reviews.required_approving_review_count: 2 + required_pull_request_reviews.bypass_pull_request_allowances.users: ["user1", "user2"] + required_pull_request_reviews.bypass_pull_request_allowances.teams: ["team1"] + required_pull_request_reviews.bypass_pull_request_allowances.apps: ["app1"] + required_pull_request_reviews.dismissal_restrictions.users: ["user3"] + required_pull_request_reviews.dismissal_restrictions.teams: ["team2"] + required_pull_request_reviews.dismissal_restrictions.apps: ["app2"] + required_status_checks.checks: ["check1", "check2"] + required_status_checks.strict: true + required_status_checks.contexts: ["context1", "context2"] + restrictions.users: ["user4"] + restrictions.teams: ["team3"] + restrictions.apps: ["app3"] + required_signatures: true + enforce_admins: true + required_linear_history: true + allow_force_pushes: false + allow_deletions: false + block_creations: true + required_conversation_resolution: true + lock_branch: true + allow_fork_syncing: true ``` +## Description +# This ones needs a large details +This rule ensures that the branch protection rules are configured in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for branch protection configuration. +2. Verifies that the configuration matches the expected settings. +2.1. Verifies that the required pull request reviews are configured. +2.2. Verifies that the required status checks are configured. +2.3. Verifies that the restrictions are configured. +2.4. Verifies that the required signatures are configured. +2.5. Verifies that the enforcement of admins is configured. +2.6. Verifies that the required linear history is configured. +2.7. Verifies that the allow force pushes is configured. +2.8. Verifies that the allow deletions is configured. +2.9. Verifies that the block creations is configured. +2.10. Verifies that the required conversation resolution is configured. +2.11. Verifies that the lock branch is configured. +2.12. Verifies that the allow fork syncing is configured. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. +- Github API token must be provided to access the GitHub API. + + ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 6befd0e49..570667037 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -22,13 +22,32 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/api/signed-commits-list@v2 +with: + commit_id_list: + - "11111115644ea629569e6a3c98c8375111111" + - "22222225644ea629569e6a3c98c8375222222" + access_token: '{{ .Args.Token }}' + owner: my_owner + ``` -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| commit_id_list | [] | -| access_token | | -| owner | | -| repo | | +## Description +This rule ensures that the selected commits are signed in the GitHub organization. +It performs the following steps: + +1. Checks the selected commits in the Selected GitHub repository. +2. Verifies that the selected commits are signed. +2.1 Verifies that the selected commits are signed by the proper owner. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources. +- Github API token must be provided to access the GitHub API. + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| commit_id_list | array | True | List of commit IDs to verify if they are signed. | +| access_token | string | True | GitHub API access token. | +| owner | string | True | GitHub repository owner. | +| repo | string | True | GitHub repository name. | diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index d3e57b532..11fb457f4 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -22,15 +22,37 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/api/signed-commits-range@v2 +with: + access_token: '{{ + .Args.Token + }}' + owner: my_owner + repo: my_repo + since: "2021-01-01T00:00:00Z" + until: "2021-01-31T23:59:59Z" + sha: "11111115644ea629569e6a3c98c8375111111" + ``` -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| access_token | | -| owner | | -| repo | | -| since | None | -| until | None | -| sha | None | +## Description +This rule ensures that the commits in the specified time range are signed in the GitHub repository. +It performs the following steps: + +1. Checks the commits in the specified time range in the GitHub repository. +2. Verifies that the commits in the specified time range are signed. +2.1 Verifies that the commits in the specified time range are signed by the proper owner. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources. +- Github API token must be provided to access the GitHub API. + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| access_token | string | True | GitHub API access token. | +| owner | string | True | GitHub repository owner. | +| repo | string | True | GitHub repository name. | +| since | string | False | ISO 8601 date-time string. The beginning of the time range. | +| until | string | False | ISO 8601 date-time string. The end of the time range. | +| sha | string | False | The SHA of the commit to verify. | diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 54f1b690b..81286805f 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/advanced-security@v2 +with: + desired_value: true ``` +## Mitigation +Enforces advanced security for new repositories in the organization, significantly reducing the risk of introducing vulnerabilities or unapproved software. + + + +## Description +This rule verifies that advanced security is enabled for new repositories in the GitHub organization by examining the provided Discovery evidence. +It checks the organization's details and compares the value of the +`organization_details.advanced_security_enabled_for_new_repositories` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `advanced_security_enabled_for_new_repositories` field does not match +the desired value, a violation is recorded. This ensures that all new repositories enforce advanced security, significantly reducing the risk of +introducing vulnerabilities or unapproved software. + +### **Evidence Requirements** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: github/org/advanced-security@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Desired value for the advanced_security_enabled_for_new_repositories setting. | diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 03ab497d3..c5b1eba93 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/allow-admins@v2 +with: + allowed_admins: + - user1 + - user2 + - user3 ``` +## Mitigation +Ensures that only approved users have admin privileges in the GitHub organization, reducing the risk of unauthorized access through compromised credentials. + + + +## Description +This rule verifies that only users in the Allowed List have admin privileges in the GitHub organization. +It checks the organization's details and compares the value of the +`organization_details.admins` field against the expected value. + +The rule iterates over the organization data in the evidence, and if the `admins` field does not match +the desired value, a violation is recorded. This ensures that only users in the Allowed List have admin privileges in the GitHub organization. + +### **Evidence Requirements** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: github/org/allow-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_admins | array | False | List of allowed GitHub organization admins. | diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 820a103a2..63a735ff1 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/allow-users@v2 +with: + allowed_users: + - "user1" + - "user2" + ``` +## Mitigation +Ensures that only approved users have access to the GitHub organization, reducing the risk of unauthorized access. + + + +## Description +This rule ensures that only users specified in the allowed list have access to the GitHub organization. +It performs the following steps: + +1. Iterates over the users in the GitHub organization. +2. Checks each user against the allowed list specified in the `with.allowed_users` configuration. + - If a user is not in the allowed list, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: github/org/allow-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of allowed users. | diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index b5348fd11..7ec3c64b1 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify members_can_create_private_repositories setting -title: Verify members_can_create_private_repositories setting +sidebar_label: Create Private Repositories +title: Create Private Repositories --- -# Verify members_can_create_private_repositories setting +# Create Private Repositories **Type:** Rule **ID:** `github-org-create-private-repos` **Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) **Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization -Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). +Verify that only allowed users can create private repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/create-private-repos@v2 +with: + allowed_users: + - "user1" + - "user2" + ``` +## Mitigation +Ensures that only approved users can create private repositories in the GitHub organization, reducing the risk of unauthorized repository creation. + + + +## Description +This rule ensures that only users specified in the allowed list can create private repositories in the GitHub organization. +It performs the following steps: + +1. Iterates over the users in the GitHub organization. +2. Checks each user's permissions to create private repositories against the allowed list specified in the `with.allowed_users` configuration. + - If a user not in the allowed list has permissions to create private repositories, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: github/org/create-private-repos@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of allowed users. | diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index ff267a852..c77c26e42 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify members_can_create_repositories setting -title: Verify members_can_create_repositories setting +sidebar_label: Create Repositories +title: Create Repositories --- -# Verify members_can_create_repositories setting +# Create Repositories **Type:** Rule **ID:** `github-org-create-repos` **Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) **Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization -Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. +Verify that only allowed users can create repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/create-repos@v2 +with: + allowed_users: + - "user1" + - "user2" + ``` +## Mitigation +Ensures that only approved users can create repositories in the GitHub organization, reducing the risk of unauthorized repository creation. + + + +## Description +This rule ensures that only users specified in the allowed list can create repositories in the GitHub organization. +It performs the following steps: + +1. Iterates over the users in the GitHub organization. +2. Checks each user's permissions to create repositories against the allowed list specified in the `with.allowed_users` configuration. + - If a user not in the allowed list has permissions to create repositories, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: github/org/create-repos@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of allowed users. | diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index 939875284..a32fcaa03 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependabot-alerts@v2 +with: + desired_value: true + ``` +## Mitigation +Ensures that Dependabot alerts are enabled for new repositories in the GitHub organization, helping to identify and address vulnerabilities in dependencies. + + + +## Description +This rule verifies that Dependabot alerts for new repositories are enabled in the GitHub organization. +It performs the following steps: + +1. Checks the organization's settings for the `dependabot_alerts_enabled_for_new_repositories` field. +2. Compares the value of this field against the desired value specified in the `with.desired_value` configuration. + - If the field does not match the desired value, the rule flags it as a violation. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization settings. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: github/org/dependabot-alerts@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Desired value for the dependabot_alerts_enabled_for_new_repositories setting. | diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 15009ce11..d7dc0f002 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify dependabot_security_updates setting in security_and_analysis -title: Verify dependabot_security_updates setting in security_and_analysis +sidebar_label: Verify Dependabot Security Updates Setting in Security and Analysis +title: Verify Dependabot Security Updates Setting in Security and Analysis --- -# Verify dependabot_security_updates setting in security_and_analysis +# Verify Dependabot Security Updates Setting in Security and Analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` **Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) @@ -25,12 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependabot-security-updates-sa@v2 +with: + dependabot_security_updates: true + +``` + +## Mitigation +Ensures that Dependabot security updates are enabled in the GitHub organization, reducing the risk of vulnerabilities in dependencies. -## Usage example -```yaml -with: github/org/dependabot-security-updates-sa@v2 -``` + +## Description +This rule ensures that Dependabot security updates are enabled in the GitHub organization. +It performs the following steps: + +1. Checks the security and analysis settings of the GitHub organization. +2. Verifies that the Dependabot security updates setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + ## Evidence Requirements | Field | Value | @@ -41,3 +55,8 @@ with: github/org/dependabot-security-updates-sa@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| dependabot_security_updates | boolean | False | Indicates if Dependabot security updates are enabled. | + diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 3785aa7da..1b42a193f 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting -title: Verify dependabot_security_updates_enabled_for_new_repositories setting +sidebar_label: Verify Dependabot Security Updates Enabled for New Repositories Setting +title: Verify Dependabot Security Updates Enabled for New Repositories Setting --- -# Verify dependabot_security_updates_enabled_for_new_repositories setting +# Verify Dependabot Security Updates Enabled for New Repositories Setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` **Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependabot-security-updates@v2 +with: + desired_value: true + ``` +## Mitigation +Ensures that Dependabot security updates are enabled for new repositories in the GitHub organization, reducing the risk of vulnerabilities in dependencies. + + + +## Description +This rule ensures that Dependabot security updates are enabled for new repositories in the GitHub organization. +It performs the following steps: + +1. Checks the security and analysis settings of the GitHub organization. +2. Verifies that the Dependabot security updates setting is enabled for new repositories. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: github/org/dependabot-security-updates@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Indicates if Dependabot security updates for new repositories are enabled. | diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index bbbb0d6c8..f9cb78a96 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting -title: Verify dependency_graph_enabled_for_new_repositories setting +sidebar_label: Verify Dependency Graph Enabled +title: Verify Dependency Graph Enabled --- -# Verify dependency_graph_enabled_for_new_repositories setting +# Verify Dependency Graph Enabled **Type:** Rule **ID:** `github-org-dependency-graph` **Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) **Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization -Verify `dependency_graph` is enabled for new repositories in the GitHub organization. +Verify that the dependency graph is enabled in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependency-graph@v2 +with: + desired_value: true + ``` +## Mitigation +Ensures that the dependency graph is enabled in the GitHub organization, providing better visibility into dependencies and potential vulnerabilities. + + + +## Description +This rule ensures that the dependency graph is enabled in the GitHub organization. +It performs the following steps: + +1. Checks the settings of the GitHub organization. +2. Verifies that the dependency graph setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: github/org/dependency-graph@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Indicates if the dependency graph is enabled. | diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index ec4464502..10b4e7393 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -1,15 +1,15 @@ --- -sidebar_label: Limit Admin Number in GitHub Organization -title: Limit Admin Number in GitHub Organization +sidebar_label: Verify Maximum Number of Admins +title: Verify Maximum Number of Admins --- -# Limit Admin Number in GitHub Organization +# Verify Maximum Number of Admins **Type:** Rule **ID:** `github-org-max-admins` **Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) -**Labels:** Blueprint, GitHub, Organization +**Labels:** GitHub, Organization -Verify the maximum number of GitHub organization admins is restricted. +Verify that the number of admins in the GitHub organization does not exceed the specified maximum. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/max-admins@v2 +with: + max_admins: 5 + ``` +## Mitigation +Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions. + + + +## Description +This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum. +It performs the following steps: + +1. Checks the list of admins in the GitHub organization. +2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: github/org/max-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_admins | integer | False | Maximum number of admins allowed. | diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 3169fa22b..9be0b9b3c 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/old-secrets@v2 +with: + max_secret_age: 12 + ``` +## Mitigation +Ensures that old secrets are removed from the GitHub organization, reducing the risk of exposure of outdated and potentially compromised secrets. + + + +## Description +This rule ensures that secrets in the GitHub organization are not older than the specified threshold. +It performs the following steps: + +1. Checks the list of secrets in the GitHub organization. +2. Verifies that no secrets are older than the value specified in the `with.max_secret_age` configuration. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: github/org/old-secrets@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_secret_age | 12 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_secret_age | integer | False | Maximum age of secrets in months. | diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 7007a8219..ffb39f41b 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting -title: Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +sidebar_label: Verify Secret Scanning Push Protection Custom Link Enabled Setting +title: Verify Secret Scanning Push Protection Custom Link Enabled Setting --- -# Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting +# Verify Secret Scanning Push Protection Custom Link Enabled Setting **Type:** Rule **ID:** `github-org-pp-custom-link` **Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/pp-custom-link@v2 +with: + desired_value: true + ``` +## Mitigation +Ensure that the secret scanning push protection custom link is enabled to provide better security for secret scanning in the GitHub organization. + + + +## Description +This rule ensures that the secret scanning push protection custom link is enabled in the GitHub organization. +It performs the following steps: + +1. Checks the settings of the GitHub organization. +2. Verifies that the secret scanning push protection custom link setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: github/org/pp-custom-link@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Indicates if the secret scanning push protection custom link is enabled. | diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index b2a661f61..47499d402 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Secret_Scanning_Push_Protection Setting -title: Verify Secret_Scanning_Push_Protection Setting +sidebar_label: Verify Secret Scanning Push Protection Enabled in Security and Analysis +title: Verify Secret Scanning Push Protection Enabled in Security and Analysis --- -# Verify Secret_Scanning_Push_Protection Setting +# Verify Secret Scanning Push Protection Enabled in Security and Analysis **Type:** Rule **ID:** `github-org-push-protection-sa` **Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) **Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_push_protection` is configured in the GitHub repository. +Verify `secret_scanning_push_protection` is enabled in the security and analysis settings of the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,22 @@ uses: github/org/push-protection-sa@v2 with: github/org/push-protection-sa@v2 ``` +## Mitigation +Ensure that secret scanning push protection is enabled to provide better security for secret scanning in the GitHub organization. + + + +## Description +This rule ensures that secret scanning push protection is enabled in the security and analysis settings of the GitHub organization. +It performs the following steps: + +1. Checks the security and analysis settings of the GitHub organization. +2. Verifies that the secret scanning push protection setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 720df224a..faea71eb4 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -1,9 +1,9 @@ --- -sidebar_label: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories +sidebar_label: Verify Secret Scanning Push Protection Enabled for New Repositories Setting -title: Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +title: Verify Secret Scanning Push Protection Enabled for New Repositories Setting --- -# Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting +# Verify Secret Scanning Push Protection Enabled for New Repositories Setting **Type:** Rule **ID:** `github-org-push-protection` **Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) @@ -26,8 +26,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/push-protection@v2 +with: + desired_value: true + ``` +## Mitigation +Ensures that secret scanning push protection is enabled for new repositories in the GitHub organization, providing better security for secret scanning. + + + +## Description +This rule ensures that secret scanning push protection is enabled for new repositories in the GitHub organization. +It performs the following steps: + +1. Checks the security and analysis settings of the GitHub organization. +2. Verifies that the secret scanning push protection setting is enabled for new repositories. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -37,8 +56,8 @@ uses: github/org/push-protection@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_value | boolean | False | Indicates if the secret scanning push protection is enabled for new repositories. | diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index ceb05ba03..8d5214e85 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Repo Visibility Setting -title: Verify Repo Visibility Setting +sidebar_label: Verify Repository Visibility Setting +title: Verify Repository Visibility Setting --- -# Verify Repo Visibility Setting +# Verify Repository Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` **Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) **Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) **Labels:** GitHub, Organization -Verify only repositories in the Allowed List are public in the GitHub organization. +Verify that the repository visibility setting is configured correctly in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/repo-visibility@v2 +with: + allowed_repo_names: + - "my_org/.*" + - "my_org/my_repo/.*" ``` +## Mitigation +Ensure that the repository visibility setting is configured correctly to reduce the risk of unauthorized access to repositories. + + + +## Description +This rule ensures that the repository visibility setting is configured correctly in the GitHub organization. +It performs the following steps: + +1. Checks the visibility settings of repositories in the GitHub organization. +2. Verifies that the visibility setting matches the value specified in the `with.desired_visibility` configuration. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: github/org/repo-visibility@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_repo_names | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_repo_names | array | False | List of repository pattern allowed to be visible. | diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index bb458be44..7b3a1d21f 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -9,7 +9,7 @@ title: Verify Secret_Scanning Setting in Security_And_Analysis **Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning` is configured in the GitHub repository. +Verify `secret_scanning` is configured and enabled in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,22 @@ uses: github/org/secret-scanning-sa@v2 with: github/org/secret-scanning-sa@v2 ``` +## Mitigation +Ensure that the Secret Scanning setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories, enhancing security. + + + +## Description +This rule checks if the `secret_scanning` setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories. +It performs the following steps: + +1. Checks the secret scanning settings of the GitHub organization. +2. Verifies that the secret scanning setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 6092de767..3ffd87ce8 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -9,7 +9,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization -Verify `secret_scanning` is enabled for new repositories in the GitHub organization. +Ensure `secret_scanning` is configured and enabled in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,6 +27,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/secret-scanning@v2 ``` +## Mitigation +Ensure that the Secret scanning setting is enabled to detect and prevent the exposure of secrets in the repository, enhancing security. + + + +## Description +This rule ensures that `secret_scanning` is enabled to detect and prevent the exposure of secrets in the repository. +It performs the following steps: + +1. Checks the secret scanning settings of the GitHub repository. +2. Verifies that the secret scanning setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 903d61c1e..6eb9f94ce 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis -title: Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +sidebar_label: Verify Validity checks are configured and enabled in the GitHub organization. +title: Verify Validity checks are configured and enabled in the GitHub organization. --- -# Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis +# Verify Validity checks are configured and enabled in the GitHub organization. **Type:** Rule **ID:** `github-org-validity-checks-sa` **Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) **Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_validity_checks` is configured in the GitHub organization. +Verify Validity checks are configured and enabled in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,22 @@ uses: github/org/validity-checks-sa@v2 with: github/org/validity-checks-sa@v2 ``` +## Mitigation +Ensure that the Validity checks under GitHub organization setting is enabled to maintain the integrity of the organization’s repositories, preventing potential issues and vulnerabilities. + + + +## Description +This rule checks if the `validity_checks` under GitHub organization setting is enabled to ensure the integrity of the organization’s repositories. +It performs the following steps: + +1. Checks the validity checks settings of the GitHub organization. +2. Verifies that the validity checks setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 54cce6642..d368a4c49 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -9,7 +9,7 @@ title: Verify Secret_Scanning_Validity_Checks_Enabled Setting **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_validity_checks` is configured in the GitHub repository. +Ensure Validity Checks are configured and enabled in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,6 +27,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/validity-checks@v2 ``` +## Mitigation +Ensure that the Validity Checks under Github Repository setting is enabled to validate the integrity of the repository, preventing potential issues and vulnerabilities. + + + +## Description +This rule ensures that are enabled to validate the integrity of the repository. +It performs the following steps: + +1. Checks the validity checks settings of the GitHub repository. +2. Verifies that the validity checks setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index 5da1116c1..d0e154d79 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -9,7 +9,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) **Labels:** GitHub, Organization -Verify contributors sign commits through the GitHub web interface. +Verify Web Commit Signoff is configured and enabled in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/web-commit-signoff@v2 + +## Usage example + +```yaml +with: github/org/web-commit-signoff@v2 ``` +## Mitigation +Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability. + + + +## Description +This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off. +It performs the following steps: + +1. Checks the web commit signoff settings of the GitHub organization. +2. Verifies that the web commit signoff setting is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 3876724e6..161826f8d 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/branch-protection@v2 +with: + desired_protected: true + branches: + - 'main' + - 'master' + ``` +## Mitigation +Ensures that branch protection settings are correctly configured, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that branch protection is configured in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for branch protection. +2. Verifies that the protection settings match the expected values. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,9 +58,9 @@ uses: github/repository/branch-protection@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=repository | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_protected | True | -| branches | ['main', 'master'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| desired_protected | boolean | False | Desired branch protection setting. | +| branches | array | False | List of branches to be protected. | diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 6d2fac34f..d9331da38 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -27,6 +27,22 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/repository/branch-verification@v2 ``` +## Mitigation +Ensures that branch verification settings are correctly configured, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that branch verification in the GitHub repository matches the value defined in the configuration file. +It performs the following steps: + +1. Checks the repository settings for branch verification. +2. Verifies that the verification setting matches the expected value. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 1187a9950..da8e42bac 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -32,6 +32,22 @@ uses: github/repository/check-signed-commits@v2 with: github/repository/check-signed-commits@v2 ``` +## Mitigation +Ensures that all commits are signed, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that all commits in the GitHub repository are signed. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. Checks each commit for a valid signature. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 12ae2eec9..913b0a2f5 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -32,6 +32,22 @@ uses: github/repository/default-branch-protection@v2 with: github/repository/default-branch-protection@v2 ``` +## Mitigation +Ensures that the default branch is protected, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that the default branch protection is configured in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for default branch protection configuration. +2. Verifies that the configuration matches the expected settings. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 8cda18e42..0ea0ad835 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Dependabot security updates setting -title: Verify Dependabot security updates setting +sidebar_label: Verify Dependabot Security Updates Setting +title: Verify Dependabot Security Updates Setting --- -# Verify Dependabot security updates setting +# Verify Dependabot Security Updates Setting **Type:** Rule **ID:** `github-repo-dependabot` **Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) @@ -32,6 +32,22 @@ uses: github/repository/dependabot@v2 with: github/repository/dependabot@v2 ``` +## Mitigation +Ensures that Dependabot security updates are enabled, reducing the risk of vulnerabilities in dependencies. + + + +## Description +This rule ensures that Dependabot security updates are configured in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for Dependabot security updates configuration. +2. Verifies that the configuration matches the expected settings. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 71067461c..d7b20d9ab 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -32,6 +32,22 @@ uses: github/repository/ephemeral-runners-only@v2 with: github/repository/ephemeral-runners-only@v2 ``` +## Mitigation +Ensures that only ephemeral runners are used, reducing the risk of persistent runner vulnerabilities. + + + +## Description +This rule ensures that only ephemeral runners are used in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for runner configuration. +2. Verifies that only ephemeral runners are used. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 45a28df7d..98438ad43 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -32,6 +32,22 @@ uses: github/repository/no-cache-usage@v2 with: github/repository/no-cache-usage@v2 ``` +## Mitigation +Ensures that no cache is used, reducing the risk of outdated or insecure dependencies. + + + +## Description +This rule ensures that no cache is used in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for cache usage. +2. Verifies that no cache is used. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 90aead5bf..07a89c7f5 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -32,6 +32,22 @@ uses: github/repository/no-org-secrets@v2 with: github/repository/no-org-secrets@v2 ``` +## Mitigation +Ensures that no organization secrets are used, reducing the risk of unauthorized access. + + + +## Description +This rule ensures that no organization secrets are used in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for organization secrets. +2. Verifies that no organization secrets are used. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 1cb1e191f..a44c824b8 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -27,6 +27,21 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/repository/old-secrets@v2 ``` +## Mitigation +Ensures that secrets are rotated regularly, reducing the risk of compromised secrets. + + +## Description +This rule ensures that secrets in the GitHub repository are not older than the specified threshold. +It performs the following steps: + +1. Checks the repository settings for secrets. +2. Verifies that the age of each secret does not exceed the specified threshold. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index fb25bdf45..08fdaba10 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -9,7 +9,7 @@ title: Verify Push Protection Setting **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) **Labels:** GitHub, Repository -Verify `secret_scanning_push_protection` is configured in the GitHub repository. +Verify Secret Scanning Push Protection Setting is configured in the GitHub repository. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,21 @@ uses: github/repository/push-protection@v2 with: github/repository/push-protection@v2 ``` +## Mitigation +Ensures that push protection is enabled, reducing the risk of unauthorized changes. + + +## Description +This rule ensures that push protection is enabled in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for push protection. +2. Verifies that push protection is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 81f9f23af..1e1ae5514 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/repo-private@v2 + +## Usage example + +```yaml +with: github/repository/repo-private@v2 ``` +## Mitigation +Ensures that the repository is private, reducing the risk of unauthorized access. + + + +## Description +This rule ensures that the GitHub repository is private. +It performs the following steps: + +1. Checks the repository settings for privacy. +2. Verifies that the repository is private. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index d491461a1..8046012c7 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -9,7 +9,7 @@ title: Verify secret_scanning setting **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) **Labels:** GitHub, Repository -Verify `secret_scanning` is configured in the GitHub repository. +Verify Secret Scanning Setting is configured in the GitHub repository. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,21 @@ uses: github/repository/secret-scanning@v2 with: github/repository/secret-scanning@v2 ``` +## Mitigation +Ensures that Secret Scanning is configured, reducing the risk of leaking sensitive information. + + + +## Description +This rule ensures that the `secret_scanning` is configured in the GitHub repository. +It performs the following steps: + +1. Checks the repository settings for `secret_scanning` configuration. +2. Verifies that the configuration matches the expected settings. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 767e03735..353729a3b 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -32,6 +32,21 @@ uses: github/repository/signed-commits@v2 with: github/repository/signed-commits@v2 ``` +## Mitigation +Ensures that all commits are signed, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that all commits in the GitHub repository are signed. +It performs the following steps: + +1. Iterates over the commits in the repository. +2. Checks each commit for a valid signature. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 2c406df16..557a124ff 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -9,7 +9,7 @@ title: Verify secret scanning. **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) **Labels:** GitHub, Repository -Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. +Verify both Secret Scanning Validity Checks and Security and Analysis Setting are configured in the GitHub organization and all the repositories. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -32,6 +32,21 @@ uses: github/repository/validity-checks@v2 with: github/repository/validity-checks@v2 ``` +## Mitigation +Ensure that the validity checks are set in the GitHub organization and all the repositories. + + + +## Description +This rule ensures that both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. +It performs the following steps: + +1. Checks the organization settings for `secret_scanning_validity_checks` and `security_and_analysis`. +2. Verifies that the settings are configured as expected. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 5f9d685e5..490b48175 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/visibility@v2 +with: + allowed_repo_names: + - my-org/.* + - my-org/my-repo.* + ``` +## Mitigation +Ensures that only allowed repositories are public, reducing the risk of unauthorized access. + + + +## Description +This rule ensures that only GitHub repositories in the Allowed List are public. +It performs the following steps: + +1. Checks the repository settings for visibility. +2. Verifies that the repository is public only if it is in the Allowed List. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: github/repository/visibility@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=repository | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_repo_names | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_repo_names | string | False | List of allowed repository patterns. | diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 1e4648a75..2ed629463 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/web-commit-signoff@v2 + +## Usage example + +```yaml +with: github/repository/web-commit-signoff@v2 ``` +## Mitigation +Ensure that the repository requires signoff on all commits made through the GitHub web interface, enhancing security and accountability. + + + +## Description +This rule checks if the repository requires signoff on all commits made through the GitHub web interface. +It performs the following steps: + +1. Checks the repository settings for commit signoff. +2. Verifies that the repository requires signoff on all commits made through the GitHub web interface. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. + ## Evidence Requirements | Field | Value | |-------|-------| From 2d6ef9f69080de8e68d5f917a1e9f3e7067a3175 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 14:04:03 +0200 Subject: [PATCH 154/191] update --- .../rules/gitlab/org/allow-admins.md | 30 ++++++++++++++++--- .../rules/gitlab/org/allow-token-scopes.md | 26 +++++++++++++--- .../rules/gitlab/org/allow-users.md | 30 ++++++++++++++++--- .../rules/gitlab/org/blocked-users.md | 29 +++++++++++++++--- .../rules/gitlab/org/expiring-tokens.md | 26 +++++++++++++--- .../rules/gitlab/org/forbid-token-scopes.md | 28 ++++++++++++++--- .../rules/gitlab/org/inactive-projects.md | 27 ++++++++++++++--- .../rules/gitlab/org/longlive-tokens.md | 26 +++++++++++++--- .../rules/gitlab/org/max-admins.md | 26 +++++++++++++--- .../rules/gitlab/org/projects-visibility.md | 23 +++++++++++--- .../rules/gitlab/org/unused-tokens.md | 26 +++++++++++++--- 11 files changed, 253 insertions(+), 44 deletions(-) diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index b581f64c4..255828856 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/allow-admins@v2 +with: + allowed_admins: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have admin privileges in the GitLab organization to reduce the risk of unauthorized changes. + + + +## Description +This rule ensures that only users in the Allowed List have admin privileges in the GitLab organization. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that only users in the Allowed List have admin privileges. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: gitlab/org/allow-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_admins | array | False | List of users allowed to have admin privileges in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index 32cb22c8f..b436d9c3a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/allow-token-scopes@v2 +with: + allowed_token_scopes: + - api + - read_api + - read_repository + - read_registry + ``` +## Description +This rule ensures that all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that all tokens are restricted to allowed scopes. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/org/allow-token-scopes@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_token_scopes | ['api', 'read_api', 'read_repository', 'read_registry'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_token_scopes | array | False | List of allowed token scopes in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index 1c0d18659..ef49575d5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/allow-users@v2 +with: + allowed_users: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have access to the GitLab organization to reduce the risk of unauthorized access. + + + +## Description +This rule ensures that only users in the Allowed List have access to the GitLab organization. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that only users in the Allowed List have access. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: gitlab/org/allow-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of users allowed to have access to the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 5047069f6..ac749f642 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/blocked-users@v2 +with: + blocked_users: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that no users are on the block list in the GitLab organization to reduce the risk of unauthorized access. + + +## Description +This rule ensures that no users in the GitLab organization are on the block list. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no users are on the block list. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +57,8 @@ uses: gitlab/org/blocked-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| blocked_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| blocked_users | array | False | List of users blocked in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index d33f2615e..a87eaf94a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/expiring-tokens@v2 +with: + exiring_in_days: 30 + ``` +## Mitigation +Ensure that no GitLab organization tokens are about to expire to prevent service disruption. + + +## Description +This rule ensures that no GitLab organization tokens are about to expire. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no tokens are about to expire. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/org/expiring-tokens@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| exiring_in_days | 30 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| exiring_in_days | number | False | Number of days before a token expires. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 870a599b4..01cd76730 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/forbid-token-scopes@v2 +with: + project_scopes: + - write_api + - write_repository + ``` +## Mitigation +Ensure that no GitLab organization tokens have disallowed scopes to prevent excessive permission. + + +## Description +This rule ensures that no GitLab organization tokens have disallowed scopes. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no tokens have disallowed scopes. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: gitlab/org/forbid-token-scopes@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| project_scopes | ['write_api', 'write_repository'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| project_scopes | array | False | List of disallowed token scopes in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index a867b2505..a2086b1ee 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/inactive-projects@v2 +with: + inactive_for_days: 90 + ``` +## Mitigation +Ensure that no GitLab organization projects are inactive to prevent service disruption. + + + +## Description +This rule ensures that no GitLab organization projects are inactive. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no projects are inactive. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/org/inactive-projects@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 90 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| inactive_for_days | number | False | Number of days before a project is considered inactive. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 04e334572..bb87e4efe 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/longlive-tokens@v2 +with: + exiring_in_days: 365 + ``` +## Mitigation +Ensure that no GitLab organization tokens have an excessively long lifespan to prevent service disruption. + + +## Description +This rule ensures that no GitLab organization tokens have an excessively long lifespan. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no tokens have an excessively long lifespan. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/org/longlive-tokens@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| exiring_in_days | 365 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| exiring_in_days | number | False | Number of days before a token expires. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index d4f22160e..7d27042cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/max-admins@v2 +with: + max_admins: 0 + ``` +## Mitigation +Ensure that the maximum number of admins for the GitLab project is restricted to reduce the risk of unauthorized changes. + + +## Description +This rule ensures that the maximum number of admins for the GitLab project is restricted. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that the maximum number of admins is restricted. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/org/max-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_admins | number | False | Maximum number of admins allowed in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 1253964f1..045578902 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -25,8 +25,23 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/projects-visibility@v2 +with: + allowed_public: + - "Learn GitLab" + - "Scribe Gitlab Test" + ``` +## Description +This rule ensures that only allowed projects in the GitLab organization have public visibility. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that only allowed projects have public visibility. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +51,8 @@ uses: gitlab/org/projects-visibility@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_public | ['Learn GitLab', 'Scribe Gitlab Test'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_public | array | False | List of projects allowed to have public visibility in the GitLab organization. | diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 723251b2e..b792615bf 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/org/unused-tokens@v2 +with: + unused_for_days: 90 + ``` +## Mitigation +Ensure that no GitLab organization tokens are unused to prevent service disruption. + + +## Description +This rule ensures that no GitLab organization tokens are unused. +It performs the following steps: + +1. Checks the settings of the GitLab organization. +2. Verifies that no tokens are unused. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/org/unused-tokens@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=organization | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| unused_for_days | 90 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| unused_for_days | number | False | Number of days before a token is considered unused. | From f7fb5f720e57fab2e7ce9ffc374f1c6804a85d99 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 14:12:11 +0200 Subject: [PATCH 155/191] update --- .../gitlab/pipeline/verify-labels-exist.md | 27 +++++++++++++++--- .../rules/gitlab/pipeline/verify-labels.md | 28 ++++++++++++++++--- .../jenkins/folder/exposed-credentials.md | 15 ++++++++++ .../rules/jenkins/instance/inactive-users.md | 26 ++++++++++++++--- .../rules/jenkins/instance/unused-users.md | 15 ++++++++++ 5 files changed, 99 insertions(+), 12 deletions(-) diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 0f49e0007..c5ee6e031 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/pipeline/verify-labels-exist@v2 +with: + labels: + - "app.kubernetes.io/instance" + ``` +## Mitigation +Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration. + + +## Description +This rule ensures that the pipeline has all required label keys and values. +It performs the following steps: + +1. Checks the settings of the GitLab pipeline. +2. Verifies that all required labels exist in the pipeline. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/pipeline/verify-labels-exist@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=pipeline | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | ['app.kubernetes.io/instance'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | array | True | List of labels to verify exist in the pipeline. | diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index 1a4f2c69e..8197f7b08 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/pipeline/verify-labels@v2 +with: + labels: + app.kubernetes.io/instance: "defaul1t" + ``` +## Mitigation +Ensure that all required labels exist in the pipeline to reduce the risk of misconfiguration. + + +## Description +This rule ensures that the pipeline includes all required label keys and values. +It performs the following steps: + +1. Checks the settings of the GitLab pipeline. +2. Verifies that all required labels exist in the pipeline. +2.1 Verify that all the label values match the expected values. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: gitlab/pipeline/verify-labels@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=pipeline | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| labels | `{'app.kubernetes.io/instance': 'defaul1t'}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| labels | object | True | List of labels to verify exist in the pipeline. | diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 4684fcbcc..41394f865 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -32,6 +32,21 @@ uses: jenkins/folder/exposed-credentials@v2 with: jenkins/folder/exposed-credentials@v2 ``` +## Mitigation +Ensure that there are no exposed credentials in the Jenkins folder to reduce the risk of unauthorized access. + + +## Description +This rule ensures that there are no exposed credentials in the Jenkins folder. +It performs the following steps: + +1. Checks the Jenkins folder for exposed credentials. +2. Verifies that there are no exposed credentials. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins folder resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 0cdab37a7..7f2b00277 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: jenkins/instance/inactive-users@v2 +with: + inactive_for_days: 90 + ``` +## Mitigation +Ensure that no Jenkins instance users are inactive to prevent service disruption. + + +## Description +This rule ensures that no Jenkins instance users are inactive. +It performs the following steps: + +1. Checks the settings of the Jenkins instance. +2. Verifies that no users are inactive. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -35,8 +53,8 @@ uses: jenkins/instance/inactive-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=instance
- platform=jenkins | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 90 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| inactive_for_days | number | False | Number of days before a user is considered inactive. | diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index 0b736c042..b3b6ac9b1 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -32,6 +32,21 @@ uses: jenkins/instance/unused-users@v2 with: jenkins/instance/unused-users@v2 ``` +## Mitigation +Ensure that there are no users with zero activity in the Jenkins instance to prevent service disruption. + + +## Description +This rule ensures that there are no users with zero activity in the Jenkins instance. +It performs the following steps: + +1. Checks the settings of the Jenkins instance. +2. Verifies that there are no users with zero activity. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources. + + ## Evidence Requirements | Field | Value | |-------|-------| From a5e4bbf9e12fd4f03d74de0ed40263ff0cd68485 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 14:17:38 +0200 Subject: [PATCH 156/191] update --- docs/configuration/initiatives/index.md | 2 +- .../rules/gitlab/api/push-rules.md | 25 +++++++--- .../rules/gitlab/api/signed-commits-range.md | 46 ++++++++++++++----- 3 files changed, 55 insertions(+), 18 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index caafdf830..f59459b00 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -295,7 +295,7 @@ | Rule Name | Description | |-----------|-------------| -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | +| [Sign Commits in Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the commits in a specified range are signed in the GitLab organization. | | [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | | [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | | [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index a135d348f..7de3e6939 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -22,12 +22,25 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/api/push-rules@v2 +with: + api_token: '{{ .Args.Token }}' + project: my_project + push_rule: + commit_message_regex: .*hotfix:.* + member_check: true + max_file_size: 100 + prevent_secrets: true + deny_delete_tag: true + author_email_regex: .*@example.com + file_name_regex: "abc" + commit_committer_name_check: "enabled" + reject_unsigned_commits: "enabled" ``` -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| api_token | `{{ .Args.Token }}` | -| project | `{{ .Args.Project }}` | -| push_rule | `{'commit_message_regex': '', 'commit_message_negative_regex': None, 'branch_name_regex': None, 'deny_delete_tag': False, 'member_check': False, 'prevent_secrets': False, 'author_email_regex': '', 'file_name_regex': 'abc', 'max_file_size': 100, 'commit_committer_name_check': None, 'reject_unsigned_commits': None}` | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| api_token | string | True | GitLab API access token. | +| project | string | True | GitLab project name. | +| push_rule | object | True | GitLab push rules. | diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 80e6cb2d5..4dd2c4f3a 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -1,15 +1,15 @@ --- -sidebar_label: Sign Selected Commit Range in GitLab -title: Sign Selected Commit Range in GitLab +sidebar_label: Sign Commits in Range in GitLab +title: Sign Commits in Range in GitLab --- -# Sign Selected Commit Range in GitLab +# Sign Commits in Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` **Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) **Labels:** Gitlab, API -Verify the selected range of commits is signed via the GitLab API. +Verify the commits in a specified range are signed in the GitLab organization. :::tip Evidence **IS NOT** required for this rule. @@ -22,13 +22,37 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/api/signed-commits-range@v2 +with: + since: "2021-01-01T00:00:00Z" + until: "2021-01-31T23:59:59Z" + project_id: my_project_id + private_token: '{{ .Args.Token }}' + ``` -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| since | | -| until | | -| project_id | | -| private_token | | +## Mitigation +Ensure that the commits in the specified time range are signed in the GitLab repository. + + + +## Description +This rule ensures that the commits in the specified time range are signed in the GitLab repository. +It performs the following steps: + +1. Checks the commits in the specified time range in the GitLab repository. +2. Verifies that the commits in the specified time range are signed. +2.1 Verifies that the commits in the specified time range are signed by the proper owner. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab repository resources. +- GitLab API token must be provided to access the GitLab API. + + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| since | string | False | ISO 8601 date-time string. The beginning of the time range. | +| until | string | False | ISO 8601 date-time string. The end of the time range. | +| project_id | string | True | GitLab project ID. | +| private_token | string | True | GitLab API access token. | From 4b020742a153fa2370c74fac4159b5e88fe5f766 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 14:59:16 +0200 Subject: [PATCH 157/191] update --- docs/configuration/initiatives/index.md | 6 ++-- .../rules/gitlab/project/abandoned-project.md | 26 ++++++++++++--- .../gitlab/project/approvals-policy-check.md | 31 +++++++++++++++--- .../project/approvers-per-merge-request.md | 28 +++++++++++++--- .../gitlab/project/author-email-regex.md | 26 ++++++++++++--- .../rules/gitlab/project/check-cwe.md | 26 ++++++++++++--- .../gitlab/project/check-signed-commits.md | 15 +++++++++ .../gitlab/project/co-approval-required.md | 27 +++++++++++++--- .../project/commit-author-email-check.md | 28 +++++++++++++--- .../project/commit-author-name-check.md | 27 +++++++++++++--- .../gitlab/project/commit-committer-check.md | 16 ++++++++++ .../gitlab/project/commit-message-check.md | 27 +++++++++++++--- .../rules/gitlab/project/commits-validated.md | 15 +++++++++ .../gitlab/project/committer-email-check.md | 27 +++++++++++++--- .../gitlab/project/committer-name-check.md | 28 +++++++++++++--- .../gitlab/project/critical-severity-limit.md | 26 ++++++++++++--- .../project/description-substring-check.md | 26 ++++++++++++--- .../project/disallowed-banned-approvers.md | 28 +++++++++++++--- .../gitlab/project/force-push-protection.md | 26 ++++++++++++--- .../gitlab/project/medium-severity-limit.md | 26 ++++++++++++--- .../rules/gitlab/project/member-check.md | 16 ++++++++++ .../gitlab/project/merge-access-level.md | 32 ++++++++++++++++--- .../project/merge-requests-author-approval.md | 28 +++++++++++++--- ...ge-requests-disable-committers-approval.md | 28 +++++++++++++--- .../gitlab/project/message-substring-check.md | 26 ++++++++++++--- .../gitlab/project/prevent-secrets-check.md | 15 +++++++++ .../gitlab/project/protect-ci-secrets.md | 26 ++++++++++++--- .../rules/gitlab/project/push-access-level.md | 31 +++++++++++++++--- .../rules/gitlab/project/push-rules-set.md | 15 +++++++++ .../gitlab/project/reject-unsigned-commits.md | 15 +++++++++ .../project/require-password-to-approve.md | 27 +++++++++++++--- .../project/required-minimal-approvers.md | 15 +++++++++ .../gitlab/project/reset-pprovals-on-push.md | 26 ++++++++++++--- .../rules/gitlab/project/sast-scan-pass.md | 16 ++++++++++ .../rules/gitlab/project/sast-scanning.md | 16 ++++++++++ .../rules/gitlab/project/secrets-scan-pass.md | 15 +++++++++ .../rules/gitlab/project/secrets-scanning.md | 16 ++++++++++ .../project/selective-code-owner-removals.md | 27 +++++++++++++--- .../rules/gitlab/project/visibility-check.md | 26 ++++++++++++--- 39 files changed, 788 insertions(+), 113 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index f59459b00..d948845ef 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -179,11 +179,11 @@ | [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | | [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | | [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project. | | [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | | [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | | [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify Merge Requests Disable Committers Approval is set for the GitLab project. | | [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | | [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | | [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | @@ -191,7 +191,7 @@ | [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | | [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | | [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field Merge Requests Author Approval is set for the GitLab project. | | [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | | [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | | [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 51e8f4a73..ff3acb94a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/abandoned-project@v2 +with: + inactive_for_days: 30 + ``` +## Mitigation +Ensure that the GitLab project is active for the specified duration to prevent project abandonment. + + +## Description +This rule ensures that the GitLab project is active for a specified duration. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the project has been active for the specified duration. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/abandoned-project@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| inactive_for_days | 30 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| inactive_for_days | number | False | Number of days the project has been inactive. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index e7dfabb97..9f2819e6d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/approvals-policy-check@v2 +with: + name: "All Members" + approvals_required_min: 2 + ``` +## Mitigation +Ensure that the project's merge approval policy complies with requirements to prevent unauthorized merges. + + + +## Description +This rule ensures that the project's merge approval policy complies with requirements. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the project's merge approval policy matchinig the 'name' field. +2.1. Verifies that the project's merge approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,9 +57,9 @@ uses: gitlab/project/approvals-policy-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| name | All Members | -| approvals_required_min | 2 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| name | string | True | Name of the group or user that must approve the merge request. | +| approvals_required_min | number | True | Minimum number of approvals required for merge requests. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 4950d6c43..993601e89 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -9,7 +9,7 @@ title: Restrict Approvers Per Merge Request **Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) **Labels:** Gitlab, Project -Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. +Verify the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/approvers-per-merge-request@v2 +with: + disable_overriding_approvers_per_merge_request: false + ``` +## Mitigation +Ensure that the binary field Disable Overriding Approvers Per Merge Request reduces the risk of unauthorized access by setting it to the specified value. + + +## Description +This rule ensures that the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project. + +It performs the following steps: +1. Checks the settings of the GitLab project. +2. Verifies that the binary field Disable Overriding Approvers Per Merge Request is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/approvers-per-merge-request@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| disable_overriding_approvers_per_merge_request | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| disable_overriding_approvers_per_merge_request | boolean | False | Whether to disable overriding approvers per merge request. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index e76b7529a..c0763a2c4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/author-email-regex@v2 +with: + author_email_regex: ".*@mycompany.com" + ``` +## Mitigation +Ensure that the Author Email reduces the risk of unauthorized access by setting the `author_email_regex` field to the specified value. + + +## Description +This rule ensures that the `author_email_regex` for the GitLab project is set to the specified value. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the Author Email matches the 'author_email_regex' field. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/author-email-regex@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| author_email_regex | | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| author_email_regex | string | False | The regular expression for the author email. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index b69783815..1e6a6627c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/check-cwe@v2 +with: + cwe_value: "89" + ``` +## Mitigation +Ensure that the specified CWEs were not detected in the GitLab project to prevent vulnerabilities. + + +## Description +This rule ensures that the specified CWEs were not detected in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the specified CWEs were not detected in the GitLab project. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/check-cwe@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| cwe_value | 89 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| cwe_value | string | True | The CWE value to check for. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index b9b5e6a5b..3d54357a8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -32,6 +32,21 @@ uses: gitlab/project/check-signed-commits@v2 with: gitlab/project/check-signed-commits@v2 ``` +## Mitigation +Ensure that all commits in the GitLab project are signed to prevent unauthorized changes. + + +## Description +This rule ensures that all commits in the GitLab project are signed. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that all commits are signed. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 5d4e11218..7a5ed4d27 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/co-approval-required@v2 +with: + branch: "main" + ``` +## Mitigation +Require code owner approval for specific branches in the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that code owner approval is required for specific branches in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that code owner approval is required for the specified branch. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/co-approval-required@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| branch | string | True | The branch to require code owner approval. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 82fcd7c67..06efddd56 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commit-author-email-check@v2 +with: + allowed_authors: + - mail@example.com + - mail2@example.com + ``` +## Mitigation +Ensure that only users in the Allowed List have commit author permissions in the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that only users in the Allowed List have commit author permissions in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that only users in the Allowed List have commit author permissions. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: gitlab/project/commit-author-email-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_authors | ['mail@example.com'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_authors | array | False | List of users allowed to have commit author permissions in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 1b34bcf66..5ff5e4cdf 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commit-author-name-check@v2 +with: + allowed_authors: + - examplename + ``` +## Mitigation +Ensure that only users in the Allowed List author commits in the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that only users in the Allowed List author commits in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that only users in the Allowed List author commits. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/commit-author-name-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_authors | ['examplename'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_authors | array | False | List of users allowed to author commits in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index 1f7c31a34..d9eff924e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -32,6 +32,22 @@ uses: gitlab/project/commit-committer-check@v2 with: gitlab/project/commit-committer-check@v2 ``` +## Mitigation +Enable `commit_committer_check` in the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that `commit_committer_check` is enabled for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that `commit_committer_check` is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 2ff5032ee..6cf14c8e3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commit-message-check@v2 +with: + commit_message_regex: ".*JIRA-\\d+.*" + ``` +## Mitigation +Ensure that commit messages adhere to the specified format template to maintain consistency and readability. + + + +## Description +This rule ensures that commit messages in the GitLab project adhere to the specified format template. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that commit messages adhere to the specified format template. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/commit-message-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| commit_message_regex | .*JIRA-\d+.* | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| commit_message_regex | string | True | The regular expression to match the commit message format. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 900bfee6f..b6e5df923 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -32,6 +32,21 @@ uses: gitlab/project/commits-validated@v2 with: gitlab/project/commits-validated@v2 ``` +## Mitigation +Ensure that all commits in the GitLab project are validated to prevent unauthorized changes. + + +## Description +This rule ensures that all commits in the GitLab project are validated. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that all commits are validated. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 72e935632..04c5b7055 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/committer-email-check@v2 +with: + allowed_committers: + - mail@example.com + ``` +## Mitigation +Ensure that only users in the Allowed List use committer email addresses in the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that only users in the Allowed List use committer email addresses in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that only users in the Allowed List use committer email addresses. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/committer-email-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_committers | ['mail@example.com'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_committers | array | False | List of email addresses allowed to use committer email addresses in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 427fa5e59..77c30832a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/committer-name-check@v2 +with: + allowed_committers: + - somename + ``` +## Mitigation +Ensure that only users in the Allowed List commit by name in the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that only users in the Allowed List commit by name in the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that only users in the Allowed List commit by name. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: gitlab/project/committer-name-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_committers | ['somename'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_committers | array | False | List of users allowed to commit by name in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 6fdfc2a39..f14055e3f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/critical-severity-limit@v2 +with: + max_allowed_vulnerability_count: 0 + ``` +## Mitigation +Ensure that the maximum allowed critical severity alerts for the GitLab project is enforced to prevent unauthorized changes. + + +## Description +This rule ensures that the maximum allowed critical severity alerts for the GitLab project is enforced. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the maximum allowed critical severity alerts is enforced. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/critical-severity-limit@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_allowed_vulnerability_count | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_allowed_vulnerability_count | number | False | Maximum allowed critical severity alerts for the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index d19d13753..cd73151c2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/description-substring-check@v2 +with: + pattern: "(?i)insdput" + ``` +## Mitigation +Ensure that the specified substring is not found in the description attribute of vulnerabilities to prevent unauthorized changes. + + +## Description +This rule ensures that a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the specified substring is not found in the description attribute of vulnerabilities. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/description-substring-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)insdput | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| pattern | string | False | The substring to search for in the description attribute of vulnerabilities. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 05ab7a67c..9bc257be0 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/disallowed-banned-approvers@v2 +with: + banned_list: + - user1 + - user2 + ``` +## Mitigation +Ensure that approvers in the GitLab project are not on the banned list to prevent unauthorized approvals. + + +## Description +This rule ensures that approvers in the GitLab project are not on the banned list. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that approvers are not on the banned list. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +56,8 @@ uses: gitlab/project/disallowed-banned-approvers@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| banned_list | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| banned_list | array | False | List of users banned from approving in the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index e539e3569..7837e716a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/force-push-protection@v2 +with: + branch: "main" + ``` +## Mitigation +Ensure that force pushes in the GitLab project are disallowed to maintain repository integrity. + + +## Description +This rule ensures that force pushes in the GitLab project are disallowed to maintain repository integrity. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that force pushes are disallowed. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/force-push-protection@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| branch | string | False | The branch to disallow force pushes. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 7d5039fd1..39f12dac6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/medium-severity-limit@v2 +with: + max_allowed_specific_severity: 0 + ``` +## Mitigation +Ensure that the maximum allowed medium severity alerts for the GitLab project is enforced to prevent unauthorized changes. + + +## Description +This rule ensures that the maximum allowed medium severity alerts for the GitLab project is enforced. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the maximum allowed medium severity alerts is enforced. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/medium-severity-limit@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_allowed_specific_severity | 0 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_allowed_specific_severity | number | False | Maximum allowed medium severity alerts for the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 18690dc68..1a70b01bc 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -32,6 +32,22 @@ uses: gitlab/project/member-check@v2 with: gitlab/project/member-check@v2 ``` +## Mitigation +Ensure that Member Check is enabled for the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that `member_check` is enabled for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that `member_check` is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index 55621b099..fcb8c9b49 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/merge-access-level@v2 +with: + branch: "main" + # access_level: 30 + access_level_description: "Maintainers" + ``` +## Mitigation +Ensure that the GitLab project's merge access level complies with requirements to prevent unauthorized changes. + + + +## Description +This rule ensures that the GitLab project's merge access level complies with requirements. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. For scoped branchs, verifies that the merge access level complies with the specified requirements. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,9 +57,10 @@ uses: gitlab/project/merge-access-level@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | -| access_level_description | Maintainers | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| branch | string | False | The branch to enforce merge access level policy. | +| access_level | number | False | The access level to enforce for merge access level policy. | +| access_level_description | string | False | The access level description to enforce for merge access level policy. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 68a2bf64c..1865f9a70 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -9,7 +9,7 @@ title: Disable Author Approval for Merge Requests in GitLab **Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) **Labels:** Gitlab, Project -Verify the binary field `merge_requests_author_approval` is set for the GitLab project. +Verify the binary field Merge Requests Author Approval is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/merge-requests-author-approval@v2 +with: + merge_requests_author_approval: true + ``` +## Mitigation +Ensure that the binary field `merge_requests_author_approval` is set for the GitLab project to prevent unauthorized approvals. + + +## Description +This rule ensures that the binary field Merge Requests Author Approval is set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the binary field Merge Requests Author Approval is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/merge-requests-author-approval@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| merge_requests_author_approval | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| merge_requests_author_approval | boolean | False | The binary field to enforce for merge requests author approval. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index ec58106ad..df3217479 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -9,7 +9,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab **Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) **Labels:** Gitlab, Project -Verify `merge_requests_disable_committers_approval` is set for the GitLab project. +Verify Merge Requests Disable Committers Approval is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/merge-requests-disable-committers-approval@v2 +with: + merge_requests_disable_committers_approval: false + ``` +## Mitigation +Ensure that the binary Merge Requests Disable Committers Approval field is set for the GitLab project to prevent unauthorized approvals. + + +## Description +This rule ensures that the binary field Merge Requests Disable Committers Approval is set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the binary field `merge_requests_disable_committers_approval` is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/merge-requests-disable-committers-approval@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| merge_requests_disable_committers_approval | False | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| merge_requests_disable_committers_approval | boolean | False | The binary field to enforce for merge requests committers' approval. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index dc45189a1..2b3c9e2b3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/message-substring-check@v2 +with: + pattern: "(?i)dghd" + ``` +## Mitigation +Ensure that the specified substring is not found in the message attribute of vulnerabilities for the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the specified substring is not found in the message attribute of vulnerabilities. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/message-substring-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)dghd | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| pattern | string | True | The pattern to search for in the message attribute of vulnerabilities. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 908ecae81..0f272efd9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -32,6 +32,21 @@ uses: gitlab/project/prevent-secrets-check@v2 with: gitlab/project/prevent-secrets-check@v2 ``` +## Mitigation +Ensure that Secrets Prevention is enabled for the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that `prevent_secrets` is enabled for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that `prevent_secrets` is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index 209a1ad6a..fc7983f2d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/protect-ci-secrets@v2 +with: + pattern: "(?i)(token|secret)" + ``` +## Mitigation +Ensure that secrets in the GitLab project are not shared to prevent unauthorized changes. + + +## Description +This rule ensures that secrets in the GitLab project are not shared. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that secrets are not shared. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/protect-ci-secrets@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| pattern | (?i)(token|secret) | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| pattern | string | False | The pattern to match secrets. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 8e1bbc20f..fd3e50efb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -25,8 +25,28 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/push-access-level@v2 +with: + branch: "main" + # access_level: 30 + access_level_description: "Maintainers" + ``` +## Mitigation +Ensure that the GitLab project's push access level complies with requirements to prevent unauthorized changes. + + +## Description +This rule ensures that the GitLab project's push access level complies with requirements. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. For scoped branchs, verifies that the push access level complies with the specified requirements. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,9 +56,10 @@ uses: gitlab/project/push-access-level@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branch | main | -| access_level_description | Maintainers | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| branch | string | False | The branch to enforce push access level policy. | +| access_level | number | False | The access level to enforce for push access level policy. | +| access_level_description | string | False | The access level description to enforce for push access level policy. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 79d93961b..51e8fdbcc 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -32,6 +32,21 @@ uses: gitlab/project/push-rules-set@v2 with: gitlab/project/push-rules-set@v2 ``` +## Mitigation +Ensure that push rules are set for the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that push rules are set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that push rules are set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index ea3280cfd..773d5aaf8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -32,6 +32,21 @@ uses: gitlab/project/reject-unsigned-commits@v2 with: gitlab/project/reject-unsigned-commits@v2 ``` +## Mitigation +Ensure that Reject Unsigned Commits is enabled for the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that `reject_unsigned_commits` is enabled for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that `reject_unsigned_commits` is enabled. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 3012177a7..2390f707c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/require-password-to-approve@v2 +with: + require_password_to_approve: true + ``` +## Mitigation +Ensure that the binary field `require_password_to_approve` is set for the GitLab project to prevent unauthorized approvals. + + + +## Description +This rule ensures that the binary field `require_password_to_approve` is set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the binary field `require_password_to_approve` is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/require-password-to-approve@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| require_password_to_approve | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| require_password_to_approve | boolean | False | The binary field to enforce for requiring password to approve. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index ad9761fb9..76cffe639 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -32,6 +32,21 @@ uses: gitlab/project/required-minimal-approvers@v2 with: gitlab/project/required-minimal-approvers@v2 ``` +## Mitigation +Ensure that the required number of approvers for the GitLab project is met to prevent unauthorized changes. + + +## Description +This rule ensures that the required number of approvers for the GitLab project is met. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the required number of approvers is met. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index a09543ee2..cf36dd65f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/reset-pprovals-on-push@v2 +with: + reset_approvals_on_push: true + ``` +## Mitigation +Ensure that the binary field `reset_approvals_on_push` is set for the GitLab project to prevent unauthorized approvals. + + +## Description +This rule ensures that the binary field `reset_approvals_on_push` is set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the binary field `reset_approvals_on_push` is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/reset-pprovals-on-push@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| reset_approvals_on_push | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| reset_approvals_on_push | boolean | False | The binary field to enforce for resetting approvals on push. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 6d743081a..0c32d48cb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -32,6 +32,22 @@ uses: gitlab/project/sast-scan-pass@v2 with: gitlab/project/sast-scan-pass@v2 ``` +## Mitigation +Ensure that SAST scanning is successful for the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that SAST scanning is successful for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that SAST scanning is successful. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 0e0ac5269..e473ff01d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -32,6 +32,22 @@ uses: gitlab/project/sast-scanning@v2 with: gitlab/project/sast-scanning@v2 ``` +## Mitigation +Ensure that SAST scanning is performed for the GitLab project to prevent unauthorized changes.\ + + + +## Description +This rule ensures that SAST scanning is performed for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that SAST scanning is performed. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index a011cd292..d11d882af 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -32,6 +32,21 @@ uses: gitlab/project/secrets-scan-pass@v2 with: gitlab/project/secrets-scan-pass@v2 ``` +## Mitigation +Ensure that secrets scanning is successful for the GitLab project to prevent unauthorized changes. + + +## Description +This rule ensures that secrets scanning is successful for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that secrets scanning is successful. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index ba35c6d90..1596d8df7 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -32,6 +32,22 @@ uses: gitlab/project/secrets-scanning@v2 with: gitlab/project/secrets-scanning@v2 ``` +## Mitigation +Ensure that secrets scanning is performed for the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that secrets scanning is performed for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that secrets scanning is performed. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 4e991f6ed..63445a0d4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/selective-code-owner-removals@v2 +with: + selective_code_owner_removals: true + ``` +## Mitigation +Ensure that `selective_code_owner_removals` is set for the GitLab project to prevent unauthorized changes. + + + +## Description +This rule ensures that `selective_code_owner_removals` is set for the GitLab project. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that `selective_code_owner_removals` is set. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: gitlab/project/selective-code-owner-removals@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| selective_code_owner_removals | True | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| selective_code_owner_removals | boolean | True | Indicates whether `selective_code_owner_removals` is set for the GitLab project. | diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index aac93c55d..26e563b5e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/visibility-check@v2 +with: + visibility: private + ``` +## Mitigation +Ensure that the GitLab project's visibility matches the required level to prevent unauthorized access. + + +## Description +This rule ensures that the GitLab project's visibility matches the required level. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the visibility level matches the required level. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +54,8 @@ uses: gitlab/project/visibility-check@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=gitlab
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| visibility | private | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| visibility | string | True | The visibility level to enforce for the GitLab project. | From 235bdcac4ac120b61c8e2b262a5f1391c87b7e57 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 16 Mar 2025 15:03:07 +0200 Subject: [PATCH 158/191] update --- .../rules/bitbucket/project/allow-admins.md | 29 +++++++++++++++--- .../rules/bitbucket/project/allow-users.md | 29 +++++++++++++++--- .../bitbucket/project/exposed-credentials.md | 16 ++++++++++ .../bitbucket/project/long-live-tokens.md | 26 +++++++++++++--- .../bitbucket/repository/allow-admins.md | 29 +++++++++++++++--- .../rules/bitbucket/repository/allow-users.md | 29 +++++++++++++++--- .../bitbucket/repository/branch-protection.md | 27 ++++++++++++++--- .../rules/bitbucket/workspace/allow-admins.md | 30 ++++++++++++++++--- .../rules/bitbucket/workspace/allow-users.md | 29 +++++++++++++++--- 9 files changed, 212 insertions(+), 32 deletions(-) diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 3df87c89b..a7737ac63 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -24,8 +24,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/project/allow-admins@v2 +with: + allowed_admins: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have admin privileges in the Bitbucket project to reduce the risk of unauthorized changes. + + +## Description +This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket project. +It performs the following steps: + +1. Checks the settings of the Bitbucket project. +2. Verifies that only users in the Allowed List have admin privileges. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -35,8 +56,8 @@ uses: bitbucket/project/allow-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket project. | diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 77c237ddd..769f805b0 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -24,8 +24,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/project/allow-users@v2 +with: + allowed_users: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have user access to the Bitbucket project to reduce the risk of unauthorized access. + + +## Description +This rule ensures that only users in the Allowed List have user access to the Bitbucket project. +It performs the following steps: + +1. Checks the settings of the Bitbucket project. +2. Verifies that only users in the Allowed List have user access. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -35,8 +56,8 @@ uses: bitbucket/project/allow-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=project | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of users allowed to have user access to the Bitbucket project. | diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 3399698c3..663632c08 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -32,6 +32,22 @@ uses: bitbucket/project/exposed-credentials@v2 with: bitbucket/project/exposed-credentials@v2 ``` +## Mitigation +Ensure that access to the Bitbucket project is blocked if exposed credentials are detected to prevent unauthorized access. + + + +## Description +This rule ensures that access to the Bitbucket project is blocked if exposed credentials are detected. +It performs the following steps: + +1. Checks the settings of the Bitbucket project. +2. Verifies that access is blocked if exposed credentials are detected. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index ae2aa2ea2..db8caf279 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -25,8 +25,26 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/project/long-live-tokens@v2 +with: + max_days: 30 + ``` +## Mitigation +Ensure that Bitbucket API tokens expire before the maximum time to live to reduce the risk of unauthorized access. + + +## Description +This rule ensures that Bitbucket API tokens expire before the maximum time to live. +It performs the following steps: + +1. Checks the settings of the Bitbucket project. +2. Verifies that tokens expire before the maximum time to live. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -35,8 +53,8 @@ uses: bitbucket/project/long-live-tokens@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - asset_type=project
- platform=bitbucket
- platform_instance=bitbucket_dc | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_days | 30 | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| max_days | number | False | Maximum number of days a token can be valid. | diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index 03e5eab98..fae353273 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/repository/allow-admins@v2 +with: + allowed_admins: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have admin privileges in the Bitbucket repository to reduce the risk of unauthorized changes. + + +## Description +This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket repository. +It performs the following steps: + +1. Checks the settings of the Bitbucket repository. +2. Verifies that only users in the Allowed List have admin privileges. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +57,8 @@ uses: bitbucket/repository/allow-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=repository | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket repository. | diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index e8efd9a1a..3a7f805c1 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/repository/allow-users@v2 +with: + allowed_users: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have user access to the Bitbucket repository to reduce the risk of unauthorized access. + + +## Description +This rule ensures that only users in the Allowed List have user access to the Bitbucket repository. +It performs the following steps: + +1. Checks the settings of the Bitbucket repository. +2. Verifies that only users in the Allowed List have user access. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +57,8 @@ uses: bitbucket/repository/allow-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=repository | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of users allowed to have user access to the Bitbucket repository. | diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index 562ade505..ca0cdb7d6 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -25,8 +25,27 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/repository/branch-protection@v2 +with: + branches: + - "main" ``` +## Mitigation +Ensures that the default branch is protected, reducing the risk of unauthorized changes. + + + +## Description +This rule ensures that the default branch protection is enabled in the Bitbucket repository. +It performs the following steps: + +1. Checks the repository settings for default branch protection configuration. +2. Verifies that the configuration matches the expected settings. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository settings. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +55,8 @@ uses: bitbucket/repository/branch-protection@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=repository | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| branches | ['main'] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| branches | array | False | List of branches to verify default branch protection. | diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 437a06062..a06846bad 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -25,8 +25,30 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/workspace/allow-admins@v2 +with: + allowed_admins: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have admin privileges in the Bitbucket workspace to reduce the risk of unauthorized changes. + + + +## Description +This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket workspace. +It performs the following steps: + +1. Checks the settings of the Bitbucket workspace. +2. Verifies that only users in the Allowed List have admin privileges. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +58,8 @@ uses: bitbucket/workspace/allow-admins@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=workspace | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_admins | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_admins | array | False | List of users allowed to have admin privileges in the Bitbucket workspace. | diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index e6fb4ce41..249dcbda6 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -25,8 +25,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/workspace/allow-users@v2 +with: + allowed_users: + - "user1" + - "user2" + - "user3" + ``` +## Mitigation +Ensure that only users in the Allowed List have user access to the Bitbucket workspace to reduce the risk of unauthorized access. + + +## Description +This rule ensures that only users in the Allowed List have user access to the Bitbucket workspace. +It performs the following steps: + +1. Checks the settings of the Bitbucket workspace. +2. Verifies that only users in the Allowed List have user access. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources. + + ## Evidence Requirements | Field | Value | |-------|-------| @@ -36,8 +57,8 @@ uses: bitbucket/workspace/allow-users@v2 | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=bitbucket
- asset_type=workspace | -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allowed_users | [] | +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| allowed_users | array | False | List of users allowed to have user access to the Bitbucket workspace. | From c2edbfec85499a01a78112bd9f8fe29be5c7932f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 17 Mar 2025 13:58:42 +0200 Subject: [PATCH 159/191] remove client id --- .../rules/dockerhub/token-expiration.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../rules/gitlab/api/push-rules.md | 26 +++++++++++++++++-- .../rules/gitlab/api/signed-commits-list.md | 6 ++--- 4 files changed, 29 insertions(+), 7 deletions(-) diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 28c47637d..7da149fb3 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -33,7 +33,7 @@ with: dockerhub/token-expiration@v2 ``` ## Mitigation -Ensure that all Dockerhub tokens are set to Active status in Dockerhub preventing unauthorized access to Dockerhub resources. +Ensure all Dockerhub tokens are set to Active status to prevent unauthorized access. ## Description diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 161826f8d..eb4cbf280 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -34,7 +34,7 @@ with: ``` ## Mitigation -Ensures that branch protection settings are correctly configured, reducing the risk of unauthorized changes. +Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes. diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 7de3e6939..6b0c91dba 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -27,16 +27,38 @@ with: project: my_project push_rule: commit_message_regex: .*hotfix:.* + commit_message_negative_regex: .*fixme.* + branch_name_regex: .*main.* + deny_delete_tag: true member_check: true - max_file_size: 100 prevent_secrets: true - deny_delete_tag: true author_email_regex: .*@example.com file_name_regex: "abc" + max_file_size: 100 commit_committer_name_check: "enabled" reject_unsigned_commits: "enabled" + ``` +## Description +This rule ensures that GitLab push rules are configured via the API. +It performs the following steps: + +1. Checks the settings of the GitLab project. +2. Verifies that the push rules are configured via the API. +2.1 Verifies that the push rules are configured with the proper settings. +2.2 Verifies that the push rules are configured with the proper regular expressions. +2.3 Verifies that the push rules are configured with the proper file size. +2.4 Verifies that the push rules are configured with the proper member check. +2.5 Verifies that the push rules are configured with the proper secrets prevention. +2.6 Verifies that the push rules are configured with the proper tag deletion prevention. +2.7 Verifies that the push rules are configured with the proper author email regular expression. +2.8 Verifies that the push rules are configured with the proper file name regular expression. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. +- GitLab API token must be provided to access the GitLab API. + ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index b2704318b..1f5bc5219 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -27,7 +27,7 @@ uses: gitlab/api/signed-commits-list@v2 ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| commit_id_list | [] | -| private_token | | -| project_id | | +| commit_id_list | ['commit1', 'commit2', 'commit3'] | +| private_token | `{{ .Args.Token }}` | +| project_id | `{{ .Args.ProjectID }}` | From ab6f7b4f25a00af654770f56406f9ac051dc1d59 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 23 Mar 2025 21:40:01 +0200 Subject: [PATCH 160/191] update --- docs/configuration/initiatives/bp1.md | 12 +- docs/configuration/initiatives/index.md | 250 ++++++++--------- .../rules/api/scribe-api-cve-product.md | 5 +- .../initiatives/rules/api/scribe-api-cve.md | 6 +- .../rules/api/scribe-api-published.md | 17 +- .../initiatives/rules/api/scribe-api.md | 2 +- .../rules/bitbucket/project/allow-admins.md | 2 - .../rules/bitbucket/project/allow-users.md | 2 - .../bitbucket/project/exposed-credentials.md | 7 - .../bitbucket/project/long-live-tokens.md | 2 - .../bitbucket/repository/allow-admins.md | 2 - .../rules/bitbucket/repository/allow-users.md | 2 - .../bitbucket/repository/branch-protection.md | 2 - .../rules/bitbucket/workspace/allow-admins.md | 3 - .../rules/bitbucket/workspace/allow-users.md | 2 - .../rules/dockerhub/token-expiration.md | 6 - .../rules/dockerhub/token-not-used.md | 5 - .../rules/generic/artifact-signed.md | 5 - .../rules/generic/evidence-exists.md | 5 - .../rules/generic/k8s-jailbreak.md | 5 - .../initiatives/rules/generic/trivy-exists.md | 5 - .../initiatives/rules/git/artifact-signed.md | 1 - .../rules/git/coding-permissions.md | 2 - .../initiatives/rules/git/evidence-exists.md | 6 - .../rules/git/no-commit-to-main.md | 6 - .../rules/git/no-unsigned-commits.md | 6 - .../rules/github/api/branch-protection.md | 1 - .../rules/github/api/signed-commits-list.md | 1 - .../rules/github/api/signed-commits-range.md | 1 - .../initiatives/rules/github/org/2fa.md | 4 +- .../rules/github/org/advanced-security.md | 10 +- .../rules/github/org/allow-admins.md | 2 - .../rules/github/org/allow-users.md | 3 - .../rules/github/org/create-private-repos.md | 11 +- .../rules/github/org/create-repos.md | 17 +- .../rules/github/org/dependabot-alerts.md | 3 - .../org/dependabot-security-updates-sa.md | 16 +- .../github/org/dependabot-security-updates.md | 9 +- .../rules/github/org/dependency-graph.md | 11 +- .../rules/github/org/max-admins.md | 11 +- .../rules/github/org/old-secrets.md | 3 - .../rules/github/org/pp-custom-link.md | 33 +-- .../rules/github/org/push-protection-sa.md | 15 +- .../rules/github/org/push-protection.md | 9 +- .../rules/github/org/repo-visibility.md | 10 +- .../rules/github/org/secret-scanning-sa.md | 15 +- .../rules/github/org/secret-scanning.md | 20 +- .../rules/github/org/validity-checks-sa.md | 15 +- .../rules/github/org/validity-checks.md | 26 +- .../rules/github/org/web-commit-signoff.md | 8 +- .../github/repository/branch-protection.md | 3 - .../github/repository/branch-verification.md | 4 +- .../github/repository/check-signed-commits.md | 7 - .../repository/default-branch-protection.md | 7 - .../rules/github/repository/dependabot.md | 13 +- .../repository/ephemeral-runners-only.md | 7 - .../rules/github/repository/no-cache-usage.md | 7 - .../rules/github/repository/no-org-secrets.md | 7 - .../rules/github/repository/old-secrets.md | 1 - .../github/repository/push-protection.md | 8 +- .../rules/github/repository/repo-private.md | 7 - .../github/repository/secret-scanning.md | 8 +- .../rules/github/repository/signed-commits.md | 6 - .../github/repository/validity-checks.md | 8 +- .../rules/github/repository/visibility.md | 2 - .../github/repository/web-commit-signoff.md | 6 - .../rules/gitlab/api/push-rules.md | 1 - .../rules/gitlab/api/signed-commits-list.md | 13 +- .../rules/gitlab/api/signed-commits-range.md | 11 +- .../rules/gitlab/org/allow-admins.md | 3 - .../rules/gitlab/org/allow-token-scopes.md | 2 - .../rules/gitlab/org/allow-users.md | 3 - .../rules/gitlab/org/blocked-users.md | 2 - .../rules/gitlab/org/expiring-tokens.md | 2 - .../rules/gitlab/org/forbid-token-scopes.md | 2 - .../rules/gitlab/org/inactive-projects.md | 3 - .../rules/gitlab/org/longlive-tokens.md | 2 - .../rules/gitlab/org/max-admins.md | 2 - .../rules/gitlab/org/projects-visibility.md | 1 - .../rules/gitlab/org/unused-tokens.md | 2 - .../gitlab/pipeline/verify-labels-exist.md | 2 - .../rules/gitlab/pipeline/verify-labels.md | 2 - .../rules/gitlab/project/abandoned-project.md | 2 - .../gitlab/project/approvals-policy-check.md | 3 - .../project/approvers-per-merge-request.md | 4 +- .../gitlab/project/author-email-regex.md | 2 - .../rules/gitlab/project/check-cwe.md | 2 - .../gitlab/project/check-signed-commits.md | 6 - .../gitlab/project/co-approval-required.md | 3 - .../project/commit-author-email-check.md | 2 - .../project/commit-author-name-check.md | 2 - .../gitlab/project/commit-committer-check.md | 7 - .../gitlab/project/commit-message-check.md | 3 - .../rules/gitlab/project/commits-validated.md | 6 - .../gitlab/project/committer-email-check.md | 2 - .../gitlab/project/committer-name-check.md | 3 - .../gitlab/project/critical-severity-limit.md | 2 - .../project/description-substring-check.md | 2 - .../project/disallowed-banned-approvers.md | 2 - .../gitlab/project/force-push-protection.md | 2 - .../gitlab/project/medium-severity-limit.md | 2 - .../rules/gitlab/project/member-check.md | 7 - .../gitlab/project/merge-access-level.md | 5 +- .../project/merge-requests-author-approval.md | 4 +- ...ge-requests-disable-committers-approval.md | 4 +- .../gitlab/project/message-substring-check.md | 2 - .../gitlab/project/prevent-secrets-check.md | 6 - .../gitlab/project/protect-ci-secrets.md | 2 - .../rules/gitlab/project/push-access-level.md | 4 +- .../rules/gitlab/project/push-rules-set.md | 6 - .../gitlab/project/reject-unsigned-commits.md | 6 - .../project/require-password-to-approve.md | 3 - .../project/required-minimal-approvers.md | 6 - .../gitlab/project/reset-pprovals-on-push.md | 2 - .../rules/gitlab/project/sast-scan-pass.md | 7 - .../rules/gitlab/project/sast-scanning.md | 9 +- .../rules/gitlab/project/secrets-scan-pass.md | 6 - .../rules/gitlab/project/secrets-scanning.md | 7 - .../project/selective-code-owner-removals.md | 3 - .../rules/gitlab/project/visibility-check.md | 2 - .../rules/images/allowed-base-image.md | 2 - .../rules/images/allowed-image-source.md | 2 - .../initiatives/rules/images/banned-ports.md | 2 - .../initiatives/rules/images/banned-users.md | 2 - .../rules/images/blocklist-build-scripts.md | 2 - .../rules/images/enforce-https-registry.md | 1 - .../rules/images/forbid-large-images.md | 2 - .../rules/images/fresh-base-image.md | 2 - .../initiatives/rules/images/fresh-image.md | 2 - .../initiatives/rules/images/image-signed.md | 2 - .../rules/images/require-healthcheck.md | 2 - .../rules/images/restrict-shell-entrypoint.md | 12 +- .../rules/images/verify-labels-exist.md | 2 - .../initiatives/rules/images/verify-labels.md | 2 - .../jenkins/folder/exposed-credentials.md | 6 - .../rules/jenkins/instance/inactive-users.md | 2 - .../rules/jenkins/instance/unused-users.md | 6 - .../rules/k8s/namespace/allowed-images.md | 4 +- .../rules/k8s/namespace/allowed-registries.md | 2 - .../namespace/verify-namespace-duration.md | 2 - .../namespace/verify-namespace-termination.md | 2 - .../k8s/namespace/white-listed-namespaces.md | 5 +- .../rules/k8s/namespace/white-listed-pod.md | 5 +- .../rules/k8s/pods/verify-pod-duration.md | 2 - .../rules/k8s/pods/verify-pod-termination.md | 7 - .../rules/k8s/pods/white-listed-pod.md | 2 - .../rules/sarif/artifact-signed.md | 18 +- .../rules/sarif/evidence-exists.md | 6 - .../rules/sarif/patcheck/updates-needed.md | 5 - .../rules/sarif/report-iac-errors.md | 4 +- .../rules/sarif/trivy/blocklist-cve.md | 2 - .../sarif/trivy/report-trivy-iac-errors.md | 4 +- .../rules/sarif/trivy/verify-cve-severity.md | 4 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 - .../rules/sarif/verify-attack-vector.md | 4 +- .../initiatives/rules/sarif/verify-sarif.md | 6 +- .../rules/sarif/verify-semgrep-report.md | 4 +- .../rules/sarif/verify-tool-evidence.md | 8 +- .../initiatives/rules/sbom/NTIA-compliance.md | 3 - .../rules/sbom/allowed-components.md | 7 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 7 +- .../initiatives/rules/sbom/banned-users.md | 41 +++ .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 12 +- .../initiatives/rules/sbom/evidence-exists.md | 42 +++ .../initiatives/rules/sbom/fresh-sbom.md | 4 +- .../initiatives/rules/sbom/require-sbom.md | 7 - .../rules/sbom/required-packages.md | 7 +- .../rules/sbom/verify-huggingface-license.md | 7 +- .../rules/slsa/l1-provenance-exists.md | 5 - .../rules/slsa/l2-provenance-authenticated.md | 1 - .../initiatives/rules/ssdf/ps-1-2fa.md | 22 +- .../rules/ssdf/ps-1-branch-protection.md | 1 - .../rules/ssdf/ps-1-limit-admins.md | 1 - .../rules/ssdf/ps-1-repo-private.md | 1 - .../rules/ssdf/ps-1-web-commit-signoff.md | 1 - .../rules/ssdf/ps-2-image-verifiable.md | 6 - .../rules/ssdf/ps-3.1-code-archived.md | 1 - .../rules/ssdf/ps-3.2-archived-sbom.md | 6 - docs/configuration/initiatives/slsa.l2.md | 1 - docs/configuration/initiatives/sp-800-190.md | 8 +- docs/configuration/initiatives/ssdf.md | 12 +- docs/guides/enforcing-sdlc-initiative.md | 257 ++++++++++-------- 185 files changed, 497 insertions(+), 1042 deletions(-) create mode 100644 docs/configuration/initiatives/rules/sbom/banned-users.md create mode 100644 docs/configuration/initiatives/rules/sbom/evidence-exists.md diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/bp1.md index 93340f10f..173fb9a8e 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/bp1.md @@ -57,7 +57,6 @@ Both host and application-layer access to CI/CD tools should be protected with m > :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -78,7 +77,6 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of > :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -100,7 +98,6 @@ Ensuring that access keys used by automation expire periodically reduces the ris > :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -121,7 +118,6 @@ CI systems should have read access only to source code repositories to limit the > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -146,7 +142,6 @@ Early detection reduces remediation costs, but also requires a well-defined vuln > :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -167,12 +162,11 @@ Before deployment, an artifact’s digest is checked against the expected value > :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity. - ### Rules | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| sbom/evidence-exists@v2 | sbom/evidence-exists@v2 | | +| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | ## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged @@ -188,7 +182,6 @@ Requiring multiple code reviews and successful tests helps ensure that no change > :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -209,7 +202,6 @@ Container images must be scanned before deployment to prevent the inclusion of i > :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -230,7 +222,6 @@ Validating the signature and digest of an artifact ensures that it has not been > :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -251,7 +242,6 @@ Production images should be validated to ensure that controls enforced during ea > :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment. - ### Rules | Rule ID | Rule Name | Rule Description | diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index d948845ef..7b4019948 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -5,12 +5,12 @@ | Name | Description | |------|-------------| +| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | | [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | ## Rules @@ -19,51 +19,53 @@ | Rule Name | Description | |-----------|-------------| -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | | [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | ### Image SBOM **Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | | [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | | [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | | [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | ### Git SBOM **Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | | [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | | [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | ### SARIF Evidence **Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) @@ -71,18 +73,18 @@ | Rule Name | Description | |-----------|-------------| | [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | | [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | | [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | -| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | | [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | | [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | | [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement @@ -90,8 +92,8 @@ | Rule Name | Description | |-----------|-------------| -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | | [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | ### Github Organization Discovery Evidence @@ -99,121 +101,121 @@ | Rule Name | Description | |-----------|-------------| -| [Verify Validity checks are configured and enabled in the GitHub organization.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify Validity checks are configured and enabled in the GitHub organization. | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify Secret Scanning Push Protection Custom Link Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | -| [Verify Secret Scanning Push Protection Enabled in Security and Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is enabled in the security and analysis settings of the GitHub organization. | -| [Create Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify that only allowed users can create repositories in the GitHub organization. | -| [Verify Maximum Number of Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify that the number of admins in the GitHub organization does not exceed the specified maximum. | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify Web Commit Signoff is configured and enabled in the GitHub organization. | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured and enabled in the GitHub organization. | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Ensure Validity Checks are configured and enabled in the GitHub repository. | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | +| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | +| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | | [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | -| [Verify Repository Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify that the repository visibility setting is configured correctly in the GitHub organization. | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | -| [Verify Dependabot Security Updates Enabled for New Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | | [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Verify Dependency Graph Enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify that the dependency graph is enabled in the GitHub organization. | -| [Verify Secret Scanning Push Protection Enabled for New Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | -| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | -| [Create Private Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify that only allowed users can create private repositories in the GitHub organization. | | [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify Dependabot Security Updates Setting in Security and Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Ensure `secret_scanning` is configured and enabled in the GitHub repository. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | ### Github Repository Discovery Evidence **Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | -| [Verify Dependabot Security Updates Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | | [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | | [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both Secret Scanning Validity Checks and Security and Analysis Setting are configured in the GitHub organization and all the repositories. | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | | [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | | [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify Secret Scanning Push Protection Setting is configured in the GitHub repository. | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | | [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify Secret Scanning Setting is configured in the GitHub repository. | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence **Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | | [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | | [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | | [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | | [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | ### Gitlab Project Discovery Evidence **Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project. | | [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify Merge Requests Disable Committers Approval is set for the GitLab project. | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | | [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | | [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | | [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field Merge Requests Author Approval is set for the GitLab project. | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | | [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | | [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | | [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | | [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | | [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | ### K8s Namespace Discovery Evidence **Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | | [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | | [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence @@ -221,8 +223,8 @@ | Rule Name | Description | |-----------|-------------| -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | ### Bitbucket Project Discovery Evidence @@ -231,35 +233,35 @@ | Rule Name | Description | |-----------|-------------| | [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | | [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | ### Bitbucket Repository Discovery Evidence **Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | | [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | | [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | ### Bitbucket Workspace Discovery Evidence **Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | | [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | ### Discovery Evidence **Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) | Rule Name | Description | |-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | | [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | ### Dockerhub Project Discovery Evidence **Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) @@ -283,30 +285,30 @@ | Rule Name | Description | |-----------|-------------| | [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | | [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | | [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | ### Statement **Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Sign Commits in Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the commits in a specified range are signed in the GitLab organization. | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | | [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | | [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | | [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | | [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index ea097106e..013c9e460 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -15,7 +15,7 @@ Verify via Scribe API that there no critical or high severity vulnerabilities in Evidence **IS NOT** required for this rule. ::: :::tip -Rule requires the Scribe API to be enabled. +Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. @@ -34,9 +34,8 @@ Ensure that all critical or high severity vulnerabilities are addressed before d ## Description This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. - ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| cve | list | False | List of CVEs to check against the product components. | +| cve | array | True | List of CVEs to check against the product components. | diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 5eea032db..2658ceca7 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -11,11 +11,8 @@ title: Verify No Critical or High Vulnerabilities Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). -:::note -Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. -::: :::tip -Rule requires the Scribe API to be enabled. +Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -45,7 +42,6 @@ Ensure that all critical or high severity vulnerabilities are addressed before d ## Description This rule ensures that there are no critical or high severity vulnerabilities in any deliverable component of the product by verifying via the Scribe API. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/api/scribe-api-published.md b/docs/configuration/initiatives/rules/api/scribe-api-published.md index cef94dc1b..58091e9d7 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-published.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-published.md @@ -11,11 +11,8 @@ title: Scribe Published Policy Verify image Scribe Publish flag is set for container image. -:::note -Rule Uses Scribe API to check for CVEs in the target artifact, Ensure usage of Scribe Token in the environment. -::: :::tip -Rule requires the Scribe API to be enabled. +Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -28,9 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: api/scribe-api-published@v2 -with: - superset: - published: true ``` ## Mitigation @@ -40,15 +34,14 @@ Ensure that all critical or high severity vulnerabilities are addressed before d ## Description This rule ensures that the product is published only after all critical or high severity vulnerabilities are addressed. - ## Evidence Requirements | Field | Value | |-------|-------| | signed | False | | content_body_type | cyclonedx-json | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| superset | object | False | The superset of CVEs to check for, including the following format [published: [flag: bool]] | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| superset | `{'published': None}` | diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index caf804aeb..77616e83a 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -11,7 +11,7 @@ title: Apply Scribe Template Policy Verify XX using the Scribe API template rule. :::tip -Rule requires the Scribe API to be enabled. +Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index a7737ac63..33a2bbf74 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -29,7 +29,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 769f805b0..538e7c39d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -29,7 +29,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 663632c08..68b1d2eb3 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: bitbucket/project/exposed-credentials@v2 - -## Usage example - -```yaml -with: bitbucket/project/exposed-credentials@v2 ``` ## Mitigation Ensure that access to the Bitbucket project is blocked if exposed credentials are detected to prevent unauthorized access. - ## Description This rule ensures that access to the Bitbucket project is blocked if exposed credentials are detected. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index db8caf279..2cc57054e 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: bitbucket/project/long-live-tokens@v2 with: max_days: 30 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index fae353273..b68c8403e 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -30,7 +30,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index 3a7f805c1..be9a18261 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -30,7 +30,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index ca0cdb7d6..d4f3b7847 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -34,7 +34,6 @@ with: Ensures that the default branch is protected, reducing the risk of unauthorized changes. - ## Description This rule ensures that the default branch protection is enabled in the Bitbucket repository. It performs the following steps: @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index a06846bad..9bfe4cf30 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -30,14 +30,12 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation Ensure that only users in the Allowed List have admin privileges in the Bitbucket workspace to reduce the risk of unauthorized changes. - ## Description This rule ensures that only users in the Allowed List have admin privileges in the Bitbucket workspace. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 249dcbda6..9b657f460 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -30,7 +30,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Bitbucket workspace resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 7da149fb3..676debc6a 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: dockerhub/token-expiration@v2 - -## Usage example - -```yaml -with: dockerhub/token-expiration@v2 ``` ## Mitigation @@ -47,7 +42,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Dockerhub resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 88c81fe10..89483d5ef 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: dockerhub/token-not-used@v2 - -## Usage example - -```yaml -with: dockerhub/token-not-used@v2 ``` ## Description diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 9a20985c9..5c5e18bff 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -28,11 +28,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/artifact-signed@v2 - -## Usage example - -```yaml -with: generic/artifact-signed@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 6f20f76be..35e2b42d6 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -28,11 +28,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/evidence-exists@v2 - -## Usage example - -```yaml -with: generic/evidence-exists@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 528e787b1..61c4f1af0 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/k8s-jailbreak@v2 - -## Usage example - -```yaml -with: generic/k8s-jailbreak@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 5dd7b8eb2..1cfdda67b 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -24,11 +24,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: generic/trivy-exists@v2 - -## Usage example - -```yaml -with: generic/trivy-exists@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 0f8571afb..8e31b26e0 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -44,7 +44,6 @@ with: Ensure that only Git artifacts with valid cryptographic signatures are deployed to prevent source code tampering. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index 8044f0f80..ea0e8453f 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -34,7 +34,6 @@ uses: git/coding-permissions@v2 Prevent unauthorized users from committing to the repository by restricting commit permissions to allowed users only. - ## Description This rule verifies that only allowed users have committed to the repository. It performs the following steps: @@ -48,7 +47,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index cbef8c0bd..973c567aa 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -31,18 +31,12 @@ Rule is scoped by product and target. ```yaml uses: git/evidence-exists@v2 - -## Usage example - -```yaml -with: git/evidence-exists@v2 ``` ## Mitigation By confirming that all required evidence exists, this rule guarantees that a Source Code Bill of Materials (SBOM) is fully represented as evidence. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 433f0f81c..307164d6a 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -28,11 +28,6 @@ Rule is scoped by product and target. ```yaml uses: git/no-commit-to-main@v2 - -## Usage example - -```yaml -with: git/no-commit-to-main@v2 ``` ## Mitigation @@ -50,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Git repository resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index ac1fe583c..6144d5a67 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -28,11 +28,6 @@ Rule is scoped by product and target. ```yaml uses: git/no-unsigned-commits@v2 - -## Usage example - -```yaml -with: git/no-unsigned-commits@v2 ``` ## Mitigation @@ -51,7 +46,6 @@ It performs the following steps: - The Source SBOM should include a `metadata.component.properties` array containing properties that identify base images. - The Source SBOM (Software Bill of Materials) must include the `PGPSignature` property for each commit Component. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 92ae26bf1..12552ec0a 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -78,7 +78,6 @@ It performs the following steps: - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - Github API token must be provided to access the GitHub API. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index 570667037..ebf40eb64 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -28,7 +28,6 @@ with: - "22222225644ea629569e6a3c98c8375222222" access_token: '{{ .Args.Token }}' owner: my_owner - ``` ## Description diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index 11fb457f4..9d0b7093a 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -31,7 +31,6 @@ with: since: "2021-01-01T00:00:00Z" until: "2021-01-31T23:59:59Z" sha: "11111115644ea629569e6a3c98c8375111111" - ``` ## Description diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index cdab61dd3..d46688c3f 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -31,7 +31,6 @@ uses: github/org/2fa@v2 Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - ## Description This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the @@ -46,7 +45,6 @@ layer of security against unauthorized access. - The data should come from a trusted source (e.g., a GitHub organization scan). - The evidence must clearly indicate whether 2FA is enabled. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -59,5 +57,5 @@ layer of security against unauthorized access. ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| desired_value | False | +| desired_value | True | diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 81286805f..4cb83b787 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify advanced security setting is enabled -title: Verify advanced security setting is enabled +sidebar_label: Verify `advanced_security_enabled_for_new_repositories` setting +title: Verify `advanced_security_enabled_for_new_repositories` setting --- -# Verify advanced security setting is enabled +# Verify `advanced_security_enabled_for_new_repositories` setting **Type:** Rule **ID:** `github-org-advanced-security` **Source:** [v2/rules/github/org/advanced-security.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.yaml) **Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) **Labels:** GitHub, Organization -Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. +Verify `advanced_security` is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -33,7 +33,6 @@ with: Enforces advanced security for new repositories in the organization, significantly reducing the risk of introducing vulnerabilities or unapproved software. - ## Description This rule verifies that advanced security is enabled for new repositories in the GitHub organization by examining the provided Discovery evidence. It checks the organization's details and compares the value of the @@ -46,7 +45,6 @@ introducing vulnerabilities or unapproved software. ### **Evidence Requirements** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index c5b1eba93..e241d4aca 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -36,7 +36,6 @@ with: Ensures that only approved users have admin privileges in the GitHub organization, reducing the risk of unauthorized access through compromised credentials. - ## Description This rule verifies that only users in the Allowed List have admin privileges in the GitHub organization. It checks the organization's details and compares the value of the @@ -48,7 +47,6 @@ the desired value, a violation is recorded. This ensures that only users in the ### **Evidence Requirements** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 63a735ff1..2a3c43722 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -29,14 +29,12 @@ with: allowed_users: - "user1" - "user2" - ``` ## Mitigation Ensures that only approved users have access to the GitHub organization, reducing the risk of unauthorized access. - ## Description This rule ensures that only users specified in the allowed list have access to the GitHub organization. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 7ec3c64b1..7a15a2a19 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -1,15 +1,15 @@ --- -sidebar_label: Create Private Repositories -title: Create Private Repositories +sidebar_label: Verify members_can_create_private_repositories setting +title: Verify members_can_create_private_repositories setting --- -# Create Private Repositories +# Verify members_can_create_private_repositories setting **Type:** Rule **ID:** `github-org-create-private-repos` **Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) **Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization -Verify that only allowed users can create private repositories in the GitHub organization. +Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -29,14 +29,12 @@ with: allowed_users: - "user1" - "user2" - ``` ## Mitigation Ensures that only approved users can create private repositories in the GitHub organization, reducing the risk of unauthorized repository creation. - ## Description This rule ensures that only users specified in the allowed list can create private repositories in the GitHub organization. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index c77c26e42..83a91cff8 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -1,15 +1,15 @@ --- -sidebar_label: Create Repositories -title: Create Repositories +sidebar_label: Verify members_can_create_repositories setting +title: Verify members_can_create_repositories setting --- -# Create Repositories +# Verify members_can_create_repositories setting **Type:** Rule **ID:** `github-org-create-repos` **Source:** [v2/rules/github/org/create-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.yaml) **Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization -Verify that only allowed users can create repositories in the GitHub organization. +Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -26,17 +26,13 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/create-repos@v2 with: - allowed_users: - - "user1" - - "user2" - + desired_value: false ``` ## Mitigation Ensures that only approved users can create repositories in the GitHub organization, reducing the risk of unauthorized repository creation. - ## Description This rule ensures that only users specified in the allowed list can create repositories in the GitHub organization. It performs the following steps: @@ -48,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -61,5 +56,5 @@ It performs the following steps: ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| allowed_users | array | False | List of allowed users. | +| desired_value | boolean | False | The desired value for the `members_can_create_repositories` setting. | diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index a32fcaa03..fc00cb9fc 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/dependabot-alerts@v2 with: desired_value: true - ``` ## Mitigation Ensures that Dependabot alerts are enabled for new repositories in the GitHub organization, helping to identify and address vulnerabilities in dependencies. - ## Description This rule verifies that Dependabot alerts for new repositories are enabled in the GitHub organization. It performs the following steps: @@ -46,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index d7dc0f002..75ab66e23 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Dependabot Security Updates Setting in Security and Analysis -title: Verify Dependabot Security Updates Setting in Security and Analysis +sidebar_label: Verify dependabot_security_updates setting in security_and_analysis +title: Verify dependabot_security_updates setting in security_and_analysis --- -# Verify Dependabot Security Updates Setting in Security and Analysis +# Verify dependabot_security_updates setting in security_and_analysis **Type:** Rule **ID:** `github-org-dependabot-security-updates-sa` **Source:** [v2/rules/github/org/dependabot-security-updates-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates-sa.yaml) @@ -25,16 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/dependabot-security-updates-sa@v2 -with: - dependabot_security_updates: true - ``` ## Mitigation Ensures that Dependabot security updates are enabled in the GitHub organization, reducing the risk of vulnerabilities in dependencies. - ## Description This rule ensures that Dependabot security updates are enabled in the GitHub organization. It performs the following steps: @@ -45,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -55,8 +50,3 @@ It performs the following steps: | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| dependabot_security_updates | boolean | False | Indicates if Dependabot security updates are enabled. | - diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 1b42a193f..8aaf34c7d 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Dependabot Security Updates Enabled for New Repositories Setting -title: Verify Dependabot Security Updates Enabled for New Repositories Setting +sidebar_label: Verify dependabot_security_updates_enabled_for_new_repositories setting +title: Verify dependabot_security_updates_enabled_for_new_repositories setting --- -# Verify Dependabot Security Updates Enabled for New Repositories Setting +# Verify dependabot_security_updates_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependabot-security-updates` **Source:** [v2/rules/github/org/dependabot-security-updates.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependabot-security-updates.yaml) @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/dependabot-security-updates@v2 with: desired_value: true - ``` ## Mitigation Ensures that Dependabot security updates are enabled for new repositories in the GitHub organization, reducing the risk of vulnerabilities in dependencies. - ## Description This rule ensures that Dependabot security updates are enabled for new repositories in the GitHub organization. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index f9cb78a96..1d5f53b2e 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Dependency Graph Enabled -title: Verify Dependency Graph Enabled +sidebar_label: Verify dependency_graph_enabled_for_new_repositories setting +title: Verify dependency_graph_enabled_for_new_repositories setting --- -# Verify Dependency Graph Enabled +# Verify dependency_graph_enabled_for_new_repositories setting **Type:** Rule **ID:** `github-org-dependency-graph` **Source:** [v2/rules/github/org/dependency-graph.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.yaml) **Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization -Verify that the dependency graph is enabled in the GitHub organization. +Verify `dependency_graph` is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/dependency-graph@v2 with: desired_value: true - ``` ## Mitigation Ensures that the dependency graph is enabled in the GitHub organization, providing better visibility into dependencies and potential vulnerabilities. - ## Description This rule ensures that the dependency graph is enabled in the GitHub organization. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 10b4e7393..514ae87a8 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Maximum Number of Admins -title: Verify Maximum Number of Admins +sidebar_label: Limit Admin Number in GitHub Organization +title: Limit Admin Number in GitHub Organization --- -# Verify Maximum Number of Admins +# Limit Admin Number in GitHub Organization **Type:** Rule **ID:** `github-org-max-admins` **Source:** [v2/rules/github/org/max-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.yaml) **Rego Source:** [max-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/max-admins.rego) **Labels:** GitHub, Organization -Verify that the number of admins in the GitHub organization does not exceed the specified maximum. +Verify the maximum number of GitHub organization admins is restricted. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/max-admins@v2 with: max_admins: 5 - ``` ## Mitigation Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions. - ## Description This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index 9be0b9b3c..b471114c6 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/old-secrets@v2 with: max_secret_age: 12 - ``` ## Mitigation Ensures that old secrets are removed from the GitHub organization, reducing the risk of exposure of outdated and potentially compromised secrets. - ## Description This rule ensures that secrets in the GitHub organization are not older than the specified threshold. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index ffb39f41b..89ff86260 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Secret Scanning Push Protection Custom Link Enabled Setting -title: Verify Secret Scanning Push Protection Custom Link Enabled Setting +sidebar_label: Verify `secret_scanning_push_protection_custom_link_enabled` Setting +title: Verify `secret_scanning_push_protection_custom_link_enabled` Setting --- -# Verify Secret Scanning Push Protection Custom Link Enabled Setting +# Verify `secret_scanning_push_protection_custom_link_enabled` Setting **Type:** Rule **ID:** `github-org-pp-custom-link` **Source:** [v2/rules/github/org/pp-custom-link.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.yaml) @@ -25,27 +25,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/pp-custom-link@v2 -with: - desired_value: true - ``` -## Mitigation -Ensure that the secret scanning push protection custom link is enabled to provide better security for secret scanning in the GitHub organization. - - - -## Description -This rule ensures that the secret scanning push protection custom link is enabled in the GitHub organization. -It performs the following steps: - -1. Checks the settings of the GitHub organization. -2. Verifies that the secret scanning push protection custom link setting is enabled. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -55,8 +36,8 @@ It performs the following steps: | predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | | labels | - platform=github
- asset_type=organization | -## Input Definitions -| Parameter | Type | Required | Description | -|-----------|------|----------|-------------| -| desired_value | boolean | False | Indicates if the secret scanning push protection custom link is enabled. | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| desired_value | True | diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 47499d402..e9385c45d 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Secret Scanning Push Protection Enabled in Security and Analysis -title: Verify Secret Scanning Push Protection Enabled in Security and Analysis +sidebar_label: Verify `secret_scanning_push_protection` Setting +title: Verify `secret_scanning_push_protection` Setting --- -# Verify Secret Scanning Push Protection Enabled in Security and Analysis +# Verify `secret_scanning_push_protection` Setting **Type:** Rule **ID:** `github-org-push-protection-sa` **Source:** [v2/rules/github/org/push-protection-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.yaml) **Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_push_protection` is enabled in the security and analysis settings of the GitHub organization. +Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/push-protection-sa@v2 - -## Usage example - -```yaml -with: github/org/push-protection-sa@v2 ``` ## Mitigation Ensure that secret scanning push protection is enabled to provide better security for secret scanning in the GitHub organization. - ## Description This rule ensures that secret scanning push protection is enabled in the security and analysis settings of the GitHub organization. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index faea71eb4..cc451052e 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -1,9 +1,9 @@ --- -sidebar_label: Verify Secret Scanning Push Protection Enabled for New Repositories +sidebar_label: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting -title: Verify Secret Scanning Push Protection Enabled for New Repositories Setting +title: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting --- -# Verify Secret Scanning Push Protection Enabled for New Repositories Setting +# Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting **Type:** Rule **ID:** `github-org-push-protection` **Source:** [v2/rules/github/org/push-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.yaml) @@ -28,14 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/push-protection@v2 with: desired_value: true - ``` ## Mitigation Ensures that secret scanning push protection is enabled for new repositories in the GitHub organization, providing better security for secret scanning. - ## Description This rule ensures that secret scanning push protection is enabled for new repositories in the GitHub organization. It performs the following steps: @@ -46,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 8d5214e85..2cefacaff 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Repository Visibility Setting -title: Verify Repository Visibility Setting +sidebar_label: Verify Repo Visibility Setting +title: Verify Repo Visibility Setting --- -# Verify Repository Visibility Setting +# Verify Repo Visibility Setting **Type:** Rule **ID:** `github-org-repo-visibility` **Source:** [v2/rules/github/org/repo-visibility.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.yaml) **Rego Source:** [repo-visibility.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/repo-visibility.rego) **Labels:** GitHub, Organization -Verify that the repository visibility setting is configured correctly in the GitHub organization. +Verify only repositories in the Allowed List are public in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -35,7 +35,6 @@ with: Ensure that the repository visibility setting is configured correctly to reduce the risk of unauthorized access to repositories. - ## Description This rule ensures that the repository visibility setting is configured correctly in the GitHub organization. It performs the following steps: @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 7b3a1d21f..e56515aff 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Secret_Scanning Setting in Security_And_Analysis -title: Verify Secret_Scanning Setting in Security_And_Analysis +sidebar_label: Verify `secret_scanning` Setting in `security_and_analysis` +title: Verify `secret_scanning` Setting in `security_and_analysis` --- -# Verify Secret_Scanning Setting in Security_And_Analysis +# Verify `secret_scanning` Setting in `security_and_analysis` **Type:** Rule **ID:** `github-org-secret-scanning-sa` **Source:** [v2/rules/github/org/secret-scanning-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.yaml) **Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning` is configured and enabled in the GitHub organization. +Verify `secret_scanning` is configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/secret-scanning-sa@v2 - -## Usage example - -```yaml -with: github/org/secret-scanning-sa@v2 ``` ## Mitigation Ensure that the Secret Scanning setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories, enhancing security. - ## Description This rule checks if the `secret_scanning` setting is enabled to detect and prevent the exposure of secrets in the organization’s repositories. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index 3ffd87ce8..b24e4f913 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -9,7 +9,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization -Ensure `secret_scanning` is configured and enabled in the GitHub repository. +Verify `secret_scanning` is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,22 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/secret-scanning@v2 ``` -## Mitigation -Ensure that the Secret scanning setting is enabled to detect and prevent the exposure of secrets in the repository, enhancing security. - - - -## Description -This rule ensures that `secret_scanning` is enabled to detect and prevent the exposure of secrets in the repository. -It performs the following steps: - -1. Checks the secret scanning settings of the GitHub repository. -2. Verifies that the secret scanning setting is enabled. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -55,5 +39,5 @@ It performs the following steps: ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| desired_value | False | +| desired_value | True | diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 6eb9f94ce..f94d06d01 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Validity checks are configured and enabled in the GitHub organization. -title: Verify Validity checks are configured and enabled in the GitHub organization. +sidebar_label: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis` +title: Verify `secret_scanning_validity_checks` Setting in `security_and_analysis` --- -# Verify Validity checks are configured and enabled in the GitHub organization. +# Verify `secret_scanning_validity_checks` Setting in `security_and_analysis` **Type:** Rule **ID:** `github-org-validity-checks-sa` **Source:** [v2/rules/github/org/validity-checks-sa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.yaml) **Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization -Verify Validity checks are configured and enabled in the GitHub organization. +Verify `secret_scanning_validity_checks` is configured in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/validity-checks-sa@v2 - -## Usage example - -```yaml -with: github/org/validity-checks-sa@v2 ``` ## Mitigation Ensure that the Validity checks under GitHub organization setting is enabled to maintain the integrity of the organization’s repositories, preventing potential issues and vulnerabilities. - ## Description This rule checks if the `validity_checks` under GitHub organization setting is enabled to ensure the integrity of the organization’s repositories. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index d368a4c49..8fd03dbee 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify Secret_Scanning_Validity_Checks_Enabled Setting -title: Verify Secret_Scanning_Validity_Checks_Enabled Setting +sidebar_label: Verify `secret_scanning_validity_checks_enabled` Setting +title: Verify `secret_scanning_validity_checks_enabled` Setting --- -# Verify Secret_Scanning_Validity_Checks_Enabled Setting +# Verify `secret_scanning_validity_checks_enabled` Setting **Type:** Rule **ID:** `github-org-validity-checks` **Source:** [v2/rules/github/org/validity-checks.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.yaml) **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization -Ensure Validity Checks are configured and enabled in the GitHub repository. +Verify `secret_scanning_validity_checks` is configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -27,22 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: github/org/validity-checks@v2 ``` -## Mitigation -Ensure that the Validity Checks under Github Repository setting is enabled to validate the integrity of the repository, preventing potential issues and vulnerabilities. - - - -## Description -This rule ensures that are enabled to validate the integrity of the repository. -It performs the following steps: - -1. Checks the validity checks settings of the GitHub repository. -2. Verifies that the validity checks setting is enabled. - -**Evidence Requirements:** -- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. - - ## Evidence Requirements | Field | Value | |-------|-------| @@ -55,5 +39,5 @@ It performs the following steps: ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| desired_value | False | +| desired_value | True | diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index d0e154d79..f9873966a 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -9,7 +9,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits **Rego Source:** [web-commit-signoff.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/web-commit-signoff.rego) **Labels:** GitHub, Organization -Verify Web Commit Signoff is configured and enabled in the GitHub organization. +Verify contributors sign commits through the GitHub web interface. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/org/web-commit-signoff@v2 - -## Usage example - -```yaml -with: github/org/web-commit-signoff@v2 ``` ## Mitigation Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability. - ## Description This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index eb4cbf280..7cc969dd8 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -30,14 +30,12 @@ with: branches: - 'main' - 'master' - ``` ## Mitigation Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes. - ## Description This rule ensures that branch protection is configured in the GitHub repository. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index d9331da38..41ba68ac2 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -31,7 +31,6 @@ uses: github/repository/branch-verification@v2 Ensures that branch verification settings are correctly configured, reducing the risk of unauthorized changes. - ## Description This rule ensures that branch verification in the GitHub repository matches the value defined in the configuration file. It performs the following steps: @@ -42,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -55,5 +53,5 @@ It performs the following steps: ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| desired_verified | False | +| desired_verified | True | diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index da8e42bac..49092cd5e 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/check-signed-commits@v2 - -## Usage example - -```yaml -with: github/repository/check-signed-commits@v2 ``` ## Mitigation Ensures that all commits are signed, reducing the risk of unauthorized changes. - ## Description This rule ensures that all commits in the GitHub repository are signed. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository commits. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 913b0a2f5..7b218d538 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/default-branch-protection@v2 - -## Usage example - -```yaml -with: github/repository/default-branch-protection@v2 ``` ## Mitigation Ensures that the default branch is protected, reducing the risk of unauthorized changes. - ## Description This rule ensures that the default branch protection is configured in the GitHub repository. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 0ea0ad835..5f3864c1d 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Dependabot Security Updates Setting -title: Verify Dependabot Security Updates Setting +sidebar_label: Verify Dependabot security updates setting +title: Verify Dependabot security updates setting --- -# Verify Dependabot Security Updates Setting +# Verify Dependabot security updates setting **Type:** Rule **ID:** `github-repo-dependabot` **Source:** [v2/rules/github/repository/dependabot.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/dependabot.yaml) @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/dependabot@v2 - -## Usage example - -```yaml -with: github/repository/dependabot@v2 ``` ## Mitigation Ensures that Dependabot security updates are enabled, reducing the risk of vulnerabilities in dependencies. - ## Description This rule ensures that Dependabot security updates are configured in the GitHub repository. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index d7b20d9ab..960486aa3 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/ephemeral-runners-only@v2 - -## Usage example - -```yaml -with: github/repository/ephemeral-runners-only@v2 ``` ## Mitigation Ensures that only ephemeral runners are used, reducing the risk of persistent runner vulnerabilities. - ## Description This rule ensures that only ephemeral runners are used in the GitHub repository. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 98438ad43..5733c665c 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/no-cache-usage@v2 - -## Usage example - -```yaml -with: github/repository/no-cache-usage@v2 ``` ## Mitigation Ensures that no cache is used, reducing the risk of outdated or insecure dependencies. - ## Description This rule ensures that no cache is used in the GitHub repository. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index 07a89c7f5..d202d64f5 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/no-org-secrets@v2 - -## Usage example - -```yaml -with: github/repository/no-org-secrets@v2 ``` ## Mitigation Ensures that no organization secrets are used, reducing the risk of unauthorized access. - ## Description This rule ensures that no organization secrets are used in the GitHub repository. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index a44c824b8..11a2818cb 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -41,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 08fdaba10..37aba58b5 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -9,7 +9,7 @@ title: Verify Push Protection Setting **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/push-protection.rego) **Labels:** GitHub, Repository -Verify Secret Scanning Push Protection Setting is configured in the GitHub repository. +Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/push-protection@v2 - -## Usage example - -```yaml -with: github/repository/push-protection@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index 1e1ae5514..f8d41c763 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/repo-private@v2 - -## Usage example - -```yaml -with: github/repository/repo-private@v2 ``` ## Mitigation Ensures that the repository is private, reducing the risk of unauthorized access. - ## Description This rule ensures that the GitHub repository is private. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 8046012c7..18a31d703 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -9,7 +9,7 @@ title: Verify secret_scanning setting **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/secret-scanning.rego) **Labels:** GitHub, Repository -Verify Secret Scanning Setting is configured in the GitHub repository. +Verify `secret_scanning` is configured in the GitHub repository. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/secret-scanning@v2 - -## Usage example - -```yaml -with: github/repository/secret-scanning@v2 ``` ## Mitigation Ensures that Secret Scanning is configured, reducing the risk of leaking sensitive information. - ## Description This rule ensures that the `secret_scanning` is configured in the GitHub repository. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index 353729a3b..d5840ee01 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/signed-commits@v2 - -## Usage example - -```yaml -with: github/repository/signed-commits@v2 ``` ## Mitigation Ensures that all commits are signed, reducing the risk of unauthorized changes. - ## Description This rule ensures that all commits in the GitHub repository are signed. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 557a124ff..531d1ef96 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -9,7 +9,7 @@ title: Verify secret scanning. **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/validity-checks.rego) **Labels:** GitHub, Repository -Verify both Secret Scanning Validity Checks and Security and Analysis Setting are configured in the GitHub organization and all the repositories. +Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/validity-checks@v2 - -## Usage example - -```yaml -with: github/repository/validity-checks@v2 ``` ## Mitigation Ensure that the validity checks are set in the GitHub organization and all the repositories. - ## Description This rule ensures that both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 490b48175..0d9ddb3eb 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -29,14 +29,12 @@ with: allowed_repo_names: - my-org/.* - my-org/my-repo.* - ``` ## Mitigation Ensures that only allowed repositories are public, reducing the risk of unauthorized access. - ## Description This rule ensures that only GitHub repositories in the Allowed List are public. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 2ed629463..77cc2432a 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: github/repository/web-commit-signoff@v2 - -## Usage example - -```yaml -with: github/repository/web-commit-signoff@v2 ``` ## Mitigation Ensure that the repository requires signoff on all commits made through the GitHub web interface, enhancing security and accountability. - ## Description This rule checks if the repository requires signoff on all commits made through the GitHub web interface. It performs the following steps: diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index 6b0c91dba..ed920bec2 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -37,7 +37,6 @@ with: max_file_size: 100 commit_committer_name_check: "enabled" reject_unsigned_commits: "enabled" - ``` ## Description diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 1f5bc5219..9856be44f 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -22,12 +22,19 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/api/signed-commits-list@v2 +with: + commit_id_list: + - 'commit1' + - 'commit2' + - 'commit3' + private_token: {{ .Args.Token }} + project_id: {{ .Args.ProjectID }} ``` ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| commit_id_list | ['commit1', 'commit2', 'commit3'] | -| private_token | `{{ .Args.Token }}` | -| project_id | `{{ .Args.ProjectID }}` | +| commit_id_list | [] | +| private_token | | +| project_id | | diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 4dd2c4f3a..341ba70a7 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -1,15 +1,15 @@ --- -sidebar_label: Sign Commits in Range in GitLab -title: Sign Commits in Range in GitLab +sidebar_label: Sign Selected Commit Range in GitLab +title: Sign Selected Commit Range in GitLab --- -# Sign Commits in Range in GitLab +# Sign Selected Commit Range in GitLab **Type:** Rule **ID:** `gitlab-api-signed-commits-range` **Source:** [v2/rules/gitlab/api/signed-commits-range.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.yaml) **Rego Source:** [signed-commits-range.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/api/signed-commits-range.rego) **Labels:** Gitlab, API -Verify the commits in a specified range are signed in the GitLab organization. +Verify the selected range of commits is signed via the GitLab API. :::tip Evidence **IS NOT** required for this rule. @@ -27,14 +27,12 @@ with: until: "2021-01-31T23:59:59Z" project_id: my_project_id private_token: '{{ .Args.Token }}' - ``` ## Mitigation Ensure that the commits in the specified time range are signed in the GitLab repository. - ## Description This rule ensures that the commits in the specified time range are signed in the GitLab repository. It performs the following steps: @@ -47,7 +45,6 @@ It performs the following steps: - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab repository resources. - GitLab API token must be provided to access the GitLab API. - ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 255828856..745f211b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -30,14 +30,12 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation Ensure that only users in the Allowed List have admin privileges in the GitLab organization to reduce the risk of unauthorized changes. - ## Description This rule ensures that only users in the Allowed List have admin privileges in the GitLab organization. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index b436d9c3a..eda5c397a 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -31,7 +31,6 @@ with: - read_api - read_repository - read_registry - ``` ## Description @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index ef49575d5..d507e4271 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -30,14 +30,12 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation Ensure that only users in the Allowed List have access to the GitLab organization to reduce the risk of unauthorized access. - ## Description This rule ensures that only users in the Allowed List have access to the GitLab organization. It performs the following steps: @@ -48,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index ac749f642..359ab1c17 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -30,7 +30,6 @@ with: - "user1" - "user2" - "user3" - ``` ## Mitigation @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index a87eaf94a..6b2a86754 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/org/expiring-tokens@v2 with: exiring_in_days: 30 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index 01cd76730..c46b3e2c8 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -29,7 +29,6 @@ with: project_scopes: - write_api - write_repository - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index a2086b1ee..099353af5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/org/inactive-projects@v2 with: inactive_for_days: 90 - ``` ## Mitigation Ensure that no GitLab organization projects are inactive to prevent service disruption. - ## Description This rule ensures that no GitLab organization projects are inactive. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index bb87e4efe..198fe2a9d 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/org/longlive-tokens@v2 with: exiring_in_days: 365 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 7d27042cb..9ded2a929 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/org/max-admins@v2 with: max_admins: 0 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 045578902..39e99487e 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -29,7 +29,6 @@ with: allowed_public: - "Learn GitLab" - "Scribe Gitlab Test" - ``` ## Description diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index b792615bf..7d2d36778 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/org/unused-tokens@v2 with: unused_for_days: 90 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab organization resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index c5ee6e031..7d6a7bc74 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -28,7 +28,6 @@ uses: gitlab/pipeline/verify-labels-exist@v2 with: labels: - "app.kubernetes.io/instance" - ``` ## Mitigation @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index 8197f7b08..98db27834 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -28,7 +28,6 @@ uses: gitlab/pipeline/verify-labels@v2 with: labels: app.kubernetes.io/instance: "defaul1t" - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab pipeline resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index ff3acb94a..6f377e608 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/abandoned-project@v2 with: inactive_for_days: 30 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 9f2819e6d..74c3cfa16 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -28,14 +28,12 @@ uses: gitlab/project/approvals-policy-check@v2 with: name: "All Members" approvals_required_min: 2 - ``` ## Mitigation Ensure that the project's merge approval policy complies with requirements to prevent unauthorized merges. - ## Description This rule ensures that the project's merge approval policy complies with requirements. It performs the following steps: @@ -47,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 993601e89..1bcfa0201 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -9,7 +9,7 @@ title: Restrict Approvers Per Merge Request **Rego Source:** [approvers-per-merge-request.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/approvers-per-merge-request.rego) **Labels:** Gitlab, Project -Verify the binary field Disable Overriding Approvers Per Merge Request is set for the GitLab project. +Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/approvers-per-merge-request@v2 with: disable_overriding_approvers_per_merge_request: false - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index c0763a2c4..c7019dce3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/author-email-regex@v2 with: author_email_regex: ".*@mycompany.com" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 1e6a6627c..9d242afec 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/check-cwe@v2 with: cwe_value: "89" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index 3d54357a8..b96f49d86 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/check-signed-commits@v2 - -## Usage example - -```yaml -with: gitlab/project/check-signed-commits@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index 7a5ed4d27..da12d7582 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/co-approval-required@v2 with: branch: "main" - ``` ## Mitigation Require code owner approval for specific branches in the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that code owner approval is required for specific branches in the GitLab project. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 06efddd56..93e5275b6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -29,7 +29,6 @@ with: allowed_authors: - mail@example.com - mail2@example.com - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 5ff5e4cdf..94d088103 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -28,7 +28,6 @@ uses: gitlab/project/commit-author-name-check@v2 with: allowed_authors: - examplename - ``` ## Mitigation @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index d9eff924e..c6f719d1d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commit-committer-check@v2 - -## Usage example - -```yaml -with: gitlab/project/commit-committer-check@v2 ``` ## Mitigation Enable `commit_committer_check` in the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that `commit_committer_check` is enabled for the GitLab project. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index 6cf14c8e3..b9a2184b8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/commit-message-check@v2 with: commit_message_regex: ".*JIRA-\\d+.*" - ``` ## Mitigation Ensure that commit messages adhere to the specified format template to maintain consistency and readability. - ## Description This rule ensures that commit messages in the GitLab project adhere to the specified format template. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index b6e5df923..7d482462a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/commits-validated@v2 - -## Usage example - -```yaml -with: gitlab/project/commits-validated@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 04c5b7055..6cee634cd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -28,7 +28,6 @@ uses: gitlab/project/committer-email-check@v2 with: allowed_committers: - mail@example.com - ``` ## Mitigation @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index 77c30832a..d296bed4e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -28,14 +28,12 @@ uses: gitlab/project/committer-name-check@v2 with: allowed_committers: - somename - ``` ## Mitigation Ensure that only users in the Allowed List commit by name in the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that only users in the Allowed List commit by name in the GitLab project. It performs the following steps: @@ -46,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index f14055e3f..91828aa07 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/critical-severity-limit@v2 with: max_allowed_vulnerability_count: 0 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index cd73151c2..13345c71e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/description-substring-check@v2 with: pattern: "(?i)insdput" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 9bc257be0..035933d59 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -29,7 +29,6 @@ with: banned_list: - user1 - user2 - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index 7837e716a..c2e7d5cf5 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/force-push-protection@v2 with: branch: "main" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index 39f12dac6..f88eaf51d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/medium-severity-limit@v2 with: max_allowed_specific_severity: 0 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 1a70b01bc..71b9b679f 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/member-check@v2 - -## Usage example - -```yaml -with: gitlab/project/member-check@v2 ``` ## Mitigation Ensure that Member Check is enabled for the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that `member_check` is enabled for the GitLab project. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index fcb8c9b49..a403b5785 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -27,16 +27,14 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/merge-access-level@v2 with: branch: "main" - # access_level: 30 + access_level: 30 access_level_description: "Maintainers" - ``` ## Mitigation Ensure that the GitLab project's merge access level complies with requirements to prevent unauthorized changes. - ## Description This rule ensures that the GitLab project's merge access level complies with requirements. It performs the following steps: @@ -47,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 1865f9a70..7932ba186 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -9,7 +9,7 @@ title: Disable Author Approval for Merge Requests in GitLab **Rego Source:** [merge-requests-author-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-author-approval.rego) **Labels:** Gitlab, Project -Verify the binary field Merge Requests Author Approval is set for the GitLab project. +Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/merge-requests-author-approval@v2 with: merge_requests_author_approval: true - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index df3217479..4a8d094d4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -9,7 +9,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab **Rego Source:** [merge-requests-disable-committers-approval.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/gitlab/project/merge-requests-disable-committers-approval.rego) **Labels:** Gitlab, Project -Verify Merge Requests Disable Committers Approval is set for the GitLab project. +Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/merge-requests-disable-committers-approval@v2 with: merge_requests_disable_committers_approval: false - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index 2b3c9e2b3..c55a94233 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/message-substring-check@v2 with: pattern: "(?i)dghd" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 0f272efd9..5b6640260 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/prevent-secrets-check@v2 - -## Usage example - -```yaml -with: gitlab/project/prevent-secrets-check@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index fc7983f2d..f3a63ec48 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/protect-ci-secrets@v2 with: pattern: "(?i)(token|secret)" - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index fd3e50efb..035c0b61c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -27,9 +27,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/push-access-level@v2 with: branch: "main" - # access_level: 30 + access_level: 30 access_level_description: "Maintainers" - ``` ## Mitigation @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 51e8fdbcc..10e0073e6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/push-rules-set@v2 - -## Usage example - -```yaml -with: gitlab/project/push-rules-set@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index 773d5aaf8..c78fa0af3 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/reject-unsigned-commits@v2 - -## Usage example - -```yaml -with: gitlab/project/reject-unsigned-commits@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 2390f707c..2ad69415a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/require-password-to-approve@v2 with: require_password_to_approve: true - ``` ## Mitigation Ensure that the binary field `require_password_to_approve` is set for the GitLab project to prevent unauthorized approvals. - ## Description This rule ensures that the binary field `require_password_to_approve` is set for the GitLab project. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 76cffe639..506521ccd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/required-minimal-approvers@v2 - -## Usage example - -```yaml -with: gitlab/project/required-minimal-approvers@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index cf36dd65f..b93761d69 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/reset-pprovals-on-push@v2 with: reset_approvals_on_push: true - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 0c32d48cb..8587693d6 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/sast-scan-pass@v2 - -## Usage example - -```yaml -with: gitlab/project/sast-scan-pass@v2 ``` ## Mitigation Ensure that SAST scanning is successful for the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that SAST scanning is successful for the GitLab project. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index e473ff01d..97831a147 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -25,16 +25,10 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/sast-scanning@v2 - -## Usage example - -```yaml -with: gitlab/project/sast-scanning@v2 ``` ## Mitigation -Ensure that SAST scanning is performed for the GitLab project to prevent unauthorized changes.\ - +Ensure that SAST scanning is performed for the GitLab project to prevent unauthorized changes. ## Description @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index d11d882af..76a61169a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/secrets-scan-pass@v2 - -## Usage example - -```yaml -with: gitlab/project/secrets-scan-pass@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index 1596d8df7..f11093603 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: gitlab/project/secrets-scanning@v2 - -## Usage example - -```yaml -with: gitlab/project/secrets-scanning@v2 ``` ## Mitigation Ensure that secrets scanning is performed for the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that secrets scanning is performed for the GitLab project. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 63445a0d4..162927a75 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -27,14 +27,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/selective-code-owner-removals@v2 with: selective_code_owner_removals: true - ``` ## Mitigation Ensure that `selective_code_owner_removals` is set for the GitLab project to prevent unauthorized changes. - ## Description This rule ensures that `selective_code_owner_removals` is set for the GitLab project. It performs the following steps: @@ -45,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index 26e563b5e..e05aa11be 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: gitlab/project/visibility-check@v2 with: visibility: private - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitLab project resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 71741dbc3..c76ff0d77 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -42,7 +42,6 @@ with: Ensures that only trusted base images are used in container builds, reducing the risk of deploying compromised or outdated images. This check mitigates vulnerabilities by enforcing that each base image matches an approved source pattern. - ## Description This rule examines the SBOM evidence for a container image, focusing on components in the "container" group that represent base images. A base image is identified by the presence of a property whose name ends with "isbaseimage" (case-insensitive) and whose value is "true". @@ -56,7 +55,6 @@ is found, a violation is recorded indicating that the necessary base image infor - The SBOM should include a `metadata.component.properties` array containing properties that identify base images. - The approved source patterns must be specified in the `with.approved_sources` parameter. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index beeb2e1ac..f1dcbc323 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -39,7 +39,6 @@ with: Enforces that the main image comes from a trusted source, reducing the risk of deploying images that are compromised or outdated. This check helps maintain container security by ensuring that only images matching approved source patterns are used. - ## Description This rule extracts the main image’s name and version from the SBOM evidence and verifies that it originates from an approved source. It does so by comparing the image name against a list of approved source patterns provided via the configuration (`with.approved_sources`). @@ -53,7 +52,6 @@ The matching is performed using a case-insensitive, anchored regex. - The SBOM must include a `metadata.component` section containing the main image’s `name` and `version` fields. - The approved source patterns must be specified in `with.approved_sources`. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index c99e8555a..a02cc8800 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -43,7 +43,6 @@ with: Prevents deployment of container images that expose disallowed ports, reducing the risk of unauthorized network access and potential exploitation. This check ensures that only images with approved port configurations are deployed. - ## Description This rule evaluates the CycloneDX SBOM evidence for a container image to verify that no disallowed ports are exposed. It performs the following steps: @@ -59,7 +58,6 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a `metadata.component.properties` array with entries for exposed ports. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 19c310453..1c667f1a5 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -37,7 +37,6 @@ with: Prevents the execution of container images with default or disallowed user accounts reducing the risk of privilege escalation and ensuring that only secure, non-privileged user configurations are used. - ## Description This rule inspects the CycloneDX SBOM evidence for a container image to ensure that the image is not configured to run with a banned default user. It does so by examining the `metadata.component.properties` array for a property @@ -51,7 +50,6 @@ a violation is recorded. - The SBOM must include a `metadata.component.properties` array with an entry where the property name is "user". - The disallowed user list (e.g., ["root"]) must be provided in the `with.users` parameter. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index cd12e35cd..4c4de8549 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -35,13 +35,11 @@ with: Prevents the execution of unauthorized or insecure build scripts during the image build process, reducing the risk of malicious command injection and ensuring a more secure supply chain. - ## Description This rule inspects the SBOM (in CycloneDX JSON format) for each Layer component and specifically looks for a property named "CreatedBy". It then checks whether the value of this property contains any substrings specified in the 'blocklist' parameter. If a match is found, the rule generates a violation indicating that a disallowed build script command was used during the build process. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index f2ca44eb0..c133b5371 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -42,7 +42,6 @@ indicating that the image may have been pulled from an insecure registry. - Evidence must be provided in the CycloneDX JSON format. - The SBOM should include a `metadata.component.properties` array with an entry for 'registry_scheme'. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index bf3a13c5f..505367584 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -33,7 +33,6 @@ with: Prevents the deployment of overly large container images, which helps control resource usage, reduces the attack surface by limiting unnecessary code and dependencies, and minimizes potential vulnerabilities. - ## Description This rule inspects the CycloneDX SBOM evidence for container images. It searches through the SBOM's components to locate a component belonging to the "layer" group where a property named "size" is defined. The rule specifically @@ -48,7 +47,6 @@ The extracted size is then converted to a numeric value and compared against the - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must include a component in the "layer" group with a "size" property, and an "index" property set to "0". - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index c084f3acb..30ba88bd5 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -37,7 +37,6 @@ with: Ensures that container images are built on up-to-date base images, reducing the risk of deploying images with outdated layers that may contain unpatched vulnerabilities or deprecated components. This check prevents the use of stale base images, thereby enhancing overall container security. - ## Description This rule processes the CycloneDX SBOM evidence for a container image to verify that its base image remains fresh. It identifies base image components by locating properties whose names end with "isbaseimage" (case-insensitive) and have a value of "true". @@ -48,7 +47,6 @@ If any base image is older than the allowed age, or if no base image data is fou - Evidence must be provided in CycloneDX JSON format. - The SBOM should include a `metadata.component.properties` array with properties for base image identification and creation timestamp. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 4b7197c7a..2c9feb853 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -36,7 +36,6 @@ with: Prevents the deployment of outdated container images—which may include unpatched vulnerabilities or outdated dependencies— by enforcing a maximum age limit based on the image's build time. - ## Description This rule extracts the Image creation timestamp from the SBOM evidence. It searches for a property named "created" within the image's metadata (specifically under `metadata.component.properties`). The creation timestamp is parsed using RFC 3339. @@ -48,7 +47,6 @@ the rule flags the image as too old and generates a violation with details on th - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "created" in valid RFC 3339 format. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 221fb3685..01ddb7cb6 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -42,7 +42,6 @@ with: Ensures that only container images with valid cryptographic signatures are deployed, mitigating the risk of tampering. By requiring evidence in the CycloneDX attest-cyclonedx-json format, this rule confirms that images have been signed by trusted entities. - ## Description This rule evaluates the evidence for a container image to determine if it is properly signed. It checks the environment field in the evidence to verify that the `content_type` is set to "attest-cyclonedx-json". If the @@ -55,7 +54,6 @@ for images that do not require a signature. Otherwise, if the evidence does not - The evidence environment must include a `content_type` field that indicates the report is signed (i.e., "attest-cyclonedx-json"). - The `with.skip_image_regex` parameter allows specifying patterns (e.g., "alpine") to bypass the signature requirement for certain images. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 2af193c6a..9fa721777 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -35,7 +35,6 @@ uses: images/require-healthcheck@v2 Ensures that container images define a HEALTHCHECK instruction so that the runtime environment can monitor and manage container health. This minimizes the risk of undetected failures at runtime. - ## Description This rule examines the CycloneDX SBOM evidence for a container image to verify that a healthcheck is defined. It does so by scanning the `metadata.component.properties` array for any property whose name, when lowercased, @@ -46,7 +45,6 @@ otherwise, a violation is recorded indicating a missing healthcheck. - Evidence must be provided in the CycloneDX JSON format. - The SBOM should include a `metadata.component.properties` array with entries that define healthcheck instructions. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 14c8dc493..59ba82bba 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -25,16 +25,11 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: images/restrict-shell-entrypoint@v2 - -## Usage example - -```yaml -with: images/restrict-shell-entrypoint@v2 ``` ## Mitigation Prevent unauthorized shell access by ensuring container images do not use a shell-based entrypoint. This reduces the risk of privilege escalation, unauthorized command execution, and potential security vulnerabilities from unrestricted shell access within containers. - +### **Evidence Requirements** - Evidence must be provided in the `cyclonedx-json` format. - The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". ## Description @@ -42,11 +37,6 @@ This rule ensures that container images do not allow shell access by verifying t Attackers often exploit shell access in containerized environments to execute arbitrary commands, escalate privileges, or perform unauthorized actions. This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata and checks whether it contains a shell invocation (e.g., 'sh', 'bash'). -### **Evidence Requirements** -- Evidence must be provided in the `cyclonedx-json` format. -- The SBOM must contain a component under `metadata.component.properties` with a property named "entrypoint". - - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 90b137f8d..d039f4bb3 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -38,7 +38,6 @@ with: Ensures that container images include all required metadata labels, which are essential for traceability, auditing, and enforcing compliance with security and operational standards. - ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label (as defined in the `with.labels` parameter) exists with the correct value. @@ -53,7 +52,6 @@ This rule checks the CycloneDX SBOM evidence for the container image to verify t - Evidence must be provided in the `cyclonedx-json` format. - The SBOM should include a `metadata.component.properties` array that contains label information. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 86b05d88e..654c419da 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -34,7 +34,6 @@ with: Ensures that all required metadata labels are present with the expected values, which is crucial for traceability, auditing, and compliance with container security standards. - ## Description This rule checks the CycloneDX SBOM evidence for the container image to verify that each required label (as defined in the `with.labels` parameter) exists with the correct value. @@ -49,7 +48,6 @@ required label (as defined in the `with.labels` parameter) exists with the corre - Evidence must be provided in the `cyclonedx-json` format. - The SBOM should include a `metadata.component.properties` array that contains label information. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 41394f865..5061c669c 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: jenkins/folder/exposed-credentials@v2 - -## Usage example - -```yaml -with: jenkins/folder/exposed-credentials@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins folder resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 7f2b00277..35e412de4 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -27,7 +27,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: jenkins/instance/inactive-users@v2 with: inactive_for_days: 90 - ``` ## Mitigation @@ -44,7 +43,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index b3b6ac9b1..f0a2f2b83 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: jenkins/instance/unused-users@v2 - -## Usage example - -```yaml -with: jenkins/instance/unused-users@v2 ``` ## Mitigation @@ -46,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Jenkins instance resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index c5bc05ee6..03666cf9b 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -28,14 +28,13 @@ uses: k8s/namespace/allowed-images@v2 with: images_to_include: - docker.io/my_org/my_image1 - - docker.io/my_org/my_image2 + - docker.io/my_org/my_image2 ``` ## Mitigation Ensures that only approved container images are running within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. - ## Description This rule ensures that only container images specified in the allowed list are running within the Kubernetes namespace. It performs the following steps: @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 947b57cf2..269762b58 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -35,7 +35,6 @@ with: Ensures that only approved container registries are used within the Kubernetes namespace, reducing the risk of introducing vulnerabilities or unapproved software. - ## Description This rule ensures that only container images from specified registries are allowed within the Kubernetes namespace. It performs the following steps: @@ -47,7 +46,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index d5a4b0d18..756b9a969 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -33,7 +33,6 @@ with: Ensures that namespaces do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. - ## Description This rule verifies that the duration of namespaces in Kubernetes does not exceed the specified limit. It performs the following steps: @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index e6eb871a6..05dd98d41 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -34,7 +34,6 @@ with: Ensures that namespaces are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. - ## Description This rule verifies that namespaces in Kubernetes are terminated properly within the specified time frame. It performs the following steps: @@ -46,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 7ee836995..28e6477ab 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -25,13 +25,15 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: k8s/namespace/white-listed-namespaces@v2 +with: + namespaces: + - default ``` ## Mitigation Ensures that only approved namespaces are allowed within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured namespaces. - ## Description This rule ensures that only namespaces specified in the whitelist are allowed within the Kubernetes cluster. It performs the following steps: @@ -43,7 +45,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index 978e32cd0..e11294ade 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -29,13 +29,14 @@ with: white_listed_pod: - my-pod-1.* - my-pod-2.* + verify_namespaces: + - ",*" ``` ## Mitigation Ensures that only approved pods are running within the Kubernetes namespace, reducing the risk of unauthorized or misconfigured pods. - ## Description This rule ensures that only pods specified in the whitelist are allowed within the Kubernetes namespace. It performs the following steps: @@ -47,7 +48,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -61,4 +61,5 @@ It performs the following steps: | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | white_listed_pod | array | True | A list of allowed pods (supports regex). | +| verify_namespaces | array | False | A list of namespaces to verify. | diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index ad1346c10..408898d9b 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -33,7 +33,6 @@ with: Ensures that pods do not exceed their intended lifecycle, maintaining cluster hygiene and resource efficiency. - ## Description This rule verifies that the duration of pods in Kubernetes does not exceed the specified limit. It performs the following steps: @@ -45,7 +44,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index 921bda88e..c80478ad2 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -25,18 +25,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: k8s/pods/verify-pod-termination@v2 - -## Usage example - -```yaml -with: k8s/pods/verify-pod-termination@v2 ``` ## Mitigation Ensures that pods are terminated in a timely manner, preventing lingering resources and maintaining cluster hygiene. - ## Description This rule verifies that pods in Kubernetes are terminated properly within the specified time frame. It performs the following steps: @@ -47,7 +41,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index e09ba4ced..ea96297a4 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -37,7 +37,6 @@ with: Ensures that only approved pods are running within the Kubernetes cluster, reducing the risk of unauthorized or misconfigured pods. - ## Description This rule ensures that only pods specified in the whitelist are allowed to run within the Kubernetes cluster. It performs the following steps: @@ -49,7 +48,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning Kubernetes resources. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 1559c8730..505777953 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -1,8 +1,8 @@ --- -sidebar_label: Verify Artifact Signature Using SARIF Report -title: Verify Artifact Signature Using SARIF Report +sidebar_label: Verify Artifact Signature in SARIF +title: Verify Artifact Signature in SARIF --- -# Verify Artifact Signature Using SARIF Report +# Verify Artifact Signature in SARIF **Type:** Rule **ID:** `sarif-artifact-signed` **Source:** [v2/rules/sarif/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/artifact-signed.yaml) @@ -28,18 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/artifact-signed@v2 - -## Usage example - -```yaml -with: sarif/artifact-signed@v2 ``` ## Mitigation Ensures that the referenced artifact has a valid digital signature, confirming its integrity and authenticity. This prevents tampering and verifies that the artifact originates from a trusted source. - ## Description This rule verifies that the artifact referenced in the SARIF report has been cryptographically signed. It uses the provided evidence (which must adhere to the SARIF 2.1.0 schema) to confirm that a valid signature exists. @@ -51,7 +45,6 @@ Additionally, the rule validates that the signature corresponds to one of the ex - The SARIF report must indicate that the artifact is signed (i.e., the 'signed' flag is true). - The signer's identity should match one of the specified common names or emails in the configuration. - ## Evidence Requirements | Field | Value | |-------|-------| @@ -60,3 +53,8 @@ Additionally, the rule validates that the signature corresponds to one of the ex | target_type | data | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| identity | `{'common-names': [], 'emails': []}` | + diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 26d124d4c..79bc0d653 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -28,18 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/evidence-exists@v2 - -## Usage example - -```yaml -with: sarif/evidence-exists@v2 ``` ## Mitigation By confirming that all required evidence exists, this rule guarantees that the outputs from various security scans (such as vulnerability assessments, configuration checks, and static analysis) are fully represented as evidence. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 6bb403a1e..33cf6453f 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -25,11 +25,6 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/patcheck/updates-needed@v2 - -## Usage example - -```yaml -with: sarif/patcheck/updates-needed@v2 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index e68b486af..b8f387131 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -26,14 +26,13 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/report-iac-errors@v2 with: - violations_threshold: 2 + violations_threshold: 0 ``` ## Mitigation Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - ## Description This rule evaluates the SARIF report generated by the Vulnerability Scanner to detect vulnerabilities that match a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving @@ -45,7 +44,6 @@ details such as the CVE identifier, its severity, and the location (artifact URI Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Vulnerability Scanner. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 1dd3db09e..4ed4c5181 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -32,7 +32,6 @@ uses: sarif/trivy/blocklist-cve@v2 Ensures that any vulnerabilities matching a predefined CVE blocklist are flagged, preventing images with known high-risk vulnerabilities from progressing through the pipeline. - ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that no vulnerabilities matching a predefined blocklist of CVE identifiers are present beyond the allowed threshold. The evaluation proceeds as follows: @@ -50,7 +49,6 @@ the rule ID, severity (extracted from the rule’s properties), and the location - The SARIF report should be generated by the "Trivy Vulnerability Scanner". - Evidence filtering based on the product must be applied as defined in the configuration. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index b7cd99590..c49159473 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -27,14 +27,13 @@ Rule is scoped by product. ```yaml uses: sarif/trivy/report-trivy-iac-errors@v2 with: - violations_threshold: 2 + violations_threshold: 0 ``` ## Mitigation Ensures that IaC misconfiguration errors remain within acceptable limits, reducing the risk of deploying images with insecure configuration settings. - ## Description This rule evaluates the SARIF report generated by the Trivy Vulnerability Scanner to detect vulnerabilities that match a specified blocklist of CVE identifiers. It processes the report by iterating over its vulnerability results, retrieving @@ -46,7 +45,6 @@ details such as the CVE identifier, its severity, and the location (artifact URI Evidence must be provided in a SARIF 2.1.0 compliant format, generated by the Trivy Vulnerability Scanner. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 23582aea0..29eb14011 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -32,14 +32,13 @@ Rule is scoped by product. ```yaml uses: sarif/trivy/verify-cve-severity@v2 with: - severity_threshold: 2 + severity_threshold: 0 ``` ## Mitigation Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it complies with a set of predefined rules. The evaluation is based on several configurable parameters: @@ -55,7 +54,6 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola - Evidence must be provided in a generic format adhering to the SARIF 2.1.0 schema. - The SARIF report should be generated by the "Trivy Vulnerability Scanner". - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 984dabaa1..552bd5dc6 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -28,7 +28,7 @@ uses: sarif/trivy/verify-trivy-attack-vector@v2 with: attack_vectors: - "stack buffer overflow" - violations_threshold: 2 + violations_threshold: 0 ``` ## Evidence Requirements diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 8d4a0d2b7..36cb48bbe 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -32,7 +32,6 @@ uses: sarif/trivy/verify-trivy-report@v2 Ensures that the SARIF report generated by Trivy meets the predefined security criteria, helping to detect critical vulnerabilities and configuration issues early. - ## Description This rule processes the SARIF report produced by the Trivy Vulnerability Scanner to verify that it complies with a set of predefined rules. The evaluation is based on several configurable parameters: @@ -49,7 +48,6 @@ threshold. If the number of such violations exceeds the allowed maximum, a viola - The SARIF report should be generated by the "Trivy Vulnerability Scanner". - The evidence must include proper filtering based on the product as defined in the configuration. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 7bd67fa2a..978972a78 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -28,14 +28,13 @@ uses: sarif/verify-attack-vector@v2 with: attack_vectors: - "stack buffer overflow" - violations_threshold: 2 + violations_threshold: 0 ``` ## Mitigation Helps prevent the deployment of images vulnerable to specific attack vectors by ensuring that any findings related to disallowed attack vectors are detected and flagged. This rule minimizes potential exploitation paths by enforcing that only acceptable vulnerability profiles are present. - ## Description This rule evaluates the SARIF report produced by the Vulnerability Scanner to verify that vulnerabilities associated with specific attack vectors are properly identified. The rule works as follows: @@ -55,7 +54,6 @@ associated with specific attack vectors are properly identified. The rule works - The SARIF report should be generated by a tool like the Vulnerability Scanner. - The report must include detailed rule definitions and descriptions that mention attack vectors. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index 4394f7e1c..ba241238f 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -9,7 +9,7 @@ title: Verify Rule Compliance in SARIF **Rego Source:** [verify-sarif.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-sarif.rego) **Labels:** SARIF -Verify the SARIF report complies with defined generic rules for compliance and security. +Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. :::note This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. @@ -28,8 +28,7 @@ uses: sarif/verify-sarif@v2 ``` ## Mitigation -Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable vulnerability profiles. - +Ensures that the SARIF report adheres to the predefined generic compliance rules by validating the vulnerability types, severity levels, and total number of findings. This verification helps maintain a consistent security posture and prevents the use of images with unacceptable ## Description @@ -50,7 +49,6 @@ severity, and the corresponding location in the artifact. - The SARIF report should include a structured list of vulnerability results, along with rule definitions and descriptions. - The evaluation uses the configuration parameters provided in the `with` section to guide the verification process. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index fb4224f2c..0d1b0cbc2 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -6,7 +6,7 @@ title: Verify Semgrep Rule in SARIF **Type:** Rule **ID:** `sarif-semgrep-report` **Source:** [v2/rules/sarif/verify-semgrep-report.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.yaml) -**Rego Source:** [blocklist-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/blocklist-report.rego) +**Rego Source:** [verify-semgrep-report.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sarif/verify-semgrep-report.rego) **Labels:** SARIF, Semgrep Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. @@ -31,7 +31,6 @@ uses: sarif/verify-semgrep-report@v2 Ensures that any violations detected in the SARIF report produced by Semgrep are promptly identified and flagged, helping to prevent the use of assets that do not meet the required security standards. - ## Description This rule evaluates the SARIF report generated by Semgrep to verify that it complies with a set of predefined compliance rules. It iterates over the vulnerability results in the SARIF report (located under @@ -48,7 +47,6 @@ Each violation includes details such as the rule identifier, the extracted sever - The SARIF report should be generated by Semgrep. - The report must include detailed rule definitions and descriptions that support matching against the specified blocklist. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index bfdb0bae8..724104947 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -28,18 +28,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: sarif/verify-tool-evidence@v2 - -## Usage example - -```yaml -with: sarif/verify-tool-evidence@v2 ``` ## Mitigation Confirms the SARIF report originates from the correct scanning tool, ensuring the evidence is trustworthy. - ## Description This rule checks the `tool` field in the SARIF evidence to verify that it matches the expected scanner (e.g., "Semgrep Vulnerability Scanner" or "Trivy Vulnerability Scanner"). Set evidence match criteria: @@ -50,12 +44,12 @@ A mismatch indicates that the report may not be reliable. - Evidence must adhere to the SARIF 2.1.0 schema. - The report must include a valid `tool` field. - ## Evidence Requirements | Field | Value | |-------|-------| | signed | False | | content_body_type | generic | | target_type | data | +| tool | semgrep | | predicate_type | http://docs.oasis-open.org/sarif/sarif/2.1.0 | diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 57e2b37c5..540a83a8d 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -51,14 +51,12 @@ with: email: "bob@company.com" required_supplier: name: "alice" - ``` ## Mitigation Ensures that the SBOM metadata meets NTIA requirements, reducing the risk of incomplete or inaccurate information about authors and suppliers. - ## Description This rule validates that the SBOM metadata meets basic NTIA requirements for authors and suppliers. It performs the following steps: @@ -72,7 +70,6 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include metadata for authors and suppliers. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index bff895f14..d9a5b8273 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -7,12 +7,12 @@ title: Enforce Allowed SBOM Components **ID:** `sbom-allowed-components` **Source:** [v2/rules/sbom/allowed-components.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.yaml) **Rego Source:** [allowed-components.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/allowed-components.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image Verify the artifact contains only allowed components. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type @@ -41,7 +41,6 @@ with: Ensures that only approved components are included in the SBOM, reducing the risk of introducing vulnerabilities or unapproved dependencies into the software supply chain. - ## Description This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it contains only allowed components. It performs the following steps: @@ -55,13 +54,13 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a list of components with their types and names. - ## Evidence Requirements | Field | Value | |-------|-------| | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | +| target_type | container | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index ffe4b291e..06d7cbc77 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -7,7 +7,7 @@ title: Require SBOM Signature **ID:** `sbom-signed` **Source:** [v2/rules/sbom/artifact-signed.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.yaml) **Rego Source:** [artifact-signed.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/artifact-signed.rego) -**Labels:** SBOM, Blueprint, Git +**Labels:** SBOM, Blueprint Verify the SBOM is signed. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 142aed6d5..98bc2c6b0 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -7,12 +7,12 @@ title: Restrict Disallowed SBOM Licenses **ID:** `sbom-disallowed-licenses` **Source:** [v2/rules/sbom/banned-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.yaml) **Rego Source:** [banned-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-licenses.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -39,7 +39,6 @@ with: Ensures that the software components used in the artifact comply with organizational policies by restricting the use of disallowed licenses. This helps prevent legal and compliance issues that may arise from using components with incompatible or risky licenses. - ## Description This rule inspects the CycloneDX SBOM evidence for the artifact to verify that the number of components with disallowed licenses remains below the specified threshold. It performs the following steps: @@ -53,13 +52,13 @@ remains below the specified threshold. It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a list of components with their licenses. - ## Evidence Requirements | Field | Value | |-------|-------| | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | +| target_type | container | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/sbom/banned-users.md b/docs/configuration/initiatives/rules/sbom/banned-users.md new file mode 100644 index 000000000..b7728c0e2 --- /dev/null +++ b/docs/configuration/initiatives/rules/sbom/banned-users.md @@ -0,0 +1,41 @@ +--- +sidebar_label: Disallow Specific Users in SBOM +title: Disallow Specific Users in SBOM +--- +# Disallow Specific Users in SBOM +**Type:** Rule +**ID:** `sbom-disallowed-users` +**Source:** [v2/rules/sbom/banned-users.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.yaml) +**Rego Source:** [banned-users.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/banned-users.rego) +**Labels:** SBOM, Image + +Verify specific users are not allowed in an SBOM. + +:::note +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: sbom/banned-users@v2 +``` + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | cyclonedx-json | +| target_type | container | + +## Rule Parameters (`with`) +| Parameter | Default | +|-----------|---------| +| users | ['root'] | + diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index c41f19802..060c6f0db 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -7,7 +7,7 @@ title: Restrict Disallowed Dependencies **ID:** `sbom-disallow-dependencies` **Source:** [v2/rules/sbom/blocklist-packages.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.yaml) **Rego Source:** [blocklist-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/blocklist-packages.rego) -**Labels:** SBOM, Image, Blueprint, Git +**Labels:** SBOM, Image, Blueprint Verify the number of disallowed dependencies remains below the specified threshold. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index 6600101aa..e345155b5 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -7,12 +7,12 @@ title: Enforce SBOM License Completeness **ID:** `sbom-require-complete-license-set` **Source:** [v2/rules/sbom/complete-licenses.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.yaml) **Rego Source:** [complete-licenses.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/complete-licenses.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image Verify all dependencies in the artifact have a license. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -28,18 +28,12 @@ Rule is scoped by product and target. ```yaml uses: sbom/complete-licenses@v2 - -## Usage example - -```yaml -with: sbom/complete-licenses@v2 ``` ## Mitigation Ensures that all dependencies have a complete set of licenses, reducing the risk of legal issues and ensuring compliance with open-source licenses. - ## Description This rule inspects the CycloneDX SBOM evidence for the artifact to verify that all dependencies have a complete set of licenses. It performs the following steps: @@ -52,11 +46,11 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a list of dependencies with their licenses. - ## Evidence Requirements | Field | Value | |-------|-------| | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | +| target_type | container | diff --git a/docs/configuration/initiatives/rules/sbom/evidence-exists.md b/docs/configuration/initiatives/rules/sbom/evidence-exists.md new file mode 100644 index 000000000..e84b7b34d --- /dev/null +++ b/docs/configuration/initiatives/rules/sbom/evidence-exists.md @@ -0,0 +1,42 @@ +--- +sidebar_label: Require SBOM Existence +title: Require SBOM Existence +--- +# Require SBOM Existence +**Type:** Rule +**ID:** `require-sbom` +**Source:** [v2/rules/sbom/evidence-exists.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.yaml) +**Rego Source:** [evidence-exists.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/evidence-exists.rego) +**Labels:** SBOM, Blueprint + +Verify the SBOM exists as evidence. + +:::note +This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +::: +:::tip +> Evidence **IS** required for this rule and will fail if missing. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: +:::info +Rule is scoped by product and target. +::: + +## Usage example + +```yaml +uses: sbom/evidence-exists@v2 +``` + +## Evidence Requirements +| Field | Value | +|-------|-------| +| filter-by | ['product', 'target'] | +| content_body_type | cyclonedx-json | +| signed | False | + diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index d6c4b814e..cb28f20b2 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -7,7 +7,7 @@ title: Enforce SBOM Freshness **ID:** `fresh-sbom` **Source:** [v2/rules/sbom/fresh-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.yaml) **Rego Source:** [fresh-sbom.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/fresh-sbom.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM Verify the SBOM is not older than the specified duration. @@ -36,7 +36,6 @@ with: Ensures that the SBOM is up-to-date, reducing the risk of outdated information and ensuring accurate tracking of components. - ## Description This rule inspects the CycloneDX SBOM evidence for the artifact to verify that it is not older than the specified duration. It performs the following steps: @@ -49,7 +48,6 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a creation date. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index ff3aa0338..6912a8916 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -31,18 +31,12 @@ Rule is scoped by product and target. ```yaml uses: sbom/require-sbom@v2 - -## Usage example - -```yaml -with: sbom/require-sbom@v2 ``` ## Mitigation Ensures that an SBOM is present, which is essential for tracking and managing software components and their dependencies. - ## Description This rule verifies the existence of an SBOM as evidence. It performs the following steps: @@ -53,7 +47,6 @@ It performs the following steps: **Evidence Requirements:** - Evidence must be provided in the CycloneDX JSON format. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 479309778..934e64052 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -9,10 +9,10 @@ title: Enforce SBOM Dependencies **Rego Source:** [required-packages.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/required-packages.rego) **Labels:** SBOM, Image -Verify the artifact includes all required dependencies specified as a list of PURLs. +Verify the artifact includes all required dependencies. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. @@ -39,7 +39,6 @@ with: Ensures that all required dependencies are included in the SBOM, reducing the risk of missing critical components and ensuring compliance with dependency requirements. - ## Description This rule verifies that the artifact includes all required dependencies as specified. It performs the following steps: @@ -52,13 +51,13 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a list of dependencies. - ## Evidence Requirements | Field | Value | |-------|-------| | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | +| target_type | container | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index c86ec14e9..b7edfa1a5 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -7,12 +7,12 @@ title: Require Specified SBOM Licenses **ID:** `sbom-hf-license` **Source:** [v2/rules/sbom/verify-huggingface-license.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-huggingface-license.yaml) **Rego Source:** [verify-hf-license.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/sbom/verify-hf-license.rego) -**Labels:** SBOM, Image, Git +**Labels:** SBOM, Image Verify the artifact includes all specified licenses. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. @@ -41,7 +41,6 @@ with: Ensures that all specified licenses are included in the SBOM, reducing the risk of legal issues and ensuring compliance with open-source licenses. - ## Description This rule verifies that the artifact includes all specified licenses. It performs the following steps: @@ -55,13 +54,13 @@ It performs the following steps: - Evidence must be provided in the CycloneDX JSON format. - The SBOM must include a list of dependencies with their licenses. - ## Evidence Requirements | Field | Value | |-------|-------| | filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | +| target_type | container | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 5f2c9b6d3..74d5688c9 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -32,11 +32,6 @@ Rule is scoped by product and target. ```yaml uses: slsa/l1-provenance-exists@v2 - -## Usage example - -```yaml -with: slsa/l1-provenance-exists@v2 ``` ## Mitigation diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index cc8de239c..7dd18db29 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -38,7 +38,6 @@ uses: slsa/l2-provenance-authenticated@v2 Cryptographic authentication prevents tampering with provenance data, ensuring that only valid and secure build information is used to establish the integrity of the software supply chain. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md index a7917520e..7f44e5053 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md @@ -26,28 +26,8 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: ssdf/ps-1-2fa@v2 ``` -## Mitigation -Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials. - - - -## Description -This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence. -It checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the -`organization_details.two_factor_requirement_enabled` field against the expected value. - -The rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match -the desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional -layer of security against unauthorized access. - -### **Evidence Requirements** -- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`. -- The data should come from a trusted source (e.g., a GitHub organization scan). -- The evidence must clearly indicate whether 2FA is enabled. - - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| desired_value | False | +| desired_value | True | diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md index a433e3f07..da0522bd1 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md @@ -30,7 +30,6 @@ uses: ssdf/ps-1-branch-protection@v2 Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md index 6ff8bbad6..59871259d 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md @@ -30,7 +30,6 @@ uses: ssdf/ps-1-limit-admins@v2 Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md index d3918b290..16ff0d8de 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md @@ -30,7 +30,6 @@ uses: ssdf/ps-1-repo-private@v2 Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md index 03cc59dde..af3734b98 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md @@ -30,7 +30,6 @@ uses: ssdf/ps-1-web-commit-signoff@v2 Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md index 652f24081..6bd9ea030 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md @@ -24,18 +24,12 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: ssdf/ps-2-image-verifiable@v2 - -## Usage example - -```yaml -with: ssdf/ps-2-image-verifiable@v2 ``` ## Mitigation Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. - ## Evidence Requirements | Field | Value | |-------|-------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 27e096510..4410c83bb 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -32,7 +32,6 @@ uses: ssdf/ps-3.1-code-archived@v2 Archives code changes to maintain a secure, immutable history for auditing and traceability. - ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md index e656e8fd1..320c41aab 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md @@ -24,15 +24,9 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl ```yaml uses: ssdf/ps-3.2-archived-sbom@v2 - -## Usage example - -```yaml -with: ssdf/ps-3.2-archived-sbom@v2 ``` ## Mitigation Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. - diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index 8803d85d1..ee0f9965e 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -16,7 +16,6 @@ Evaluate SLSA Level 2 Evaluate SLSA L2 and ensure that provenance information is both recorded and authenticated. This helps protect against unauthorized modifications and ensures artifact integrity." - ## Controls Overview | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index 981667a68..d86ae52db 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -18,11 +18,9 @@ This initiative enforces container security controls as outlined in NIST SP 800 | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| | [[4.1] IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. - | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. - | + | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | | [[4.2] REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. - | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. - | + | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | ## Evidence Defaults @@ -43,7 +41,6 @@ Implements security controls to reduce risks associated with container images, ### Mitigation Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -76,7 +73,6 @@ Implements controls to secure container image registries by enforcing HTTPS con ### Mitigation Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. - ### Rules | Rule ID | Rule Name | Rule Description | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index cf2ce087f..21dfed625 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -21,12 +21,9 @@ This initiative enforces key controls from the Secure Software Development Frame | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. - | -| [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. - | -| [SSDF-REPO](#ssdf-repo) | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. - | +| [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. | +| [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. | +| [SSDF-REPO](#ssdf-repo) | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. | ## Evidence Defaults @@ -46,7 +43,6 @@ Ensures that container images are verifiable and that their build metadata is ar ### Mitigation Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -62,7 +58,6 @@ Verifies that organizational security policies, such as multi-factor authenticat ### Mitigation Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -79,7 +74,6 @@ Ensures repository-level controls are in place, including branch protection, cod ### Mitigation Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. - ### Rules | Rule ID | Rule Name | Rule Description | diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index d84dd3652..542c93571 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -297,263 +297,281 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | Name | Description | |------|-------------| +| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | | [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | ## Rules ### SBOM + **Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies specified as a list of PURLs. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | | [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. | +| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | +| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | ### Image SBOM + **Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | +| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | | [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | | [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | | [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. | +| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. | +| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | +| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | +| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | +| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | ### Git SBOM + **Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | | [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | +| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | | [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | +| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | +| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | ### SARIF Evidence + **Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| | [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. | +| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | | [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | | [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | -| [Verify Artifact Signature Using SARIF Report](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | +| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | | [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | | [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | | [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | | [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement + **Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | | [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | +| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | | [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | ### Github Organization Discovery Evidence + **Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Secret_Scanning_Validity_Checks Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Custom_Link_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | | [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | +| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | | [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | | [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify Secret_Scanning Setting in Security_And_Analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Verify Secret_Scanning_Validity_Checks_Enabled Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | | [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | | [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | -| [Verify Secret_Scanning_Push_Protection_Enabled_For_New_Repositories Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | -| [Verify advanced security setting is enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security_enabled_for_new_repositories` is enabled for new repositories in the GitHub organization. | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | | [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | | [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | +| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | +| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | ### Github Repository Discovery Evidence + **Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | | [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | | [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | | [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | | [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | +| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | | [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | | [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence + **Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | | [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | +| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | | [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | | [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | +| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | | [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | +| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | +| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | ### Gitlab Project Discovery Evidence + **Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | | [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | +| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | | [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | | [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | +| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | | [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | | [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | | [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | +| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | +| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | | [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | +| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | | [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | | [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | +| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | | [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | +| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | +| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | ### K8s Namespace Discovery Evidence + **Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | | [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | | [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence + **Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | | [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | ### Bitbucket Project Discovery Evidence + **Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| | [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | | [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | +| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | ### Bitbucket Repository Discovery Evidence + **Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| +| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | | [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | | [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | ### Bitbucket Workspace Discovery Evidence + **Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | | [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | +| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | ### Discovery Evidence + **Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) | Rule Name | Description | |-----------|-------------| -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | | [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | +| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | +| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | ### Dockerhub Project Discovery Evidence + **Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) | Rule Name | Description | @@ -562,6 +580,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | ### Jenkins Instance Discovery Evidence + **Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) | Rule Name | Description | @@ -570,38 +589,40 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | ### SLSA Provenance + **Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| | [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | | [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | | [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | +| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | +| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | +| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | ### Statement + **Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | +| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | +| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | | [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | | [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | | [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | +| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | +| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | +| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | | [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | ### General Information From f222b28e90fecc7a073390d143aaf90f091debc3 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 23 Mar 2025 21:45:20 +0200 Subject: [PATCH 161/191] update --- docs/configuration/initiatives/rules/git/artifact-signed.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index 8e31b26e0..cd9897d0f 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -36,8 +36,6 @@ with: emails: - bob@company.com - alice@company.com - skip_image_regex: - - .*alpine.* ``` ## Mitigation From 59f4f3bbd98cb03047c23d1b1c843782fc2bbab4 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 24 Mar 2025 17:38:24 +0200 Subject: [PATCH 162/191] update --- docs/configuration/initiatives/index.md | 10 ++--- .../rules/github/org/advanced-security.md | 2 +- .../rules/images/enforce-https-registry.md | 1 - .../rules/images/fresh-base-image.md | 1 - .../rules/images/require-healthcheck.md | 1 - docs/configuration/initiatives/slsa.l1.md | 1 - docs/configuration/initiatives/sp-800-190.md | 45 ++++++------------- docs/configuration/initiatives/sp-800-53.md | 25 ++++------- docs/configuration/initiatives/ssdf.md | 1 - 9 files changed, 28 insertions(+), 59 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 7b4019948..f60e3464c 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -7,9 +7,9 @@ |------|-------------| | [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | | [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | | [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | ## Rules @@ -36,13 +36,13 @@ | [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | | [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | | [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | | [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | | [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | | [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | +| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | | [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | +| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | | [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | | [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 4cb83b787..719d42d2d 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -57,5 +57,5 @@ introducing vulnerabilities or unapproved software. ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| desired_value | boolean | False | Desired value for the advanced_security_enabled_for_new_repositories setting. | +| desired_value | boolean | False | Desired value for the `advanced_security_enabled_for_new_repositories` setting. | diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index c133b5371..86f385186 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -11,7 +11,6 @@ title: Registry Connection HTTPS Checks if the container's registry scheme is HTTPS - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 30ba88bd5..7e9bc6b60 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -11,7 +11,6 @@ title: Fresh Base Image Verifies that each base image is not older than the specified threshold (max_days) from its creation date. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 9fa721777..37469aad5 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -11,7 +11,6 @@ title: Require Healthcheck Checks that the container image includes at least one healthcheck property. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 31f927eec..3957036d0 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -16,7 +16,6 @@ Evaluate SLSA Level 1 This initiative ensures that every critical build artifact includes the minimum required provenance metadata as specified in SLSA Level 1. By recording detailed information about the build process—such as timestamps, authors, and build details— organizations establish a traceable chain-of-custody for their software artifacts. - ## Controls Overview | Control Name | Control Description | Mitigation | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index d86ae52db..c5423f3b8 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -12,15 +12,12 @@ title: NIST Application Container Security Initiative This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. - ## Controls Overview | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[4.1] IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. - | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | -| [[4.2] REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. - | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | +| [[4.1] IMAGE COUNTERMEASURES](#41-41-image-countermeasures) | Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. | Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. | +| [[4.2] REGISTRY COUNTERMEASURES](#42-42-registry-countermeasures) | Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. | Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. | ## Evidence Defaults @@ -37,7 +34,6 @@ This initiative enforces container security controls as outlined in NIST SP 800 Implements security controls to reduce risks associated with container images, such as vulnerabilities, misconfigurations, and unauthorized images. The policies enforce CVE scanning, mandatory security settings, and allow only trusted sources. - ### Mitigation Ensures that all container images meet organizational security policies before deployment. Helps reduce the attack surface by blocking images with vulnerabilities, misconfigurations, or unauthorized sources. @@ -45,31 +41,21 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. - | -| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. - | -| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. - | -| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. - | -| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. - | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. - | -| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. - | -| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. - | -| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. - | +| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | +| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | +| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | +| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | +| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | +| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | +| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | +| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES Implements controls to secure container image registries by enforcing HTTPS connections, verifying image freshness, and preventing stale images from being used. - ### Mitigation Reduces risks associated with registry security, stale images, and unauthorized image pulls. Ensures that images are kept up-to-date and only retrieved from secure sources. @@ -77,9 +63,6 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. - | -| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. - | -| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. - | +| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | +| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | +| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index e34fd54ae..90e6cddec 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -16,17 +16,13 @@ This initiative enforces key supply chain requirements from NIST SP 800-53. It m - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. - ## Controls Overview | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[SR4_CM8] SBOM Requirement (SR-4 / CM-8)](#sr4_cm8-sbom-requirement-sr-4-cm-8) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. - | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | -| [[SA8] Provenance Requirement (SA-8)](#sa8-provenance-requirement-sa-8) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. - | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | -| [[SA12] SBOM Signature Enforcement (SA-12)](#sa12-sbom-signature-enforcement-sa-12) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. - | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | +| [[SR4_CM8] SBOM Requirement](#sr4_cm8-sbom-requirement) | Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. | Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. | +| [[SA8] Provenance Requirement](#sa8-provenance-requirement) | Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. | Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. | +| [[SA12] SBOM Signature Enforcement](#sa12-sbom-signature-enforcement) | Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. | Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. | ## Evidence Defaults @@ -38,12 +34,11 @@ Both the SBOM and the provenance artifacts must be cryptographically signed to m # Detailed Controls -## [SR4_CM8] SBOM Requirement (SR-4 / CM-8) +## [SR4_CM8] SBOM Requirement Enforce that every container build includes a Software Bill of Materials (SBOM), ensuring that all components are inventoried and traceable. This requirement addresses both SR-4 and the component inventory aspects of CM-8. - ### Mitigation Ensures complete visibility into container components, reducing the risk of unvetted or vulnerable code entering the supply chain. @@ -52,17 +47,14 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| | [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: - | -| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. - | +| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | +| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | -## [SA8] Provenance Requirement (SA-8) +## [SA8] Provenance Requirement Enforce that every container build includes provenance data, supporting traceability within the security architecture as required by SA-8. - ### Mitigation Provides a clear audit trail of the build process, mitigating risks related to unidentified or untraceable changes. @@ -72,12 +64,11 @@ Provides a clear audit trail of the build process, mitigating risks related to u |---------|-----------|------------------| | [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | -## [SA12] SBOM Signature Enforcement (SA-12) +## [SA12] SBOM Signature Enforcement Enforce that the SBOM is cryptographically signed to verify its integrity and authenticity, aligning with SA-12 requirements. - ### Mitigation Prevents unauthorized modifications by ensuring that only signed SBOMs are accepted. diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 21dfed625..f84b6a58b 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -16,7 +16,6 @@ Evaluate PS rules from the SSDF initiative This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. - ## Controls Overview | Control Name | Control Description | Mitigation | From 785f501655732a9fb5edf0107dec18a740818500 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 24 Mar 2025 17:45:12 +0200 Subject: [PATCH 163/191] update --- docs/configuration/initiatives/index.md | 12 ++++++------ .../initiatives/rules/images/allowed-base-image.md | 1 - .../initiatives/rules/images/allowed-image-source.md | 1 - .../initiatives/rules/images/banned-ports.md | 1 - .../initiatives/rules/images/image-signed.md | 1 - .../initiatives/rules/sbom/NTIA-compliance.md | 1 - .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 1 - docs/configuration/initiatives/ssdf.md | 3 +-- 8 files changed, 7 insertions(+), 14 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index f60e3464c..e1714b601 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -21,7 +21,7 @@ |-----------|-------------| | [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | | [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | | [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | | [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. | | [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | @@ -37,16 +37,16 @@ | [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | | [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | | [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | | [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | | [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | | [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | | [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | | [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | | [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | | [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | | [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. | | [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. | @@ -307,7 +307,7 @@ | [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | | [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | | [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | +| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | | [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | | [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | | [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index c76ff0d77..0a0a08a60 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -14,7 +14,6 @@ including the component names and versions of valid base images, or lists the in This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index f1dcbc323..9fa8c6fee 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -11,7 +11,6 @@ title: Allowed Main Image Source Ensures the main container image referenced in the SBOM is from an approved source. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index a02cc8800..d4529eaa5 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -13,7 +13,6 @@ Ensures that the container image does not expose ports that are disallowed by or The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 01ddb7cb6..91858cd0a 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -11,7 +11,6 @@ title: Require Signed Container Image Enforces that container images (target_type=container) are cryptographically signed. - :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index 540a83a8d..f6d02669a 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -11,7 +11,6 @@ title: NTIA SBOM Compliance Check Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. - :::note This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. ::: diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 4410c83bb..2a5a8fd94 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -11,7 +11,6 @@ title: Code archived PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository - :::note This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. ::: diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index f84b6a58b..3c895f20d 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -78,7 +78,6 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| | [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository - | +We assume running in Github thus the code is allways stored in a repository | | [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | | [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 242d421dd1e1ca52fe4613e1df54b9d4a5951b05 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 24 Mar 2025 17:48:27 +0200 Subject: [PATCH 164/191] update --- .../initiatives/rules/ssdf/ps-3.1-code-archived.md | 3 +-- docs/configuration/initiatives/ssdf.md | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md index 2a5a8fd94..e86b3f56a 100644 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md @@ -8,8 +8,7 @@ title: Code archived **Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) **Labels:** SSDF -PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository +PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository :::note This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 3c895f20d..0507f5824 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -77,7 +77,6 @@ Minimizes the risk of code tampering and unauthorized modifications by enforcing | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. -We assume running in Github thus the code is allways stored in a repository | +| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | | [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | | [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | From 6a76d740c842a2cc9f4b4652dd1dbe0cb55f75f5 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 24 Mar 2025 17:52:23 +0200 Subject: [PATCH 165/191] update --- .../initiatives/rules/images/allowed-base-image.md | 5 +---- docs/configuration/initiatives/rules/images/banned-ports.md | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 0a0a08a60..7e1da7e5d 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -9,10 +9,7 @@ title: Allowed Base Image **Rego Source:** [allowed-base-image.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/allowed-base-image.rego) **Labels:** SBOM, Images -Verifies that every base image is from an approved source. The rule returns a summary -including the component names and versions of valid base images, or lists the invalid ones. -This rule requires Dockerfile context; for example, run it with: -`valint my_image --base-image Dockerfile`. +Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index d4529eaa5..68d9c841c 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -9,9 +9,7 @@ title: Banned Ports **Rego Source:** [banned-ports.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/images/banned-ports.rego) **Labels:** SBOM, Images -Ensures that the container image does not expose ports that are disallowed by organizational policy. -The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. -It fails if any banned port is exposed or if no banned ports list is provided. +Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. :::note This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. From aec8a5627b6c50a0c56ae838e9325bfbe4de0e11 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 25 Mar 2025 15:47:03 +0200 Subject: [PATCH 166/191] migration guide --- docs/guides/enforcing-sdlc-initiative.md | 78 ++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 0524e2630..78b80529b 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -287,6 +287,84 @@ INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: In this case, no rule was disabled, and all of them were verified. +### Migration from an older version + +Before initiatives were introduced in `valint v2.0.0`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format. + +#### Rule configs migration + +In general, older rule configs can be used in `valint v2.0.0` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config: + +```yaml +config-type: rule +``` + +After that, you can pass the rule config to `valint` using the same `--rule` flag as before. + +#### Policy configs migration + +Policy configs were deprecated in `valint v2.0.0`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward. + +If you use a single policy config, you can copy it entirely under the `controls` key in the new initiative config. For example, if you have a policy config like this: + +```yaml +name: "MyPolicy" +rules: + - uses: images/blocklist-build-scripts@v1 + level: error + with: + blocklist: + - "wget" + - "curl" +``` + +then the new initiative config will look like this: + +```yaml +config-type: "initiative" +name: "MyInitiative" +controls: + - name: "MyControl" + rules: + - uses: images/blocklist-build-scripts@v1 + level: error + with: + blocklist: + - "wget" + - "curl" +``` + +If you use multiple policies at once, you can copy all of them under the `controls` key in the new initiative config. + +The next important step is to ensure that the referenced rules work with the new `valint` version. If you use rules from the [Scribe Sample Catalog](#sample-policy-catalog), you only need to change the referenced rule version from `@v1` to `@v2`. If your rule is not listed in the updated catalog, please check whether it was renamed or moved to a different folder. As a result, the initiative configuration will look like this: + +```yaml +config-type: "initiative" +name: "MyInitiative" +controls: + - name: "MyControl" + rules: + - uses: images/blocklist-build-scripts@v2 + level: error + with: + blocklist: + - "wget" + - "curl" +``` + +This configuration can be passed to `valint` using the `--initiative` flag. + +If you're using custom rules, update them as shown in the section above. + +:::tip +Note that initiatives provide more flexibility and control over rules and controls than policies, +including smart filtering as shown in the [Rule Filtering](../valint/initiatives#rule-filtering) section. Depending on the scenario, it might be useful to place all controls in a single initiative and filter them by gate or target. +::: + +:::note +Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [here](#sample-policy-catalog) for more details. +::: + ## Sample Policy Catalog We provide a set of sample initiatives and rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. From ab98e3ae12748c1c68e934ebcfecc4eabaec349e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 2 Apr 2025 09:29:38 +0300 Subject: [PATCH 167/191] - separated advanced features and technical details of the feature core --- docs/valint/initiatives.md | 110 +++++++++++++++++++------------------ 1 file changed, 56 insertions(+), 54 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index eb795671a..d998ed7d7 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -537,7 +537,7 @@ default asset = {} asset := scribe.get_asset_data(input.evidence) ``` -## Advanced features +## Technical Details ### Evidence Lookup @@ -697,55 +697,6 @@ In this example, -### Template arguments - -Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2` relies on several arguments provided at runtime: - -```yaml - -... -with: - api_token: '{{ .Args.Token }}' - owner: '{{ .Args.Owner }}' - repo: '{{ .Args.Repo }}' - branch: '{{ .Args.Branch }}' -... -``` - -To specify those, `valint` should be run with args `--rule-args Token=MyToken,Owner=MyOwner,Repo=MyRepo,Branch=MyBranch`. - -When a required template argument is not specified, the rule will be disabled with a warning. - -#### Built-in functions - -To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of these functions is to disable filtering when the `--all-evidence` flag is used, see below. - -List of supported functions: - -- `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below -- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name`. -- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used. -- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead. - -
- Example - -In the following rule, the `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: - -```yaml -... -with: - defaults: - evidence: - labels: - - '{{ asset .Args.MyAsset }}' -... -``` - -When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will use the `asset=MyAssetValue` label for the evidence lookup. - -
- ### Rule filtering When running an initiative, there are several options to decide which rules will be evaluated. Some of the criteria are used by `valint` automatically based on the context, while others can be specified by the user. @@ -753,14 +704,14 @@ When running an initiative, there are several options to decide which rules will The following criteria are used by `valint` automatically: - Rules that have the `filter-by: target` value set in the config (see the [Evidence Lookup](#evidence-lookup) section) are disabled if no target is provided to the `valint verify` command. -- Rules that use some of the built-in functions for template arguments are disabled if the required arguments are not provided, see the [Built-in functions](#built-in-functions) section above. +- Rules that use some of the built-in functions for template arguments are disabled if the required arguments are not provided, see the [Built-in functions](#built-in-functions) for more details. -The only exception for both of these is when the `--all-evidence` flag is used, see the [Whole product evaluation](#whole-product-evaluation) section below. +The only exception for both of these is when the `--all-evidence` flag is used, see the [Whole product evaluation](#whole-product-evaluation) section. The following criteria can be specified by the user: -- The `when.gate` field is used to filter the controls by the gate type provided to the `valint verify` command using the `--gate-type` flag. When this flag is used, only controls with the matching gate and controls that don't have a gate filter are run. This feature works on the control level only. -- The `rule.labels` field is used to filter the rules by the labels provided to the `valint verify` command using the `--rule-label` flag. This feature works on the rule level only and filters out the rules that don't have any matching labels regardless of the control they belong to. +- The `when.gate` field is used to filter _***controls***_ by the gate type provided to the `valint verify` command using the `--gate-type` flag. When this flag is used, only controls with a matching gate and controls without a gate filter are executed. This feature operates at the _***control***_ level only. +- The `rule.labels` field is used to filter _***rules***_ by the labels provided to the `valint verify` command using the `--rule-label` flag. This feature operates at the _***rule***_ level only and excludes rules that do not have any matching labels, regardless of the control they belong to.
Gate Filtering Example @@ -936,6 +887,57 @@ INFO [my-initiative] Initiative "My Initiative" Evaluation Summary:
+## Advanced features + +### Template arguments + +Rules can have template arguments that can be used to simplify rule configuration. For example, `github/api/branch-protection@v2` relies on several arguments provided at runtime: + +```yaml + +... +with: + api_token: '{{ .Args.Token }}' + owner: '{{ .Args.Owner }}' + repo: '{{ .Args.Repo }}' + branch: '{{ .Args.Branch }}' +... +``` + +To specify those, `valint` should be run with args `--rule-args Token=MyToken,Owner=MyOwner,Repo=MyRepo,Branch=MyBranch`. + +When a required template argument is not specified, the rule will be disabled with a warning. + +#### Built-in functions + +To simplify the rule-args input, the rules template engine has built-in functions that can be used to define the rule arguments. Another use of these functions is to disable filtering when the `--all-evidence` flag is used, see below. + +List of supported functions: + +- `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below +- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name`. +- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used. +- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead. + +
+ Example + +In the following rule, the `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: + +```yaml +... +with: + defaults: + evidence: + labels: + - '{{ asset .Args.MyAsset }}' +... +``` + +When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will use the `asset=MyAssetValue` label for the evidence lookup. + +
+ ### Whole product evaluation One can run an initiative to verify all the existing evidences in a product. In this case, the initiative will try to find all matching evidences for every rule and verify those. To do that, the `--all-evidence` flag should be used: From 86c0f915aebe16e52e051d339c67e62380663eb4 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 3 Apr 2025 14:16:02 +0300 Subject: [PATCH 168/191] update gendocs --- docs/configuration/initiatives/index.md | 34 ++++----- .../initiatives/rules/github/org/2fa.md | 8 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/create-private-repos.md | 13 ++-- .../rules/github/org/create-repos.md | 6 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/images/blocklist-user.md | 38 ---------- .../initiatives/rules/ssdf/_category_.json | 4 - .../initiatives/rules/ssdf/ps-1-2fa.md | 33 -------- .../rules/ssdf/ps-1-branch-protection.md | 37 --------- .../rules/ssdf/ps-1-limit-admins.md | 37 --------- .../rules/ssdf/ps-1-repo-private.md | 37 --------- .../rules/ssdf/ps-1-web-commit-signoff.md | 37 --------- .../rules/ssdf/ps-2-image-verifiable.md | 37 --------- .../rules/ssdf/ps-3.1-code-archived.md | 40 ---------- .../rules/ssdf/ps-3.2-archived-sbom.md | 32 -------- docs/configuration/initiatives/slsa.l1.md | 6 +- docs/configuration/initiatives/slsa.l2.md | 8 +- docs/configuration/initiatives/ssdf.md | 76 +++++++++++++------ .../initiatives/{bp1.md => sspb.md} | 74 +++++++++--------- 27 files changed, 132 insertions(+), 443 deletions(-) delete mode 100644 docs/configuration/initiatives/rules/images/blocklist-user.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/_category_.json delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md delete mode 100644 docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md rename docs/configuration/initiatives/{bp1.md => sspb.md} (51%) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index e1714b601..60c638ccb 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -5,10 +5,10 @@ | Name | Description | |------|-------------| -| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | | [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | | [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | | [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | +| [Secure Software Pipeline Blueprint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sspb) | Blueprint for secure pipelines - Gitlab | | [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | | [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | @@ -101,26 +101,26 @@ | Rule Name | Description | |-----------|-------------| -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | -| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | +| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify only allowed users can create repositories in the GitHub organization. | +| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify secret scanning push protection is configured in the GitHub repository. | +| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify validity checks for secrets are configured for the GitHub repository. | | [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | -| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify secret scanning is configured in the GitHub repository. | | [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | -| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | +| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify Advanced Security is enabled for new repositories in the GitHub organization. | +| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify dependency graph is enabled for new repositories in the GitHub organization. | | [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | +| [Verify Two-Factor Authentication (2FA) Requirement Enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify Two-factor Authentication is required in the GitHub organization. | | [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | | [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify secret scanning is configured for new repositories in the GitHub organization. | | [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | +| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify secret scanning push protection custom link is enabled in the GitHub organization. | | [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | +| [Verify that members can create private repositories setting is configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify only allowed users can create private repositories in the GitHub organization. | | [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | -| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | -| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | +| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify validity checks for secrets are configured for the GitHub organization. | +| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. | | [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | ### Github Repository Discovery Evidence @@ -300,14 +300,6 @@ | [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | | [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | | [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | -| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | -| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | | [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | | [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | | [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index d46688c3f..98a390f89 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify two_factor_requirement_enabled setting -title: Verify two_factor_requirement_enabled setting +sidebar_label: Verify Two-Factor Authentication (2FA) Requirement Enabled +title: Verify Two-Factor Authentication (2FA) Requirement Enabled --- -# Verify two_factor_requirement_enabled setting +# Verify Two-Factor Authentication (2FA) Requirement Enabled **Type:** Rule **ID:** `github-org-2fa` **Source:** [v2/rules/github/org/2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.yaml) **Rego Source:** [2fa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/2fa.rego) **Labels:** GitHub, Organization -Verify `two_factor_requirement` is enabled in the GitHub organization. +Verify Two-factor Authentication is required in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 719d42d2d..40fc3885c 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -9,7 +9,7 @@ title: Verify `advanced_security_enabled_for_new_repositories` setting **Rego Source:** [advanced-security.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/advanced-security.rego) **Labels:** GitHub, Organization -Verify `advanced_security` is enabled for new repositories in the GitHub organization. +Verify Advanced Security is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 7a15a2a19..7ebef2bcb 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -1,15 +1,15 @@ --- -sidebar_label: Verify members_can_create_private_repositories setting -title: Verify members_can_create_private_repositories setting +sidebar_label: Verify that members can create private repositories setting is configured +title: Verify that members can create private repositories setting is configured --- -# Verify members_can_create_private_repositories setting +# Verify that members can create private repositories setting is configured **Type:** Rule **ID:** `github-org-create-private-repos` **Source:** [v2/rules/github/org/create-private-repos.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.yaml) **Rego Source:** [create-private-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-private-repos.rego) **Labels:** GitHub, Organization -Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). +Verify only allowed users can create private repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -37,11 +37,12 @@ Ensures that only approved users can create private repositories in the GitHub o ## Description This rule ensures that only users specified in the allowed list can create private repositories in the GitHub organization. +Note: this setting is supported only in GitHub Enterprise. It performs the following steps: 1. Iterates over the users in the GitHub organization. -2. Checks each user's permissions to create private repositories against the allowed list specified in the `with.allowed_users` configuration. - - If a user not in the allowed list has permissions to create private repositories, the rule flags it as a violation. +2. Checks users' permissions to create private repositories against the allowed list specified in the `with.allowed_users` configuration. + - If a user not on the allowed list has permission to create private repositories, the rule flags this as a violation. **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index 83a91cff8..c2058efa0 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -9,7 +9,7 @@ title: Verify members_can_create_repositories setting **Rego Source:** [create-repos.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/create-repos.rego) **Labels:** GitHub, Organization -Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. +Verify only allowed users can create repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. @@ -38,8 +38,8 @@ This rule ensures that only users specified in the allowed list can create repos It performs the following steps: 1. Iterates over the users in the GitHub organization. -2. Checks each user's permissions to create repositories against the allowed list specified in the `with.allowed_users` configuration. - - If a user not in the allowed list has permissions to create repositories, the rule flags it as a violation. +2. Checks users' permissions to create repositories against the allowed list specified in the `with.allowed_users` configuration. + - If a user not in the allowed list has permission to create repositories, the rule flags it as a violation. **Evidence Requirements:** - Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index 1d5f53b2e..b3cebc3ab 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -9,7 +9,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting **Rego Source:** [dependency-graph.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/dependency-graph.rego) **Labels:** GitHub, Organization -Verify `dependency_graph` is enabled for new repositories in the GitHub organization. +Verify dependency graph is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index 89ff86260..d39f3519f 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -9,7 +9,7 @@ title: Verify `secret_scanning_push_protection_custom_link_enabled` Setting **Rego Source:** [pp-custom-link.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/pp-custom-link.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. +Verify secret scanning push protection custom link is enabled in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index e9385c45d..5a9187161 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -9,7 +9,7 @@ title: Verify `secret_scanning_push_protection` Setting **Rego Source:** [push-protection-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_push_protection` is configured in the GitHub repository. +Verify secret scanning push protection is configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index cc451052e..3744e4963 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -10,7 +10,7 @@ title: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Set **Rego Source:** [push-protection.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/push-protection.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. +Verify secret scanning push protection is enabled for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index e56515aff..6ab0850a9 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -9,7 +9,7 @@ title: Verify `secret_scanning` Setting in `security_and_analysis` **Rego Source:** [secret-scanning-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning` is configured in the GitHub repository. +Verify secret scanning is configured in the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index b24e4f913..c1ecd9d02 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -9,7 +9,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting **Rego Source:** [secret-scanning.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/secret-scanning.rego) **Labels:** GitHub, Organization -Verify `secret_scanning` is enabled for new repositories in the GitHub organization. +Verify secret scanning is configured for new repositories in the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index f94d06d01..91c076b99 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -9,7 +9,7 @@ title: Verify `secret_scanning_validity_checks` Setting in `security_and_analysi **Rego Source:** [validity-checks-sa.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks-sa.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_validity_checks` is configured in the GitHub organization. +Verify validity checks for secrets are configured for the GitHub organization. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 8fd03dbee..0b302b8ef 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -9,7 +9,7 @@ title: Verify `secret_scanning_validity_checks_enabled` Setting **Rego Source:** [validity-checks.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/validity-checks.rego) **Labels:** GitHub, Organization -Verify `secret_scanning_validity_checks` is configured in the GitHub repository. +Verify validity checks for secrets are configured for the GitHub repository. :::note This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. diff --git a/docs/configuration/initiatives/rules/images/blocklist-user.md b/docs/configuration/initiatives/rules/images/blocklist-user.md deleted file mode 100644 index 9acd11cac..000000000 --- a/docs/configuration/initiatives/rules/images/blocklist-user.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -sidebar_label: Blocklist Container User -title: Blocklist Container User ---- -# Blocklist Container User -**Type:** Rule -**ID:** `images-blocklist-user` -**Uses:** `images/blocklist-user@v2/rules` -**Source:** [v2/rules/images/blocklist-user.yaml](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.yaml) -**Rego Source:** [blocklist-user.rego](https://github.com/scribe-public/sample-policies/v2/rules/images/blocklist-user.rego) -**Labels:** SBOM, Images - -Ensures that the container image does not use a user in the blocklist. -We look for a SBOM property named "user" in metadata.component.properties. -If it matches any username from the 'users' list, we fail. - - -:::tip -Rule Result will be set as 'open' if evidence is missing. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -his rule requires evaluation with a target; without one, the rule will be **disabled**. -::: - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | False | -| content_body_type | cyclonedx-json | -| target_type | container | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| users | [] | diff --git a/docs/configuration/initiatives/rules/ssdf/_category_.json b/docs/configuration/initiatives/rules/ssdf/_category_.json deleted file mode 100644 index dc1b66dcb..000000000 --- a/docs/configuration/initiatives/rules/ssdf/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SSDF", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md b/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md deleted file mode 100644 index 7f44e5053..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-2fa.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -sidebar_label: Enforce 2FA -title: Enforce 2FA ---- -# Enforce 2FA -**Type:** Rule -**ID:** `PS.1.1` -**Source:** [v2/rules/ssdf/ps-1-2fa.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-2fa.yaml) -**Labels:** SSDF - -PS.1 Require 2FA for accessing code - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-1-2fa@v2 -``` - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md b/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md deleted file mode 100644 index da0522bd1..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Branch protected -title: Branch protected ---- -# Branch protected -**Type:** Rule -**ID:** `PS.1.2` -**Source:** [v2/rules/ssdf/ps-1-branch-protection.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-branch-protection.yaml) -**Labels:** SSDF - -PS.1 Require branch protection for the repository - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-1-branch-protection@v2 -``` - -## Mitigation -Enforces branch protection policies to prevent unauthorized commits and maintain the integrity of critical code branches. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_protected | True | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md b/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md deleted file mode 100644 index 59871259d..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Limit admins -title: Limit admins ---- -# Limit admins -**Type:** Rule -**ID:** `PS.1.3` -**Source:** [v2/rules/ssdf/ps-1-limit-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-limit-admins.yaml) -**Labels:** SSDF - -PS.1 Restrict the maximum number of organization admins - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-1-limit-admins@v2 -``` - -## Mitigation -Limits the number of administrative accounts, minimizing the potential for abuse of elevated privileges. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| max_admins | 3 | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md b/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md deleted file mode 100644 index 16ff0d8de..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Repo private -title: Repo private ---- -# Repo private -**Type:** Rule -**ID:** `PS.1.4` -**Source:** [v2/rules/ssdf/ps-1-repo-private.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-repo-private.yaml) -**Labels:** SSDF - -PS.1 Assure the repository is private - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-1-repo-private@v2 -``` - -## Mitigation -Ensures that repositories remain private, reducing the risk of sensitive code being exposed to unauthorized parties. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md b/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md deleted file mode 100644 index af3734b98..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Require signoff on web commits -title: Require signoff on web commits ---- -# Require signoff on web commits -**Type:** Rule -**ID:** `PS.1.5` -**Source:** [v2/rules/ssdf/ps-1-web-commit-signoff.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-1-web-commit-signoff.yaml) -**Labels:** SSDF - -PS.1 Require contributors to sign when committing to Github through the web interface - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-1-web-commit-signoff@v2 -``` - -## Mitigation -Requires signoff on web commits to ensure that code changes are reviewed and approved, thereby reducing the risk of unauthorized or malicious modifications. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| desired_value | True | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md b/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md deleted file mode 100644 index 6bd9ea030..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -sidebar_label: Image-verifiable -title: Image-verifiable ---- -# Image-verifiable -**Type:** Rule -**ID:** `PS.2` -**Source:** [v2/rules/ssdf/ps-2-image-verifiable.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-2-image-verifiable.yaml) -**Labels:** SSDF - -PS.2 Provide a mechanism to verify the integrity of the image - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-2-image-verifiable@v2 -``` - -## Mitigation -Ensures container images are cryptographically verifiable, preventing tampering and confirming their authenticity. - - -## Evidence Requirements -| Field | Value | -|-------|-------| -| target_type | container | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md b/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md deleted file mode 100644 index e86b3f56a..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -sidebar_label: Code archived -title: Code archived ---- -# Code archived -**Type:** Rule -**ID:** `PS.3.1` -**Source:** [v2/rules/ssdf/ps-3.1-code-archived.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.1-code-archived.yaml) -**Labels:** SSDF - -PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-3.1-code-archived@v2 -``` - -## Mitigation -Archives code changes to maintain a secure, immutable history for auditing and traceability. - - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| allow | True | -| short_description | Code is archived. | -| description | Since the code is within a repository, it is archived. | -| reason | The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository. | - diff --git a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md b/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md deleted file mode 100644 index 320c41aab..000000000 --- a/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -sidebar_label: SBOM archived -title: SBOM archived ---- -# SBOM archived -**Type:** Rule -**ID:** `PS.3.2` -**Source:** [v2/rules/ssdf/ps-3.2-archived-sbom.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/ssdf/ps-3.2-archived-sbom.yaml) -**Labels:** SSDF - -PS.3.2 Archive SBOM - -:::note -This rule requires Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. -::: -:::tip -Signed Evidence for this rule **IS NOT** required by default but is recommended. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: ssdf/ps-3.2-archived-sbom@v2 -``` - -## Mitigation -Archives the SBOM for every build, providing a permanent record of the software components and their relationships, thereby reducing the risk of supply chain attacks. - - diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 3957036d0..368c82573 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -20,7 +20,7 @@ This initiative ensures that every critical build artifact includes the minimum | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[prov_exists] Provenance exists](#prov_exists-provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | +| [[provenance] Provenance exists](#provenance-provenance-exists) | This control verifies that essential provenance metadata is present for each build artifact. | Ensure that provenance metadata is present for critical build artifacts to support supply chain integrity. | ## Evidence Defaults @@ -32,7 +32,7 @@ This initiative ensures that every critical build artifact includes the minimum # Detailed Controls -## [prov_exists] Provenance exists +## [provenance] Provenance exists This control verifies that essential provenance metadata is present for each build artifact. @@ -44,4 +44,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index ee0f9965e..a8b536d88 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -20,7 +20,7 @@ Evaluate SLSA L2 and ensure that provenance information is both recorded and aut | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[prov_authn] Provenance authenticated](#prov_authn-provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | +| [[provenance] Provenance authenticated](#provenance-provenance-authenticated) | Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. | Authentication of provenance data prevents attackers from forging or modifying build metadata, ensuring the integrity of the software supply chain. | ## Evidence Defaults @@ -32,7 +32,7 @@ Evaluate SLSA L2 and ensure that provenance information is both recorded and aut # Detailed Controls -## [prov_authn] Provenance authenticated +## [provenance] Provenance authenticated Ensure that provenance metadata for build artifacts is authenticated, confirming that it originates from a trusted source. @@ -44,5 +44,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [prov_exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [prov_authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [provenance-authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 0507f5824..4334cc2d3 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -12,17 +12,22 @@ title: SSDF Client Initiative Evaluate PS rules from the SSDF initiative -## **Description** - -This initiative enforces key controls from the Secure Software Development Framework (SSDF) to ensure the integrity and security of your software supply chain. It evaluates critical process (PS) rules to detect vulnerabilities, enforce proper access and commit practices, and secure code repositories. - ## Controls Overview | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [SSDF-IMAGE](#ssdf-image) | Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. | Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. | -| [SSDF-ORG](#ssdf-org) | Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. | Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. | -| [SSDF-REPO](#ssdf-repo) | Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. | Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. | +| [[PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege](#psps1ps11-store-all-forms-of-code-based-on-the-principle-of-least-privilege) | Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. + | Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. + | +| [[PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers](#psps2ps21-make-software-integrity-verification-information-available-to-software-acquirers) | Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. + | Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. + | +| [[PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release](#psps3ps31-securely-archive-the-necessary-files-and-supporting-data-to-be-retained-for-each-software-release) | Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release + | Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. + | +| [[PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release](#psps3ps32-collect-safeguard-maintain-and-share-provenance-data-for-all-components-of-each-software-release) | Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) + | Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. + | ## Evidence Defaults @@ -34,49 +39,72 @@ This initiative enforces key controls from the Secure Software Development Frame # Detailed Controls -## SSDF-IMAGE +## [PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege + +Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. + + + +### Mitigation +Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [2fa](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | [Enforce 2FA](rules/github/org/2fa.md) | PS.1 Require 2FA for accessing code | +| [max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | [Limit admins](rules/github/org/max-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [web-commit-signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | [Require signoff on web commits](rules/github/org/web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [branch-protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | [Branch protected](rules/github/repository/branch-protection.md) | PS.1 Require branch protection for the repository | +| [repo-is-private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | [Repo private](rules/github/repository/repo-private.md) | PS.1 Assure the repository is private | + +## [PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers + +Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. -Ensures that container images are verifiable and that their build metadata is archived for supply chain integrity. ### Mitigation -Mitigates the risk of deploying untrusted or compromised container images by enforcing rules that verify image build integrity and preserve critical SBOM metadata. +Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. + ### Rules | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | [Image-verifiable](rules/ssdf/ps-2-image-verifiable.md) | PS.2 Provide a mechanism to verify the integrity of the image | -| [PS.3.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbo) | [SBOM archived](rules/ssdf/ps-3.2-archived-sbom.md) | PS.3.2 Archive SBOM | +| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Image-verifiable](rules/sbom/artifact-signed.md) | PS.2 Provide a mechanism to verify the integrity of the image | + +## [PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release -## SSDF-ORG +Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release -Verifies that organizational security policies, such as multi-factor authentication and admin limitations, are enforced. ### Mitigation -Reduces risks of unauthorized access and changes by ensuring strong organizational security practices and process signoffs. +Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. + ### Rules | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.1.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | [Enforce 2FA](rules/ssdf/ps-1-2fa.md) | PS.1 Require 2FA for accessing code | -| [PS.1.3](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | [Limit admins](rules/ssdf/ps-1-limit-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [PS.1.5](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | [Require signoff on web commits](rules/ssdf/ps-1-web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | PS.3 Provenance exists +Ensure that provenance information is available for each software release + | -## SSDF-REPO +## [PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release + +Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) -Ensures repository-level controls are in place, including branch protection, code archiving, and repository privacy. ### Mitigation -Minimizes the risk of code tampering and unauthorized modifications by enforcing strict repository controls and preserving code history. +Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. + ### Rules | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [PS.3.1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archive) | [Code archived](rules/ssdf/ps-3.1-code-archived.md) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [PS.1.2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | [Branch protected](rules/ssdf/ps-1-branch-protection.md) | PS.1 Require branch protection for the repository | -| [PS.1.4](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | [Repo private](rules/ssdf/ps-1-repo-private.md) | PS.1 Assure the repository is private | +| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [SBOM archived](rules/sbom/artifact-signed.md) | PS.3 Archive SBOM | diff --git a/docs/configuration/initiatives/bp1.md b/docs/configuration/initiatives/sspb.md similarity index 51% rename from docs/configuration/initiatives/bp1.md rename to docs/configuration/initiatives/sspb.md index 173fb9a8e..8c527817b 100644 --- a/docs/configuration/initiatives/bp1.md +++ b/docs/configuration/initiatives/sspb.md @@ -1,13 +1,13 @@ --- -sidebar_label: Blueprint for Secure Pipelines -title: Blueprint for Secure Pipelines +sidebar_label: Secure Software Pipeline Blueprint +title: Secure Software Pipeline Blueprint --- -# Blueprint for Secure Pipelines +# Secure Software Pipeline Blueprint **Type:** Initiative -**ID:** `blueprint-securesoftwarepipeline` +**ID:** `SSPB` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/bp1.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/bp1.yaml) +**Source:** [v2/initiatives/sspb.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb.yaml) **Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline Blueprint for secure pipelines - Gitlab @@ -20,16 +20,16 @@ This initiative defines a set of best practices and technical guidelines designe | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[CT-1] Restrict administrative access to CI/CD tools](#ct-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [[CT-2] Only accept commits signed with a developer GPG key](#ct-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | -| [[CT-3] Automation access keys expire automatically](#ct-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | -| [[CT-4] Reduce automation access to read-only](#ct-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | -| [[CT-6] Any critical or high severity vulnerability breaks the build](#ct-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | -| [[CT-8] Validate artifact digest](#ct-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | -| [[CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ct-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | -| [[CT-11] Available container images don’t have any high or critical vulnerabilities](#ct-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | -| [[CT-12] Validate artifact signatures and digests](#ct-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | -| [[CT-13] Scan deployed images in production](#ct-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | +| [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | ## Evidence Defaults @@ -41,7 +41,7 @@ This initiative defines a set of best practices and technical guidelines designe # Detailed Controls -## [CT-1] Restrict administrative access to CI/CD tools +## [CTL-1] Restrict administrative access to CI/CD tools Restrict administrative access to CI/CD tools @@ -61,9 +61,9 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [Limit Admins in GitLab Organization](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | -## [CT-2] Only accept commits signed with a developer GPG key +## [CTL-2] Only accept commits signed with a developer GPG key The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab @@ -81,10 +81,10 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-disallow-unsigned-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [Reject Unsigned Commits in GitLab Project](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [gitlab-project-signed-commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [Ensure All Commits Are Signed in GitLab Project](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [disallow-committing-unsigned](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [all-commits-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | -## [CT-3] Automation access keys expire automatically +## [CTL-3] Automation access keys expire automatically Automation access keys expire automatically @@ -102,9 +102,9 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [Forbid Long-Lived Tokens in GitLab Organization](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | -## [CT-4] Reduce automation access to read-only +## [CTL-4] Reduce automation access to read-only Reduce automation access to read-only @@ -122,9 +122,9 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-org-disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [Forbid Token Scopes in GitLab Organization](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | -## [CT-6] Any critical or high severity vulnerability breaks the build +## [CTL-6] Any critical or high severity vulnerability breaks the build Any critical or high severity vulnerability breaks the build @@ -146,9 +146,9 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | -## [CT-8] Validate artifact digest +## [CTL-8] Validate artifact digest Validate artifact digest @@ -168,7 +168,7 @@ Before deployment, an artifact’s digest is checked against the expected value |---------|-----------|------------------| | [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | -## [CT-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged +## [CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged @@ -186,9 +186,9 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [gitlab-project-merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [Merge approval policy check for GitLab project](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | -## [CT-11] Available container images don’t have any high or critical vulnerabilities +## [CTL-11] Available container images don’t have any high or critical vulnerabilities Available container images don’t have any high or critical vulnerabilities @@ -206,9 +206,9 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | -## [CT-12] Validate artifact signatures and digests +## [CTL-12] Validate artifact signatures and digests Validate artifact signatures and digests @@ -226,9 +226,9 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -## [CT-13] Scan deployed images in production +## [CTL-13] Scan deployed images in production Scan deployed images in production @@ -246,6 +246,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Require SBOM Signature](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [sbom-disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [Restrict Disallowed Dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [scribe-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [Verify No Critical or High Vulnerabilities](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | From 4303d39a72218a033bdae1bc498eeda1297bf599 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 3 Apr 2025 14:55:58 +0300 Subject: [PATCH 169/191] update (removed the DOC_SITE_URL prefix) --- docs/configuration/initiatives/index.md | 404 +++++++++--------- .../rules/bitbucket/project/allow-admins.md | 2 +- .../rules/bitbucket/project/allow-users.md | 2 +- .../bitbucket/project/exposed-credentials.md | 2 +- .../bitbucket/project/long-live-tokens.md | 2 +- .../bitbucket/repository/allow-admins.md | 2 +- .../rules/bitbucket/repository/allow-users.md | 2 +- .../bitbucket/repository/branch-protection.md | 2 +- .../rules/bitbucket/workspace/allow-admins.md | 2 +- .../rules/bitbucket/workspace/allow-users.md | 2 +- .../rules/dockerhub/token-expiration.md | 2 +- .../rules/dockerhub/token-not-used.md | 2 +- .../rules/generic/artifact-signed.md | 2 +- .../rules/generic/evidence-exists.md | 2 +- .../rules/generic/k8s-jailbreak.md | 2 +- .../initiatives/rules/generic/trivy-exists.md | 2 +- .../initiatives/rules/git/artifact-signed.md | 2 +- .../rules/git/coding-permissions.md | 2 +- .../initiatives/rules/git/evidence-exists.md | 2 +- .../rules/git/no-commit-to-main.md | 2 +- .../rules/git/no-unsigned-commits.md | 2 +- .../initiatives/rules/github/org/2fa.md | 2 +- .../rules/github/org/advanced-security.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/github/org/allow-users.md | 2 +- .../rules/github/org/create-private-repos.md | 2 +- .../rules/github/org/create-repos.md | 2 +- .../rules/github/org/dependabot-alerts.md | 2 +- .../org/dependabot-security-updates-sa.md | 2 +- .../github/org/dependabot-security-updates.md | 2 +- .../rules/github/org/dependency-graph.md | 2 +- .../rules/github/org/max-admins.md | 2 +- .../rules/github/org/old-secrets.md | 2 +- .../rules/github/org/pp-custom-link.md | 2 +- .../rules/github/org/push-protection-sa.md | 2 +- .../rules/github/org/push-protection.md | 2 +- .../rules/github/org/repo-visibility.md | 2 +- .../rules/github/org/secret-scanning-sa.md | 2 +- .../rules/github/org/secret-scanning.md | 2 +- .../rules/github/org/validity-checks-sa.md | 2 +- .../rules/github/org/validity-checks.md | 2 +- .../rules/github/org/web-commit-signoff.md | 2 +- .../github/repository/branch-protection.md | 2 +- .../github/repository/branch-verification.md | 2 +- .../github/repository/check-signed-commits.md | 2 +- .../repository/default-branch-protection.md | 2 +- .../rules/github/repository/dependabot.md | 2 +- .../repository/ephemeral-runners-only.md | 2 +- .../rules/github/repository/no-cache-usage.md | 2 +- .../rules/github/repository/no-org-secrets.md | 2 +- .../rules/github/repository/old-secrets.md | 2 +- .../github/repository/push-protection.md | 2 +- .../rules/github/repository/repo-private.md | 2 +- .../github/repository/secret-scanning.md | 2 +- .../rules/github/repository/signed-commits.md | 2 +- .../github/repository/validity-checks.md | 2 +- .../rules/github/repository/visibility.md | 2 +- .../github/repository/web-commit-signoff.md | 2 +- .../rules/gitlab/org/allow-admins.md | 2 +- .../rules/gitlab/org/allow-token-scopes.md | 2 +- .../rules/gitlab/org/allow-users.md | 2 +- .../rules/gitlab/org/blocked-users.md | 2 +- .../rules/gitlab/org/expiring-tokens.md | 2 +- .../rules/gitlab/org/forbid-token-scopes.md | 2 +- .../rules/gitlab/org/inactive-projects.md | 2 +- .../rules/gitlab/org/longlive-tokens.md | 2 +- .../rules/gitlab/org/max-admins.md | 2 +- .../rules/gitlab/org/projects-visibility.md | 2 +- .../rules/gitlab/org/unused-tokens.md | 2 +- .../gitlab/pipeline/verify-labels-exist.md | 2 +- .../rules/gitlab/pipeline/verify-labels.md | 2 +- .../rules/gitlab/project/abandoned-project.md | 2 +- .../gitlab/project/approvals-policy-check.md | 2 +- .../project/approvers-per-merge-request.md | 2 +- .../gitlab/project/author-email-regex.md | 2 +- .../rules/gitlab/project/check-cwe.md | 2 +- .../gitlab/project/check-signed-commits.md | 2 +- .../gitlab/project/co-approval-required.md | 2 +- .../project/commit-author-email-check.md | 2 +- .../project/commit-author-name-check.md | 2 +- .../gitlab/project/commit-committer-check.md | 2 +- .../gitlab/project/commit-message-check.md | 2 +- .../rules/gitlab/project/commits-validated.md | 2 +- .../gitlab/project/committer-email-check.md | 2 +- .../gitlab/project/committer-name-check.md | 2 +- .../gitlab/project/critical-severity-limit.md | 2 +- .../project/description-substring-check.md | 2 +- .../project/disallowed-banned-approvers.md | 2 +- .../gitlab/project/force-push-protection.md | 2 +- .../gitlab/project/medium-severity-limit.md | 2 +- .../rules/gitlab/project/member-check.md | 2 +- .../gitlab/project/merge-access-level.md | 2 +- .../project/merge-requests-author-approval.md | 2 +- ...ge-requests-disable-committers-approval.md | 2 +- .../gitlab/project/message-substring-check.md | 2 +- .../gitlab/project/prevent-secrets-check.md | 2 +- .../gitlab/project/protect-ci-secrets.md | 2 +- .../rules/gitlab/project/push-access-level.md | 2 +- .../rules/gitlab/project/push-rules-set.md | 2 +- .../gitlab/project/reject-unsigned-commits.md | 2 +- .../project/require-password-to-approve.md | 2 +- .../project/required-minimal-approvers.md | 2 +- .../gitlab/project/reset-pprovals-on-push.md | 2 +- .../rules/gitlab/project/sast-scan-pass.md | 2 +- .../rules/gitlab/project/sast-scanning.md | 2 +- .../rules/gitlab/project/secrets-scan-pass.md | 2 +- .../rules/gitlab/project/secrets-scanning.md | 2 +- .../project/selective-code-owner-removals.md | 2 +- .../rules/gitlab/project/visibility-check.md | 2 +- .../rules/images/allowed-base-image.md | 2 +- .../rules/images/allowed-image-source.md | 2 +- .../initiatives/rules/images/banned-ports.md | 2 +- .../initiatives/rules/images/banned-users.md | 2 +- .../rules/images/blocklist-build-scripts.md | 2 +- .../rules/images/enforce-https-registry.md | 2 +- .../rules/images/forbid-large-images.md | 2 +- .../rules/images/fresh-base-image.md | 2 +- .../initiatives/rules/images/fresh-image.md | 2 +- .../initiatives/rules/images/image-signed.md | 2 +- .../rules/images/require-healthcheck.md | 2 +- .../rules/images/restrict-shell-entrypoint.md | 2 +- .../rules/images/verify-labels-exist.md | 2 +- .../initiatives/rules/images/verify-labels.md | 2 +- .../jenkins/folder/exposed-credentials.md | 2 +- .../rules/jenkins/instance/inactive-users.md | 2 +- .../rules/jenkins/instance/unused-users.md | 2 +- .../rules/k8s/namespace/allowed-images.md | 2 +- .../rules/k8s/namespace/allowed-registries.md | 2 +- .../namespace/verify-namespace-duration.md | 2 +- .../namespace/verify-namespace-termination.md | 2 +- .../k8s/namespace/white-listed-namespaces.md | 2 +- .../rules/k8s/namespace/white-listed-pod.md | 2 +- .../rules/k8s/pods/verify-pod-duration.md | 2 +- .../rules/k8s/pods/verify-pod-termination.md | 2 +- .../rules/k8s/pods/white-listed-pod.md | 2 +- .../rules/multievidence/files_integrity.md | 2 +- .../rules/sarif/artifact-signed.md | 2 +- .../rules/sarif/evidence-exists.md | 2 +- .../rules/sarif/patcheck/updates-needed.md | 2 +- .../rules/sarif/report-iac-errors.md | 2 +- .../rules/sarif/trivy/blocklist-cve.md | 2 +- .../sarif/trivy/report-trivy-iac-errors.md | 2 +- .../rules/sarif/trivy/verify-cve-severity.md | 2 +- .../sarif/trivy/verify-trivy-attack-vector.md | 2 +- .../rules/sarif/trivy/verify-trivy-report.md | 2 +- .../rules/sarif/verify-attack-vector.md | 2 +- .../initiatives/rules/sarif/verify-sarif.md | 2 +- .../rules/sarif/verify-semgrep-report.md | 2 +- .../rules/sarif/verify-tool-evidence.md | 2 +- .../initiatives/rules/sbom/NTIA-compliance.md | 2 +- .../rules/sbom/allowed-components.md | 2 +- .../initiatives/rules/sbom/artifact-signed.md | 2 +- .../initiatives/rules/sbom/banned-licenses.md | 2 +- .../initiatives/rules/sbom/banned-users.md | 2 +- .../rules/sbom/blocklist-packages.md | 2 +- .../rules/sbom/complete-licenses.md | 2 +- .../initiatives/rules/sbom/evidence-exists.md | 2 +- .../initiatives/rules/sbom/fresh-sbom.md | 2 +- .../initiatives/rules/sbom/require-sbom.md | 2 +- .../rules/sbom/required-packages.md | 2 +- .../rules/sbom/verify-huggingface-license.md | 2 +- .../rules/slsa/banned-builder-deps.md | 2 +- .../initiatives/rules/slsa/build-time.md | 2 +- .../initiatives/rules/slsa/field-exists.md | 2 +- .../rules/slsa/l1-provenance-exists.md | 2 +- .../rules/slsa/l2-provenance-authenticated.md | 2 +- .../initiatives/rules/slsa/verify-builder.md | 2 +- .../rules/slsa/verify-byproducts.md | 2 +- docs/configuration/initiatives/slsa.l1.md | 2 +- docs/configuration/initiatives/slsa.l2.md | 4 +- docs/configuration/initiatives/sp-800-190.md | 24 +- docs/configuration/initiatives/sp-800-53.md | 12 +- docs/configuration/initiatives/ssdf.md | 16 +- docs/configuration/initiatives/sspb.md | 26 +- 174 files changed, 411 insertions(+), 411 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 60c638ccb..851d4f296 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -5,302 +5,302 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | -| [Secure Software Pipeline Blueprint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sspb) | Blueprint for secure pipelines - Gitlab | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Supply Chain Integrity Initiative](/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab | +| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | ## Rules ### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | -| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | +| [Apply Scribe Template Policy](/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | +| [Scribe Published Policy](/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | +| [NTIA SBOM Compliance Check](/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Enforce SBOM Freshness](/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | +| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | +| [Require SBOM Signature](/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | ### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [Image SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | -| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | -| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | +| [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | +| [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | +| [Fresh Base Image](/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Banned Ports](/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | +| [Restrict Build Scripts](/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | +| [Registry Connection HTTPS](/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | +| [Require Image Labels](/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | +| [Require Healthcheck](/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | +| [Allowed Base Image](/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Fresh Image](/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | +| [Allowed Main Image Source](/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Require Signed Container Image](/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/sbom/banned-users.md) | Verify specific users are not allowed in an SBOM. | +| [Enforce SBOM Dependencies](/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies. | +| [Enforce SBOM License Completeness](/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | +| [Restrict Disallowed SBOM Licenses](/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce Allowed SBOM Components](/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | +| [Require Specified SBOM Licenses](/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | +| [Restrict Disallowed Dependencies](/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | ### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [Git SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | -| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | +| [Restrict Coding Permissions](/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | +| [Required Git Evidence Exists](/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. | +| [Git Artifact Signed](/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. | +| [Disallow Commits to Main Branch](/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | +| [Disallow Unsigned Commits](/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. | ### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) +**Evidence Type:** [SARIF Evidence](/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| -| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | -| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | -| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | -| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | -| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | -| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | -| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | +| [Verify Attack Vector Exists in SARIF](/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | +| [Verify IaC Misconfiguration Threshold in SARIF](/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | +| [Verify Required Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | +| [Verify Artifact Signature in SARIF](/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [Verify Rule Compliance in SARIF](/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | +| [Verify Tool Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | +| [Verify Semgrep Rule in SARIF](/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Trivy SARIF Report Compliance](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Blocklist CVE Check](/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | +| [Trivy Vulnerability Findings Check](/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | +| [Verify Attack Vector Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [SARIF Update Needed](/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | +| [K8s Jailbreak](/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) +**Evidence Type:** [Generic Statement](/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | -| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | +| [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | +| [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. | +| [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. | ### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) +**Evidence Type:** [Github Organization Discovery Evidence](/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify only allowed users can create repositories in the GitHub organization. | -| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify secret scanning push protection is configured in the GitHub repository. | -| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify validity checks for secrets are configured for the GitHub repository. | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | -| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify secret scanning is configured in the GitHub repository. | -| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | -| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify Advanced Security is enabled for new repositories in the GitHub organization. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify dependency graph is enabled for new repositories in the GitHub organization. | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify Two-Factor Authentication (2FA) Requirement Enabled](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify Two-factor Authentication is required in the GitHub organization. | -| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify secret scanning is configured for new repositories in the GitHub organization. | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify secret scanning push protection custom link is enabled in the GitHub organization. | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify that members can create private repositories setting is configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify only allowed users can create private repositories in the GitHub organization. | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | -| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify validity checks for secrets are configured for the GitHub organization. | -| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | +| [Verify members_can_create_repositories setting](/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify only allowed users can create repositories in the GitHub organization. | +| [Verify `secret_scanning_push_protection` Setting](/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify secret scanning push protection is configured in the GitHub repository. | +| [Verify `secret_scanning_validity_checks_enabled` Setting](/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify validity checks for secrets are configured for the GitHub repository. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify `secret_scanning` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify secret scanning is configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify `advanced_security_enabled_for_new_repositories` setting](/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify Advanced Security is enabled for new repositories in the GitHub organization. | +| [Verify dependency_graph_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify dependency graph is enabled for new repositories in the GitHub organization. | +| [Verify GitHub Organization Requires Signoff on Web Commits](/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | +| [Verify Two-Factor Authentication (2FA) Requirement Enabled](/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify Two-factor Authentication is required in the GitHub organization. | +| [Verify GitHub Organization Secrets Are Not Too Old](/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | +| [Allowed GitHub Organization Admins](/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify secret scanning is configured for new repositories in the GitHub organization. | +| [Allowed GitHub Organization Users](/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify secret scanning push protection custom link is enabled in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify that members can create private repositories setting is configured](/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify only allowed users can create private repositories in the GitHub organization. | +| [Verify Repo Visibility Setting](/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify validity checks for secrets are configured for the GitHub organization. | +| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | ### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) +**Evidence Type:** [Github Repository Discovery Evidence](/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | -| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | -| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | -| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | +| [Verify Repository Requires Commit Signoff](/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | +| [Verify Default Branch Protection](/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | +| [Verify No Old Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | +| [Verify No Organization Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Branch Verification Setting](/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | +| [Verify secret_scanning setting](/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify No Cache Usage Exists in Repository](/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | +| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | +| [Verify Only Ephemeral Runners Exist in Repository](/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Allowed Public Repositories](/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify Push Protection Setting](/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Organization Discovery Evidence](/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | -| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | -| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | -| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | +| [Limit Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [Ensure Active Projects in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | +| [Restrict Public Visibility in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | +| [Allowed Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | +| [Forbid Long-Lived Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Forbid Unused Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | +| [Allowed Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Restrict Token Scopes in GitLab](/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | +| [Block Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | +| [Prevent Token Expiration in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | +| [Forbid Token Scopes in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Project Discovery Evidence](/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | -| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | -| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | -| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | -| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | -| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | -| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | -| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | +| [Merge approval policy check for GitLab project](/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [Set Push Rules for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | +| [Disable Committers' Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Restrict Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | +| [Require Minimal Approvers in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | +| [Enforce Medium Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Author Email Regex in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Check CWE Compliance](/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | +| [Enforce Critical Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | +| [Verify Commit Message Format](/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Enable Member Check for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | +| [Restrict Selective Code Owner Removals in GitLab](/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | +| [Run Secrets Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Reject Unsigned Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Protect CI Secrets in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | +| [Validate All Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | +| [Disallow Banned Approvers](/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | +| [Allowed Committer Emails in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | +| [Set Push Access Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | +| [Disallow Force Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Set Visibility Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Approvers Per Merge Request](/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Allowed Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Ensure All Commits Are Signed in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [Check Description Substring](/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Verify Project Activity](/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | +| [Allowed Committer Names in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | +| [Check Message Substring](/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Run SAST Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Ensure SAST Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | +| [Ensure Secrets Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | +| [Require Password for Approvals in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | ### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Namespace Discovery Evidence](/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | -| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | -| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | +| [Allowed Container Images](/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Verify Namespace Termination](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Namespaces](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | +| [Verify Namespace Runtime Duration](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | +| [Allowed Namespace Registries](/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Pods in Namespace](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Pod Discovery Evidence](/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | +| [Verify Pod Runtime Duration](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Pod Termination](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Pods](/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | ### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Project Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Prevent Long-Lived Tokens](/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Allowed Project Admins](/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | +| [Allowed Project Users](/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Prevent Credential Exposure](/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | ### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Repository Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | +| [Verify Default Branch Protection Setting Is Configured](/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | ### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | +| [Allowed Workspace Users](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | ### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) +**Evidence Type:** [Discovery Evidence](/docs/platforms/discover) | Rule Name | Description | |-----------|-------------| -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [Verify GitLab Pipeline Labels](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | +| [GitLab pipeline verify labels exist](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | +| [Verify Exposed Credentials](/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | ### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) +**Evidence Type:** [Dockerhub Project Discovery Evidence](/docs/platforms/discover#dockerhub-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | +| [Verify DockerHub Tokens are Active](/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | ### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) +**Evidence Type:** [Jenkins Instance Discovery Evidence](/docs/platforms/discover#jenkins-discovery) | Rule Name | Description | |-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | +| [Disallow Unused Users](/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | +| [Verify Inactive Users](/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | ### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) +**Evidence Type:** [SLSA Provenance](/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| -| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | -| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | -| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | +| [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | +| [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | +| [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [Disallow dependencies in SLSA Provenance Document](/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | +| [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | +| [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | ### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) +**Evidence Type:** [Statement](/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | -| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Verify Selected Commits Are Signed API](/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | +| [Branch protection enabled in GitHub repository](/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | +| [Disallow Unsigned Commits In Time Range](/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | +| [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | +| [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | +| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md index 33a2bbf74..de262da4c 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md @@ -11,7 +11,7 @@ title: Allowed Project Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md index 538e7c39d..013c0209c 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md @@ -11,7 +11,7 @@ title: Allowed Project Users Verify only users specified in the Allowed List have user access to the Bitbucket project. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md index 68b1d2eb3..82a465060 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md @@ -12,7 +12,7 @@ title: Prevent Credential Exposure Verify access to the Bitbucket project is blocked if exposed credentials are detected. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md index 2cc57054e..828f6e046 100644 --- a/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md +++ b/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md @@ -12,7 +12,7 @@ title: Prevent Long-Lived Tokens Verify Bitbucket API tokens expire before the maximum time to live. :::note -This rule requires Bitbucket Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Project Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md index b68c8403e..bdcb29925 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Repository Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md index be9a18261..7f9d70f65 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Repository Users Verify only users specified in the Allowed List have user access to the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md index d4f3b7847..347cd4b4d 100644 --- a/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md @@ -12,7 +12,7 @@ title: Verify Default Branch Protection Setting Is Configured Verify the default branch protection is enabled in the Bitbucket repository. :::note -This rule requires Bitbucket Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Repository Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md index 9bfe4cf30..793de740c 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Workspace Admins Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md index 9b657f460..0a6d19ee1 100644 --- a/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md +++ b/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Workspace Users Verify only users specified in the Allowed List have user access to the Bitbucket workspace. :::note -This rule requires Bitbucket Workspace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) for more details. +This rule requires Bitbucket Workspace Discovery Evidence. See [here](/docs/platforms/discover#bitbucket-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md index 676debc6a..31c705621 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-expiration.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-expiration.md @@ -12,7 +12,7 @@ title: Verify DockerHub Tokens are Active Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md index 89483d5ef..14ba8e6e3 100644 --- a/docs/configuration/initiatives/rules/dockerhub/token-not-used.md +++ b/docs/configuration/initiatives/rules/dockerhub/token-not-used.md @@ -12,7 +12,7 @@ title: Verify no unused Dockerhub Verify that there are no unused Dockerhub. :::note -This rule requires Dockerhub Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) for more details. +This rule requires Dockerhub Project Discovery Evidence. See [here](/docs/platforms/discover#dockerhub-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/artifact-signed.md b/docs/configuration/initiatives/rules/generic/artifact-signed.md index 5c5e18bff..7ef7ee9ae 100644 --- a/docs/configuration/initiatives/rules/generic/artifact-signed.md +++ b/docs/configuration/initiatives/rules/generic/artifact-signed.md @@ -12,7 +12,7 @@ title: Generic Artifact Signed Verify required evidence is signed. :::note -This rule requires Signed Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Signed Generic Statement. See [here](/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/evidence-exists.md b/docs/configuration/initiatives/rules/generic/evidence-exists.md index 35e2b42d6..d99c50022 100644 --- a/docs/configuration/initiatives/rules/generic/evidence-exists.md +++ b/docs/configuration/initiatives/rules/generic/evidence-exists.md @@ -12,7 +12,7 @@ title: Required Generic Evidence Exists Verify required evidence exists. :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Generic Statement. See [here](/docs/valint/generic) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md index 61c4f1af0..547b25e7d 100644 --- a/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md +++ b/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md @@ -12,7 +12,7 @@ title: K8s Jailbreak Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/generic/trivy-exists.md b/docs/configuration/initiatives/rules/generic/trivy-exists.md index 1cfdda67b..b2e2d6c9c 100644 --- a/docs/configuration/initiatives/rules/generic/trivy-exists.md +++ b/docs/configuration/initiatives/rules/generic/trivy-exists.md @@ -11,7 +11,7 @@ title: Required Trivy Evidence Exists Verify required Trivy evidence exists :::note -This rule requires Generic Statement. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) for more details. +This rule requires Generic Statement. See [here](/docs/valint/generic) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/artifact-signed.md b/docs/configuration/initiatives/rules/git/artifact-signed.md index cd9897d0f..2fec2b81a 100644 --- a/docs/configuration/initiatives/rules/git/artifact-signed.md +++ b/docs/configuration/initiatives/rules/git/artifact-signed.md @@ -12,7 +12,7 @@ title: Git Artifact Signed Verify the Git artifact is signed. :::note -This rule requires Signed Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed Git SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/coding-permissions.md b/docs/configuration/initiatives/rules/git/coding-permissions.md index ea0e8453f..c55d1936d 100644 --- a/docs/configuration/initiatives/rules/git/coding-permissions.md +++ b/docs/configuration/initiatives/rules/git/coding-permissions.md @@ -12,7 +12,7 @@ title: Restrict Coding Permissions Verify only allowed users committed to the repository. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/evidence-exists.md b/docs/configuration/initiatives/rules/git/evidence-exists.md index 973c567aa..237304dc8 100644 --- a/docs/configuration/initiatives/rules/git/evidence-exists.md +++ b/docs/configuration/initiatives/rules/git/evidence-exists.md @@ -12,7 +12,7 @@ title: Required Git Evidence Exists Verify required Git evidence exists. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/git/no-commit-to-main.md b/docs/configuration/initiatives/rules/git/no-commit-to-main.md index 307164d6a..bfc24c3e1 100644 --- a/docs/configuration/initiatives/rules/git/no-commit-to-main.md +++ b/docs/configuration/initiatives/rules/git/no-commit-to-main.md @@ -12,7 +12,7 @@ title: Disallow Commits to Main Branch Verify commits made directly to the main branch are disallowed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md index 6144d5a67..4d015322b 100644 --- a/docs/configuration/initiatives/rules/git/no-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/git/no-unsigned-commits.md @@ -12,7 +12,7 @@ title: Disallow Unsigned Commits Verify all commits are signed. :::note -This rule requires Git SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Git SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/2fa.md b/docs/configuration/initiatives/rules/github/org/2fa.md index 98a390f89..644e07024 100644 --- a/docs/configuration/initiatives/rules/github/org/2fa.md +++ b/docs/configuration/initiatives/rules/github/org/2fa.md @@ -12,7 +12,7 @@ title: Verify Two-Factor Authentication (2FA) Requirement Enabled Verify Two-factor Authentication is required in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/advanced-security.md b/docs/configuration/initiatives/rules/github/org/advanced-security.md index 40fc3885c..e74375a12 100644 --- a/docs/configuration/initiatives/rules/github/org/advanced-security.md +++ b/docs/configuration/initiatives/rules/github/org/advanced-security.md @@ -12,7 +12,7 @@ title: Verify `advanced_security_enabled_for_new_repositories` setting Verify Advanced Security is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index e241d4aca..04b60260f 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed GitHub Organization Admins Verify only users in the Allowed List have admin privileges in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/allow-users.md b/docs/configuration/initiatives/rules/github/org/allow-users.md index 2a3c43722..ca8df3d50 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-users.md +++ b/docs/configuration/initiatives/rules/github/org/allow-users.md @@ -12,7 +12,7 @@ title: Allowed GitHub Organization Users Verify only users in the Allowed List have user access to the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-private-repos.md b/docs/configuration/initiatives/rules/github/org/create-private-repos.md index 7ebef2bcb..60db251bb 100644 --- a/docs/configuration/initiatives/rules/github/org/create-private-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-private-repos.md @@ -12,7 +12,7 @@ title: Verify that members can create private repositories setting is configured Verify only allowed users can create private repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/create-repos.md b/docs/configuration/initiatives/rules/github/org/create-repos.md index c2058efa0..8f3e68c18 100644 --- a/docs/configuration/initiatives/rules/github/org/create-repos.md +++ b/docs/configuration/initiatives/rules/github/org/create-repos.md @@ -12,7 +12,7 @@ title: Verify members_can_create_repositories setting Verify only allowed users can create repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md index fc00cb9fc..6805700cf 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md @@ -12,7 +12,7 @@ title: Verify dependabot_alerts_enabled_for_new_repositories setting Verify Dependabot alerts for new repositories are enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md index 75ab66e23..ae9bac2b0 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md @@ -12,7 +12,7 @@ title: Verify dependabot_security_updates setting in security_and_analysis Verify Dependabot security updates are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md index 8aaf34c7d..45e410708 100644 --- a/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md +++ b/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md @@ -12,7 +12,7 @@ title: Verify dependabot_security_updates_enabled_for_new_repositories setting Verify Dependabot security updates for new repositories are configured in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/dependency-graph.md b/docs/configuration/initiatives/rules/github/org/dependency-graph.md index b3cebc3ab..9999445b2 100644 --- a/docs/configuration/initiatives/rules/github/org/dependency-graph.md +++ b/docs/configuration/initiatives/rules/github/org/dependency-graph.md @@ -12,7 +12,7 @@ title: Verify dependency_graph_enabled_for_new_repositories setting Verify dependency graph is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/max-admins.md b/docs/configuration/initiatives/rules/github/org/max-admins.md index 514ae87a8..458ae9876 100644 --- a/docs/configuration/initiatives/rules/github/org/max-admins.md +++ b/docs/configuration/initiatives/rules/github/org/max-admins.md @@ -12,7 +12,7 @@ title: Limit Admin Number in GitHub Organization Verify the maximum number of GitHub organization admins is restricted. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/old-secrets.md b/docs/configuration/initiatives/rules/github/org/old-secrets.md index b471114c6..fee218e54 100644 --- a/docs/configuration/initiatives/rules/github/org/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/org/old-secrets.md @@ -12,7 +12,7 @@ title: Verify GitHub Organization Secrets Are Not Too Old Verify secrets in the GitHub organization are not older than the specified threshold. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md index d39f3519f..a09354b45 100644 --- a/docs/configuration/initiatives/rules/github/org/pp-custom-link.md +++ b/docs/configuration/initiatives/rules/github/org/pp-custom-link.md @@ -12,7 +12,7 @@ title: Verify `secret_scanning_push_protection_custom_link_enabled` Setting Verify secret scanning push protection custom link is enabled in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md index 5a9187161..ff0d21fe2 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection-sa.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection-sa.md @@ -12,7 +12,7 @@ title: Verify `secret_scanning_push_protection` Setting Verify secret scanning push protection is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/push-protection.md b/docs/configuration/initiatives/rules/github/org/push-protection.md index 3744e4963..5aadbeab3 100644 --- a/docs/configuration/initiatives/rules/github/org/push-protection.md +++ b/docs/configuration/initiatives/rules/github/org/push-protection.md @@ -13,7 +13,7 @@ title: Verify `secret_scanning_push_protection_enabled_for_new_repositories` Set Verify secret scanning push protection is enabled for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/repo-visibility.md b/docs/configuration/initiatives/rules/github/org/repo-visibility.md index 2cefacaff..98603f352 100644 --- a/docs/configuration/initiatives/rules/github/org/repo-visibility.md +++ b/docs/configuration/initiatives/rules/github/org/repo-visibility.md @@ -12,7 +12,7 @@ title: Verify Repo Visibility Setting Verify only repositories in the Allowed List are public in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md index 6ab0850a9..16fabb0dd 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md @@ -12,7 +12,7 @@ title: Verify `secret_scanning` Setting in `security_and_analysis` Verify secret scanning is configured in the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/secret-scanning.md b/docs/configuration/initiatives/rules/github/org/secret-scanning.md index c1ecd9d02..aad5af60f 100644 --- a/docs/configuration/initiatives/rules/github/org/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/org/secret-scanning.md @@ -12,7 +12,7 @@ title: Verify secret_scanning_enabled_for_new_repositories setting Verify secret scanning is configured for new repositories in the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md index 91c076b99..ba7944eb9 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md @@ -12,7 +12,7 @@ title: Verify `secret_scanning_validity_checks` Setting in `security_and_analysi Verify validity checks for secrets are configured for the GitHub organization. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/validity-checks.md b/docs/configuration/initiatives/rules/github/org/validity-checks.md index 0b302b8ef..e0e954854 100644 --- a/docs/configuration/initiatives/rules/github/org/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/org/validity-checks.md @@ -12,7 +12,7 @@ title: Verify `secret_scanning_validity_checks_enabled` Setting Verify validity checks for secrets are configured for the GitHub repository. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md index f9873966a..50f953fd3 100644 --- a/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md @@ -12,7 +12,7 @@ title: Verify GitHub Organization Requires Signoff on Web Commits Verify contributors sign commits through the GitHub web interface. :::note -This rule requires Github Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Organization Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-protection.md b/docs/configuration/initiatives/rules/github/repository/branch-protection.md index 7cc969dd8..89069fd1d 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-protection.md @@ -12,7 +12,7 @@ title: Verify Branch Protection Setting Verify branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/branch-verification.md b/docs/configuration/initiatives/rules/github/repository/branch-verification.md index 41ba68ac2..48232d5e9 100644 --- a/docs/configuration/initiatives/rules/github/repository/branch-verification.md +++ b/docs/configuration/initiatives/rules/github/repository/branch-verification.md @@ -12,7 +12,7 @@ title: Verify Branch Verification Setting Verify branch verification in the GitHub repository matches the value defined in the configuration file. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md index 49092cd5e..dec363eed 100644 --- a/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md @@ -12,7 +12,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits in the GitHub repository are signed. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md index 7b218d538..1d266e99a 100644 --- a/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md @@ -12,7 +12,7 @@ title: Verify Default Branch Protection Verify the default branch protection is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/dependabot.md b/docs/configuration/initiatives/rules/github/repository/dependabot.md index 5f3864c1d..08b9ba9ba 100644 --- a/docs/configuration/initiatives/rules/github/repository/dependabot.md +++ b/docs/configuration/initiatives/rules/github/repository/dependabot.md @@ -12,7 +12,7 @@ title: Verify Dependabot security updates setting Verify Dependabot security updates are configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md index 960486aa3..3893a88d4 100644 --- a/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md +++ b/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md @@ -12,7 +12,7 @@ title: Verify Only Ephemeral Runners Exist in Repository Verify self-hosted runners are disallowed in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md index 5733c665c..8f2e89285 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md +++ b/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md @@ -12,7 +12,7 @@ title: Verify No Cache Usage Exists in Repository Verify the GitHub repository has no cache usage. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md index d202d64f5..be2c1a241 100644 --- a/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md @@ -12,7 +12,7 @@ title: Verify No Organization Secrets Exist in Repository Verify no organization secrets exist in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/old-secrets.md b/docs/configuration/initiatives/rules/github/repository/old-secrets.md index 11a2818cb..fd5293186 100644 --- a/docs/configuration/initiatives/rules/github/repository/old-secrets.md +++ b/docs/configuration/initiatives/rules/github/repository/old-secrets.md @@ -12,7 +12,7 @@ title: Verify No Old Secrets Exist in Repository Verify secrets in the GitHub repository are not older than the specified threshold. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/push-protection.md b/docs/configuration/initiatives/rules/github/repository/push-protection.md index 37aba58b5..7bedd3d91 100644 --- a/docs/configuration/initiatives/rules/github/repository/push-protection.md +++ b/docs/configuration/initiatives/rules/github/repository/push-protection.md @@ -12,7 +12,7 @@ title: Verify Push Protection Setting Verify `secret_scanning_push_protection` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/repo-private.md b/docs/configuration/initiatives/rules/github/repository/repo-private.md index f8d41c763..3f093b80b 100644 --- a/docs/configuration/initiatives/rules/github/repository/repo-private.md +++ b/docs/configuration/initiatives/rules/github/repository/repo-private.md @@ -12,7 +12,7 @@ title: Verify Repository Is Private Verify the GitHub repository is private. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md index 18a31d703..c36877398 100644 --- a/docs/configuration/initiatives/rules/github/repository/secret-scanning.md +++ b/docs/configuration/initiatives/rules/github/repository/secret-scanning.md @@ -12,7 +12,7 @@ title: Verify secret_scanning setting Verify `secret_scanning` is configured in the GitHub repository. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/signed-commits.md b/docs/configuration/initiatives/rules/github/repository/signed-commits.md index d5840ee01..7d5d1e7a1 100644 --- a/docs/configuration/initiatives/rules/github/repository/signed-commits.md +++ b/docs/configuration/initiatives/rules/github/repository/signed-commits.md @@ -12,7 +12,7 @@ title: Verify All Commits Are Signed in Repository Verify all commits are signed in a repository attestation. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/validity-checks.md b/docs/configuration/initiatives/rules/github/repository/validity-checks.md index 531d1ef96..4b385d1f0 100644 --- a/docs/configuration/initiatives/rules/github/repository/validity-checks.md +++ b/docs/configuration/initiatives/rules/github/repository/validity-checks.md @@ -12,7 +12,7 @@ title: Verify secret scanning. Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/visibility.md b/docs/configuration/initiatives/rules/github/repository/visibility.md index 0d9ddb3eb..897e4c6fb 100644 --- a/docs/configuration/initiatives/rules/github/repository/visibility.md +++ b/docs/configuration/initiatives/rules/github/repository/visibility.md @@ -12,7 +12,7 @@ title: Allowed Public Repositories Verify only GitHub repositories in the Allowed List are public. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md index 77cc2432a..224fb90da 100644 --- a/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md +++ b/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md @@ -12,7 +12,7 @@ title: Verify Repository Requires Commit Signoff Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. :::note -This rule requires Github Repository Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) for more details. +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md index 745f211b6..73c7c93f6 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md @@ -12,7 +12,7 @@ title: Allowed Admins in GitLab Organization Verify only users in the Allowed List have admin privileges in the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md index eda5c397a..3e2bdf5c5 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md @@ -12,7 +12,7 @@ title: Restrict Token Scopes in GitLab Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md index d507e4271..cdc185c53 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/allow-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/allow-users.md @@ -12,7 +12,7 @@ title: Allowed Users in GitLab Organization Verify only users in the Allowed List have access to the GitLab organization. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md index 359ab1c17..0486fbdf8 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md +++ b/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md @@ -12,7 +12,7 @@ title: Block Users in GitLab Organization Verify no users in the GitLab organization are on the block list. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md index 6b2a86754..824fc4a93 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md @@ -12,7 +12,7 @@ title: Prevent Token Expiration in GitLab Organization Verify no GitLab organization tokens are about to expire. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md index c46b3e2c8..4c5950612 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md +++ b/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md @@ -12,7 +12,7 @@ title: Forbid Token Scopes in GitLab Organization Verify no GitLab organization tokens have disallowed scopes. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md index 099353af5..74e4dbbf7 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md +++ b/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md @@ -12,7 +12,7 @@ title: Ensure Active Projects in GitLab Organization Verify no GitLab organization projects are inactive. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md index 198fe2a9d..922de7791 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md @@ -12,7 +12,7 @@ title: Forbid Long-Lived Tokens in GitLab Organization Verify no GitLab organization tokens have an excessively long lifespan. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md index 9ded2a929..7ab171500 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/max-admins.md +++ b/docs/configuration/initiatives/rules/gitlab/org/max-admins.md @@ -12,7 +12,7 @@ title: Limit Admins in GitLab Organization Verify the maximum number of admins for the GitLab project is restricted. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md index 39e99487e..303c97227 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md +++ b/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md @@ -12,7 +12,7 @@ title: Restrict Public Visibility in GitLab Organization Verify only allowed projects in the GitLab organization have public visibility. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md index 7d2d36778..619affeb1 100644 --- a/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md +++ b/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md @@ -12,7 +12,7 @@ title: Forbid Unused Tokens in GitLab Organization Verify there are no unused GitLab organization tokens. :::note -This rule requires Gitlab Organization Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Organization Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md index 7d6a7bc74..9c019a28e 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md @@ -12,7 +12,7 @@ title: GitLab pipeline verify labels exist Verify the pipeline has all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md index 98db27834..cc46d1ca1 100644 --- a/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md +++ b/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md @@ -12,7 +12,7 @@ title: Verify GitLab Pipeline Labels Verify the pipeline includes all required label keys and values. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md index 6f377e608..8d523c739 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md +++ b/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md @@ -12,7 +12,7 @@ title: Verify Project Activity Verify the GitLab project is active for a specified duration. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md index 74c3cfa16..43e902f13 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md @@ -12,7 +12,7 @@ title: Merge approval policy check for GitLab project Verify the project's merge approval policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md index 1bcfa0201..1e54c8d91 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md +++ b/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md @@ -12,7 +12,7 @@ title: Restrict Approvers Per Merge Request Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md index c7019dce3..cfb8cda12 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md +++ b/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md @@ -12,7 +12,7 @@ title: Set Author Email Regex in GitLab Project Verify the `author_email_regex` for the GitLab project is set to the specified value. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md index 9d242afec..a125c366a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md @@ -12,7 +12,7 @@ title: Check CWE Compliance Verify that specified CWEs were not detected in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md index b96f49d86..a80374c33 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md @@ -12,7 +12,7 @@ title: Ensure All Commits Are Signed in GitLab Project Verify all commits in the GitLab project are signed. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md index da12d7582..bf4a52c38 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md +++ b/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md @@ -12,7 +12,7 @@ title: Require Code Owner Approval in GitLab Project Verify code owner approval is required for specific branches in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md index 93e5275b6..d77361ab8 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md @@ -12,7 +12,7 @@ title: Restrict Commit Authors in GitLab Project Verify only GitLab project users in the Allowed List have commit author permissions. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md index 94d088103..55e087650 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md @@ -12,7 +12,7 @@ title: Allowed Commit Authors in GitLab Project Verify only users in the Allowed List author commits in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md index c6f719d1d..a2fddaafd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md @@ -12,7 +12,7 @@ title: Enable Commit Committer Check in GitLab Project Verify `commit_committer_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md index b9a2184b8..56cf33494 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md @@ -12,7 +12,7 @@ title: Verify Commit Message Format Verify that commit messages in the GitLab project adhere to the specified format template. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md index 7d482462a..2786a114a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md +++ b/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md @@ -12,7 +12,7 @@ title: Validate All Commits in GitLab Project Verify all commits in the GitLab project are validated. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md index 6cee634cd..5f48fd56c 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md @@ -12,7 +12,7 @@ title: Allowed Committer Emails in GitLab Project Verify only users in the Allowed List use committer email addresses in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md index d296bed4e..8a9d8858e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md @@ -12,7 +12,7 @@ title: Allowed Committer Names in GitLab Project Verify only users in the Allowed List commit by name in the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md index 91828aa07..b1fe783df 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md @@ -12,7 +12,7 @@ title: Enforce Critical Severity Limit Verify the maximum allowed critical severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md index 13345c71e..c099ebfcb 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md @@ -12,7 +12,7 @@ title: Check Description Substring Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md index 035933d59..1dc623619 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md @@ -12,7 +12,7 @@ title: Disallow Banned Approvers Verify approvers in the GitLab project are not on the banned list. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md index c2e7d5cf5..a7563bf66 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md +++ b/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md @@ -12,7 +12,7 @@ title: Disallow Force Push in GitLab Project Verify force pushes in the GitLab project are disallowed to maintain repository integrity. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md index f88eaf51d..97b566385 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md +++ b/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md @@ -12,7 +12,7 @@ title: Enforce Medium Severity Limit Verify the maximum allowed medium severity alerts for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/member-check.md b/docs/configuration/initiatives/rules/gitlab/project/member-check.md index 71b9b679f..d5e607ecc 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/member-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/member-check.md @@ -12,7 +12,7 @@ title: Enable Member Check for GitLab Project Verify `member_check` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md index a403b5785..699e195a9 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md @@ -12,7 +12,7 @@ title: Enforce Merge Access Level Policy for GitLab Project Verify the GitLab project's merge access level complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md index 7932ba186..03f4f6a7d 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md @@ -12,7 +12,7 @@ title: Disable Author Approval for Merge Requests in GitLab Verify the binary field `merge_requests_author_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md index 4a8d094d4..73012b220 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md +++ b/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md @@ -12,7 +12,7 @@ title: Disable Committers' Approval for Merge Requests in GitLab Verify `merge_requests_disable_committers_approval` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md index c55a94233..9bb75f6dd 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md @@ -12,7 +12,7 @@ title: Check Message Substring Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md index 5b6640260..8aa4d7b58 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md @@ -12,7 +12,7 @@ title: Enable Secrets Prevention in GitLab Project Verify `prevent_secrets` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md index f3a63ec48..d34548bc4 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md +++ b/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md @@ -12,7 +12,7 @@ title: Protect CI Secrets in GitLab Project Verify secrets in the GitLab project are not shared. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md index 035c0b61c..8c0ef7478 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md @@ -12,7 +12,7 @@ title: Set Push Access Level in GitLab Project Verify the GitLab project's push access level policy complies with requirements. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md index 10e0073e6..77d37f3fc 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md +++ b/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md @@ -12,7 +12,7 @@ title: Set Push Rules for GitLab Project Verify push rules are set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md index c78fa0af3..d966af231 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md @@ -12,7 +12,7 @@ title: Reject Unsigned Commits in GitLab Project Verify `reject_unsigned_commits` is enabled for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md index 2ad69415a..74629475a 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md +++ b/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md @@ -12,7 +12,7 @@ title: Require Password for Approvals in GitLab Project Verify the binary field `require_password_to_approve` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md index 506521ccd..a1d23a6e1 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md +++ b/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md @@ -12,7 +12,7 @@ title: Require Minimal Approvers in GitLab Project Verify the required number of approvers for the GitLab project is met. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md index b93761d69..f598ceaac 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md +++ b/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md @@ -12,7 +12,7 @@ title: Reset Approvals on Push in GitLab Project Verify `reset_approvals_on_push` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md index 8587693d6..ee0b45035 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md @@ -12,7 +12,7 @@ title: Ensure SAST Scanning Passes Verify SAST scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md index 97831a147..f2dd6cb95 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md @@ -12,7 +12,7 @@ title: Run SAST Scanning in GitLab Project Verify SAST scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md index 76a61169a..f1259f531 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md @@ -12,7 +12,7 @@ title: Ensure Secrets Scanning Passes Verify secrets scanning is successful for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md index f11093603..d928ba814 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md +++ b/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md @@ -12,7 +12,7 @@ title: Run Secrets Scanning in GitLab Project Verify secrets scanning is performed for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md index 162927a75..b6394dc4e 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md +++ b/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md @@ -12,7 +12,7 @@ title: Restrict Selective Code Owner Removals in GitLab Verify `selective_code_owner_removals` is set for the GitLab project. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md index e05aa11be..713c49fe2 100644 --- a/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md +++ b/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md @@ -12,7 +12,7 @@ title: Set Visibility Level in GitLab Project Verify the GitLab project's visibility matches the required level. :::note -This rule requires Gitlab Project Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) for more details. +This rule requires Gitlab Project Discovery Evidence. See [here](/docs/platforms/discover#gitlab-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index 7e1da7e5d..f8706fe13 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -12,7 +12,7 @@ title: Allowed Base Image Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/allowed-image-source.md b/docs/configuration/initiatives/rules/images/allowed-image-source.md index 9fa8c6fee..6f5aeb92d 100644 --- a/docs/configuration/initiatives/rules/images/allowed-image-source.md +++ b/docs/configuration/initiatives/rules/images/allowed-image-source.md @@ -12,7 +12,7 @@ title: Allowed Main Image Source Ensures the main container image referenced in the SBOM is from an approved source. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-ports.md b/docs/configuration/initiatives/rules/images/banned-ports.md index 68d9c841c..b6215c2c6 100644 --- a/docs/configuration/initiatives/rules/images/banned-ports.md +++ b/docs/configuration/initiatives/rules/images/banned-ports.md @@ -12,7 +12,7 @@ title: Banned Ports Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/banned-users.md b/docs/configuration/initiatives/rules/images/banned-users.md index 1c667f1a5..52d2e90b9 100644 --- a/docs/configuration/initiatives/rules/images/banned-users.md +++ b/docs/configuration/initiatives/rules/images/banned-users.md @@ -12,7 +12,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 4c4de8549..44927c5d6 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -12,7 +12,7 @@ title: Restrict Build Scripts Verify no build scripts commands appear in block list. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/enforce-https-registry.md b/docs/configuration/initiatives/rules/images/enforce-https-registry.md index 86f385186..6694658b6 100644 --- a/docs/configuration/initiatives/rules/images/enforce-https-registry.md +++ b/docs/configuration/initiatives/rules/images/enforce-https-registry.md @@ -12,7 +12,7 @@ title: Registry Connection HTTPS Checks if the container's registry scheme is HTTPS :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 505367584..456fd5442 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -12,7 +12,7 @@ title: Forbid Large Images Verify the image size is below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-base-image.md b/docs/configuration/initiatives/rules/images/fresh-base-image.md index 7e9bc6b60..886b15b83 100644 --- a/docs/configuration/initiatives/rules/images/fresh-base-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-base-image.md @@ -12,7 +12,7 @@ title: Fresh Base Image Verifies that each base image is not older than the specified threshold (max_days) from its creation date. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/fresh-image.md b/docs/configuration/initiatives/rules/images/fresh-image.md index 2c9feb853..baf77e017 100644 --- a/docs/configuration/initiatives/rules/images/fresh-image.md +++ b/docs/configuration/initiatives/rules/images/fresh-image.md @@ -12,7 +12,7 @@ title: Fresh Image Verify the image is not older than the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/image-signed.md b/docs/configuration/initiatives/rules/images/image-signed.md index 91858cd0a..7ff88fc2f 100644 --- a/docs/configuration/initiatives/rules/images/image-signed.md +++ b/docs/configuration/initiatives/rules/images/image-signed.md @@ -12,7 +12,7 @@ title: Require Signed Container Image Enforces that container images (target_type=container) are cryptographically signed. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/require-healthcheck.md b/docs/configuration/initiatives/rules/images/require-healthcheck.md index 37469aad5..02d073bfb 100644 --- a/docs/configuration/initiatives/rules/images/require-healthcheck.md +++ b/docs/configuration/initiatives/rules/images/require-healthcheck.md @@ -12,7 +12,7 @@ title: Require Healthcheck Checks that the container image includes at least one healthcheck property. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 59ba82bba..5242b965f 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -12,7 +12,7 @@ title: Disallow Container Shell Entrypoint Verify the container image disallows shell entrypoint. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index d039f4bb3..0eff8b5d7 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -12,7 +12,7 @@ title: Require Image Labels Verify the image has the specified labels. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 654c419da..6c8c45e84 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -12,7 +12,7 @@ title: Verify Image Labels Verify specified labels key-value pairs exist in the image. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md index 5061c669c..851ca8a62 100644 --- a/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md +++ b/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md @@ -12,7 +12,7 @@ title: Verify Exposed Credentials Verify there are no exposed credentials. :::note -This rule requires Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) for more details. +This rule requires Discovery Evidence. See [here](/docs/platforms/discover) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md index 35e412de4..e4a94c697 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md @@ -12,7 +12,7 @@ title: Verify Inactive Users Verify there are no inactive users. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md index f0a2f2b83..e389c4c5b 100644 --- a/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md +++ b/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md @@ -12,7 +12,7 @@ title: Disallow Unused Users Verify there are no users with zero activity. :::note -This rule requires Jenkins Instance Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) for more details. +This rule requires Jenkins Instance Discovery Evidence. See [here](/docs/platforms/discover#jenkins-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md index 03666cf9b..6d4175020 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md @@ -12,7 +12,7 @@ title: Allowed Container Images Verify only container images specified in the Allowed List run within the Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md index 269762b58..86df02e4e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md @@ -12,7 +12,7 @@ title: Allowed Namespace Registries Verify container images in Kubernetes namespaces originate from registries in the Allowed List. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md index 756b9a969..9f3ab6a6e 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md @@ -12,7 +12,7 @@ title: Verify Namespace Runtime Duration Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md index 05dd98d41..2f09ed274 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md @@ -12,7 +12,7 @@ title: Verify Namespace Termination Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md index 28e6477ab..9fa04fe21 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md @@ -12,7 +12,7 @@ title: Allowed Namespaces Verify only namespaces specified in the Allowed List are allowed within the cluster. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md index e11294ade..16ca50ecf 100644 --- a/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md @@ -12,7 +12,7 @@ title: Allowed Pods in Namespace Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. :::note -This rule requires K8s Namespace Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Namespace Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md index 408898d9b..3bd9120a7 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md @@ -12,7 +12,7 @@ title: Verify Pod Runtime Duration Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md index c80478ad2..0419bfd0d 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md +++ b/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md @@ -12,7 +12,7 @@ title: Verify Pod Termination Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md index ea96297a4..2c2f7e044 100644 --- a/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md +++ b/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md @@ -12,7 +12,7 @@ title: Allowed Pods Verify only pods explicitly listed in the Allowed List are allowed to run. :::note -This rule requires K8s Pod Discovery Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) for more details. +This rule requires K8s Pod Discovery Evidence. See [here](/docs/platforms/discover#k8s-discovery) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md index d059f7018..6ad76cd05 100644 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ b/docs/configuration/initiatives/rules/multievidence/files_integrity.md @@ -12,7 +12,7 @@ title: Verify File Integrity Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. :::note -This rule requires Signed Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS** required by default. diff --git a/docs/configuration/initiatives/rules/sarif/artifact-signed.md b/docs/configuration/initiatives/rules/sarif/artifact-signed.md index 505777953..bc19b5ab4 100644 --- a/docs/configuration/initiatives/rules/sarif/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sarif/artifact-signed.md @@ -12,7 +12,7 @@ title: Verify Artifact Signature in SARIF Verify the artifact referenced in the SARIF report is signed to confirm its integrity. :::note -This rule requires Signed SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires Signed SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/evidence-exists.md b/docs/configuration/initiatives/rules/sarif/evidence-exists.md index 79bc0d653..42cd057ee 100644 --- a/docs/configuration/initiatives/rules/sarif/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sarif/evidence-exists.md @@ -12,7 +12,7 @@ title: Verify Required Evidence in SARIF Verify all required evidence exists as defined by the SARIF policy. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md index 33cf6453f..73272dd36 100644 --- a/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md +++ b/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md @@ -12,7 +12,7 @@ title: SARIF Update Needed Verify no security packages require updates. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md index b8f387131..60a3b8c25 100644 --- a/docs/configuration/initiatives/rules/sarif/report-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/report-iac-errors.md @@ -12,7 +12,7 @@ title: Verify IaC Misconfiguration Threshold in SARIF Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md index 4ed4c5181..6a48c671c 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md @@ -13,7 +13,7 @@ title: Trivy Blocklist CVE Check Verify a CVE Blocklist against a SARIF report :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md index c49159473..82c29d586 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md @@ -13,7 +13,7 @@ title: Verify IaC Misconfiguration Threshold in Trivy SARIF Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md index 29eb14011..070aa80fc 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md @@ -15,7 +15,7 @@ the defined severity threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md index 552bd5dc6..1b02523f8 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md @@ -12,7 +12,7 @@ title: Verify Attack Vector Threshold in Trivy SARIF Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md index 36cb48bbe..5104fbfec 100644 --- a/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md +++ b/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md @@ -13,7 +13,7 @@ title: Verify Trivy SARIF Report Compliance Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md index 978972a78..20f5479df 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md +++ b/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md @@ -12,7 +12,7 @@ title: Verify Attack Vector Exists in SARIF Verify required evidence validates attack vectors in the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-sarif.md b/docs/configuration/initiatives/rules/sarif/verify-sarif.md index ba241238f..1dacfc9d2 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-sarif.md +++ b/docs/configuration/initiatives/rules/sarif/verify-sarif.md @@ -12,7 +12,7 @@ title: Verify Rule Compliance in SARIF Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md index 0d1b0cbc2..51bba1c7a 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md +++ b/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md @@ -12,7 +12,7 @@ title: Verify Semgrep Rule in SARIF Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md index 724104947..c9f4b8e30 100644 --- a/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md +++ b/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md @@ -12,7 +12,7 @@ title: Verify Tool Evidence in SARIF Verify required tools were used to generate the SARIF report. :::note -This rule requires SARIF Evidence. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) for more details. +This rule requires SARIF Evidence. See [here](/docs/valint/sarif) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md index f6d02669a..6e824ea72 100644 --- a/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md +++ b/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md @@ -12,7 +12,7 @@ title: NTIA SBOM Compliance Check Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes metadata for authors and suppliers to meet NTIA requirements. diff --git a/docs/configuration/initiatives/rules/sbom/allowed-components.md b/docs/configuration/initiatives/rules/sbom/allowed-components.md index d9a5b8273..0fcf18aa1 100644 --- a/docs/configuration/initiatives/rules/sbom/allowed-components.md +++ b/docs/configuration/initiatives/rules/sbom/allowed-components.md @@ -12,7 +12,7 @@ title: Enforce Allowed SBOM Components Verify the artifact contains only allowed components. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::note Components type reference: https://cyclonedx.org/docs/1.6/json/#components_items_type diff --git a/docs/configuration/initiatives/rules/sbom/artifact-signed.md b/docs/configuration/initiatives/rules/sbom/artifact-signed.md index 06d7cbc77..afe914345 100644 --- a/docs/configuration/initiatives/rules/sbom/artifact-signed.md +++ b/docs/configuration/initiatives/rules/sbom/artifact-signed.md @@ -12,7 +12,7 @@ title: Require SBOM Signature Verify the SBOM is signed. :::note -This rule requires Signed SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Signed SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/banned-licenses.md b/docs/configuration/initiatives/rules/sbom/banned-licenses.md index 98bc2c6b0..b04282513 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/banned-licenses.md @@ -12,7 +12,7 @@ title: Restrict Disallowed SBOM Licenses Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/banned-users.md b/docs/configuration/initiatives/rules/sbom/banned-users.md index b7728c0e2..589f7c1fa 100644 --- a/docs/configuration/initiatives/rules/sbom/banned-users.md +++ b/docs/configuration/initiatives/rules/sbom/banned-users.md @@ -12,7 +12,7 @@ title: Disallow Specific Users in SBOM Verify specific users are not allowed in an SBOM. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md index 060c6f0db..68340e1f6 100644 --- a/docs/configuration/initiatives/rules/sbom/blocklist-packages.md +++ b/docs/configuration/initiatives/rules/sbom/blocklist-packages.md @@ -12,7 +12,7 @@ title: Restrict Disallowed Dependencies Verify the number of disallowed dependencies remains below the specified threshold. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/complete-licenses.md b/docs/configuration/initiatives/rules/sbom/complete-licenses.md index e345155b5..092a58aac 100644 --- a/docs/configuration/initiatives/rules/sbom/complete-licenses.md +++ b/docs/configuration/initiatives/rules/sbom/complete-licenses.md @@ -12,7 +12,7 @@ title: Enforce SBOM License Completeness Verify all dependencies in the artifact have a license. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/evidence-exists.md b/docs/configuration/initiatives/rules/sbom/evidence-exists.md index e84b7b34d..8575c67c2 100644 --- a/docs/configuration/initiatives/rules/sbom/evidence-exists.md +++ b/docs/configuration/initiatives/rules/sbom/evidence-exists.md @@ -12,7 +12,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md index cb28f20b2..2cb34b7bf 100644 --- a/docs/configuration/initiatives/rules/sbom/fresh-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/fresh-sbom.md @@ -12,7 +12,7 @@ title: Enforce SBOM Freshness Verify the SBOM is not older than the specified duration. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/require-sbom.md b/docs/configuration/initiatives/rules/sbom/require-sbom.md index 6912a8916..26af45b64 100644 --- a/docs/configuration/initiatives/rules/sbom/require-sbom.md +++ b/docs/configuration/initiatives/rules/sbom/require-sbom.md @@ -12,7 +12,7 @@ title: Require SBOM Existence Verify the SBOM exists as evidence. :::note -This rule requires SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/sbom/required-packages.md b/docs/configuration/initiatives/rules/sbom/required-packages.md index 934e64052..7f588770f 100644 --- a/docs/configuration/initiatives/rules/sbom/required-packages.md +++ b/docs/configuration/initiatives/rules/sbom/required-packages.md @@ -12,7 +12,7 @@ title: Enforce SBOM Dependencies Verify the artifact includes all required dependencies. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md index b7edfa1a5..8e23d65e8 100644 --- a/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md +++ b/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md @@ -12,7 +12,7 @@ title: Require Specified SBOM Licenses Verify the artifact includes all specified licenses. :::note -This rule requires Image SBOM. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) for more details. +This rule requires Image SBOM. See [here](/docs/valint/sbom) for more details. ::: :::note Ensure that the SBOM includes all specified licenses to meet compliance requirements. This rule accesses the Hugging Face API to validate the licenses. diff --git a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md index 5a1ce8f08..740abf350 100644 --- a/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md +++ b/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md @@ -12,7 +12,7 @@ title: Disallow dependencies in SLSA Provenance Document Verify that dependencies in the block list do not appear in the SLSA Proveance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/build-time.md b/docs/configuration/initiatives/rules/slsa/build-time.md index 3544a7642..15078ca55 100644 --- a/docs/configuration/initiatives/rules/slsa/build-time.md +++ b/docs/configuration/initiatives/rules/slsa/build-time.md @@ -12,7 +12,7 @@ title: Verify build time Verify the artifact was created within the specified time window. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/field-exists.md b/docs/configuration/initiatives/rules/slsa/field-exists.md index 0895f0509..f8f51dd61 100644 --- a/docs/configuration/initiatives/rules/slsa/field-exists.md +++ b/docs/configuration/initiatives/rules/slsa/field-exists.md @@ -12,7 +12,7 @@ title: SLSA Field Exists in Provenance Document Verify the specified field exists in the provenance document. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md index 74d5688c9..c145190e5 100644 --- a/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md +++ b/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md @@ -13,7 +13,7 @@ title: Verify Provenance Document Exists Verify that the Provenance document evidence exists. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md index 7dd18db29..b41e03755 100644 --- a/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md +++ b/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md @@ -13,7 +13,7 @@ title: Verify that provenance is authenticated Verify the artifact is signed. :::note -This rule requires Signed SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires Signed SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip > Evidence **IS** required for this rule and will fail if missing. diff --git a/docs/configuration/initiatives/rules/slsa/verify-builder.md b/docs/configuration/initiatives/rules/slsa/verify-builder.md index 2bc163454..dcf1cad98 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-builder.md +++ b/docs/configuration/initiatives/rules/slsa/verify-builder.md @@ -12,7 +12,7 @@ title: Verify that artifact was created by the specified builder Verify the artifact was created by the specified builder. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md index 7477a84e8..4e8cb7128 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-byproducts.md +++ b/docs/configuration/initiatives/rules/slsa/verify-byproducts.md @@ -12,7 +12,7 @@ title: Verify that artifact has no disallowed builder dependencies Verify the artifact has no disallowed builder dependencies. :::note -This rule requires SLSA Provenance. See [here](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) for more details. +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. ::: :::tip Signed Evidence for this rule **IS NOT** required by default but is recommended. diff --git a/docs/configuration/initiatives/slsa.l1.md b/docs/configuration/initiatives/slsa.l1.md index 368c82573..f7972a389 100644 --- a/docs/configuration/initiatives/slsa.l1.md +++ b/docs/configuration/initiatives/slsa.l1.md @@ -44,4 +44,4 @@ Ensure that provenance metadata is present for critical build artifacts to suppo | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/slsa.l2.md b/docs/configuration/initiatives/slsa.l2.md index a8b536d88..54513ea07 100644 --- a/docs/configuration/initiatives/slsa.l2.md +++ b/docs/configuration/initiatives/slsa.l2.md @@ -44,5 +44,5 @@ Authentication of provenance data prevents attackers from forging or modifying b | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | -| [provenance-authn](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | +| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | Ensure that provenance metadata is present for each build artifact, enabling traceability and verification. | +| [provenance-authn](rules/slsa/l2-provenance-authenticated.md) | [Provenance authenticated](rules/slsa/l2-provenance-authenticated.md) | Verify that provenance metadata is cryptographically authenticated, ensuring it has not been tampered with. | diff --git a/docs/configuration/initiatives/sp-800-190.md b/docs/configuration/initiatives/sp-800-190.md index c5423f3b8..d7f0538c5 100644 --- a/docs/configuration/initiatives/sp-800-190.md +++ b/docs/configuration/initiatives/sp-800-190.md @@ -41,15 +41,15 @@ Ensures that all container images meet organizational security policies before | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [trivy-verify-vulnerability-findings](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | -| [trivy-blocklist-cve](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | -| [sbom-disallowed-users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | -| [images-banned-ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | -| [images-require-healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | -| [images-allowed-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | -| [images-allowed-image-source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | -| [images-require-signed-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signe) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | +| [trivy-verify-vulnerability-findings](rules/sarif/trivy/verify-cve-severity.md) | [4.1.1 Severity-Based Vulnerabilities (Trivy)](rules/sarif/trivy/verify-cve-severity.md) | Ensures that images do not contain high-severity vulnerabilities. Blocks images if any CVEs exceed the defined severity threshold. | +| [trivy-blocklist-cve](rules/sarif/trivy/blocklist-cve.md) | [4.1.1 High-Profile Vulnerabilities (Trivy)](rules/sarif/trivy/blocklist-cve.md) | Blocks images that contain specific high-profile CVEs that are actively exploited or widely known. | +| [sbom-disallowed-users](rules/images/banned-users.md) | [4.1.2 Default Non-Root User](rules/images/banned-users.md) | Ensures that containers do not run as the root user. | +| [images-banned-ports](rules/images/banned-ports.md) | [4.1.2 Banned Open Port 22](rules/images/banned-ports.md) | Blocks images that expose SSH (port 22), which should not be used in containerized applications. | +| [images-require-healthcheck](rules/images/require-healthcheck.md) | [4.1.3 Set HEALTHCHECK Instruction](rules/images/require-healthcheck.md) | Ensures that container images include a HEALTHCHECK instruction to monitor their runtime health. | +| [image-labels](rules/images/verify-labels.md) | [4.1.3 Verify Required Image Labels](rules/images/verify-labels.md) | Enforces the presence of essential OpenContainers labels, such as creation time, version, and source repository. | +| [images-allowed-base-image](rules/images/allowed-base-image.md) | [4.1.5 Approved Source Base Images](rules/images/allowed-base-image.md) | Ensures that base images originate from approved and trusted sources. | +| [images-allowed-image-source](rules/images/allowed-image-source.md) | [4.1.5 Approved Source Images](rules/images/allowed-image-source.md) | Ensures that application images are built from approved sources. | +| [images-require-signed-image](rules/images/image-signed.md) | [4.1.5 Signed Images](rules/images/image-signed.md) | Ensures that images are cryptographically signed before execution. | ## [4.2] 4.2 REGISTRY COUNTERMEASURES @@ -63,6 +63,6 @@ Reduces risks associated with registry security, stale images, and unauthorized | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [images-registry-https-check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | -| [images-fresh-base-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | -| [fresh-image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | +| [images-registry-https-check](rules/images/enforce-https-registry.md) | [4.2.1 Registry Connection Enforcement](rules/images/enforce-https-registry.md) | Ensures that images are only pulled from registries using HTTPS. | +| [images-fresh-base-image](rules/images/fresh-base-image.md) | [4.2.2 Up-to-Date Base Images](rules/images/fresh-base-image.md) | Ensures that base images are not older than a specified time limit. | +| [fresh-image](rules/images/fresh-image.md) | [4.2.2 Up-to-Date Derived Images](rules/images/fresh-image.md) | Ensures that derived images are refreshed regularly and not outdated. | diff --git a/docs/configuration/initiatives/sp-800-53.md b/docs/configuration/initiatives/sp-800-53.md index 90e6cddec..9a709a36a 100644 --- a/docs/configuration/initiatives/sp-800-53.md +++ b/docs/configuration/initiatives/sp-800-53.md @@ -46,9 +46,9 @@ Ensures complete visibility into container components, reducing the risk of unve | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | -| [image-labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | -| [NTIA-compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | +| [require-sbom](rules/sbom/require-sbom.md) | [Require SBOM](rules/sbom/require-sbom.md) | Ensure an SBOM is provided for all container builds. | +| [image-labels](rules/images/verify-labels.md) | [Verify Supply Chain Labels](rules/images/verify-labels.md) | Confirm that container images include required `opencontainers` labels: | +| [NTIA-compliance](rules/sbom/NTIA-compliance.md) | [NTIA SBOM Compliance Check](rules/sbom/NTIA-compliance.md) | Verifies that the SBOM includes valid authors and supplier data following NTIA guidelines. Optionally enforces a required_author and required_supplier if provided. | ## [SA8] Provenance Requirement @@ -62,7 +62,7 @@ Provides a clear audit trail of the build process, mitigating risks related to u | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [SLSA.L1](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | +| [SLSA.L1](rules/slsa/l1-provenance-exists.md) | [Require Provenance](rules/slsa/l1-provenance-exists.md) | Ensure provenance data is present for container builds. | ## [SA12] SBOM Signature Enforcement @@ -76,5 +76,5 @@ Prevents unauthorized modifications by ensuring that only signed SBOMs are accep | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbo) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | -| [SLSA.L2](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticate) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | +| [require-sbom](rules/sbom/require-sbom.md) | [Signed SBOM Requirement](rules/sbom/require-sbom.md) | Validate that the SBOM is cryptographically signed. | +| [SLSA.L2](rules/slsa/l2-provenance-authenticated.md) | [Signed Provenance Requirement](rules/slsa/l2-provenance-authenticated.md) | Validate that the provenance data is cryptographically signed. | diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 4334cc2d3..161379be2 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -53,11 +53,11 @@ Implement strict access controls, enforce multi-factor authentication (MFA), and | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [2fa](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | [Enforce 2FA](rules/github/org/2fa.md) | PS.1 Require 2FA for accessing code | -| [max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | [Limit admins](rules/github/org/max-admins.md) | PS.1 Restrict the maximum number of organization admins | -| [web-commit-signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | [Require signoff on web commits](rules/github/org/web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | -| [branch-protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | [Branch protected](rules/github/repository/branch-protection.md) | PS.1 Require branch protection for the repository | -| [repo-is-private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | [Repo private](rules/github/repository/repo-private.md) | PS.1 Assure the repository is private | +| [2fa](rules/github/org/2fa.md) | [Enforce 2FA](rules/github/org/2fa.md) | PS.1 Require 2FA for accessing code | +| [max-admins](rules/github/org/max-admins.md) | [Limit admins](rules/github/org/max-admins.md) | PS.1 Restrict the maximum number of organization admins | +| [web-commit-signoff](rules/github/org/web-commit-signoff.md) | [Require signoff on web commits](rules/github/org/web-commit-signoff.md) | PS.1 Require contributors to sign when committing to Github through the web interface | +| [branch-protection](rules/github/repository/branch-protection.md) | [Branch protected](rules/github/repository/branch-protection.md) | PS.1 Require branch protection for the repository | +| [repo-is-private](rules/github/repository/repo-private.md) | [Repo private](rules/github/repository/repo-private.md) | PS.1 Assure the repository is private | ## [PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers @@ -73,7 +73,7 @@ Use cryptographic signatures to sign software releases and provide a way for use | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [Image-verifiable](rules/sbom/artifact-signed.md) | PS.2 Provide a mechanism to verify the integrity of the image | +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [Image-verifiable](rules/sbom/artifact-signed.md) | PS.2 Provide a mechanism to verify the integrity of the image | ## [PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release @@ -89,7 +89,7 @@ Use secure, version-controlled repositories to store software releases and their | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [provenance-exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | PS.3 Provenance exists +| [provenance-exists](rules/slsa/l1-provenance-exists.md) | [Provenance exists](rules/slsa/l1-provenance-exists.md) | PS.3 Provenance exists Ensure that provenance information is available for each software release | @@ -107,4 +107,4 @@ Use software bill of materials (SBOM) to document the provenance of each softwar | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [SBOM archived](rules/sbom/artifact-signed.md) | PS.3 Archive SBOM | +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [SBOM archived](rules/sbom/artifact-signed.md) | PS.3 Archive SBOM | diff --git a/docs/configuration/initiatives/sspb.md b/docs/configuration/initiatives/sspb.md index 8c527817b..2f8b7ea58 100644 --- a/docs/configuration/initiatives/sspb.md +++ b/docs/configuration/initiatives/sspb.md @@ -61,7 +61,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [max-admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [max-admins](rules/gitlab/org/max-admins.md) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | ## [CTL-2] Only accept commits signed with a developer GPG key @@ -81,8 +81,8 @@ Unsigned code commits are difficult to trace and pose a risk to the integrity of | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [disallow-committing-unsigned](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [all-commits-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | [disallow-committing-unsigned](rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | [all-commits-signed](rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | ## [CTL-3] Automation access keys expire automatically @@ -102,7 +102,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [token-excessive-lifespan](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | [token-excessive-lifespan](rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | ## [CTL-4] Reduce automation access to read-only @@ -122,7 +122,7 @@ CI systems should have read access only to source code repositories to limit the | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [disallowed-token-scope](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +| [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ## [CTL-6] Any critical or high severity vulnerability breaks the build @@ -146,7 +146,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CTL-8] Validate artifact digest @@ -166,7 +166,7 @@ Before deployment, an artifact’s digest is checked against the expected value | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [require-sbom](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | +| [require-sbom](rules/sbom/evidence-exists.md) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | ## [CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged @@ -186,7 +186,7 @@ Requiring multiple code reviews and successful tests helps ensure that no change | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [merge-approval](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [merge-approval](rules/gitlab/project/approvals-policy-check.md) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | ## [CTL-11] Available container images don’t have any high or critical vulnerabilities @@ -206,7 +206,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CTL-12] Validate artifact signatures and digests @@ -226,7 +226,7 @@ Validating the signature and digest of an artifact ensures that it has not been | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | ## [CTL-13] Scan deployed images in production @@ -246,6 +246,6 @@ Production images should be validated to ensure that controls enforced during ea | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [sbom-is-signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signe) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | -| [disallow-dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [stop-critical-or-high-vuln](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | From c4a00c0ccf65a1d28e61efd6d0943de845018ec7 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 3 Apr 2025 15:00:11 +0300 Subject: [PATCH 170/191] ssdf fix --- docs/configuration/initiatives/ssdf.md | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/docs/configuration/initiatives/ssdf.md b/docs/configuration/initiatives/ssdf.md index 161379be2..23e1c8fe2 100644 --- a/docs/configuration/initiatives/ssdf.md +++ b/docs/configuration/initiatives/ssdf.md @@ -16,18 +16,10 @@ Evaluate PS rules from the SSDF initiative | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| -| [[PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege](#psps1ps11-store-all-forms-of-code-based-on-the-principle-of-least-privilege) | Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. - | Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. - | -| [[PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers](#psps2ps21-make-software-integrity-verification-information-available-to-software-acquirers) | Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. - | Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. - | -| [[PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release](#psps3ps31-securely-archive-the-necessary-files-and-supporting-data-to-be-retained-for-each-software-release) | Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release - | Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. - | -| [[PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release](#psps3ps32-collect-safeguard-maintain-and-share-provenance-data-for-all-components-of-each-software-release) | Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) - | Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. - | +| [[PS/PS.1/PS.1.1] Store all forms of code based on the principle of least privilege](#psps1ps11-store-all-forms-of-code-based-on-the-principle-of-least-privilege) | Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. | Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. | +| [[PS/PS.2/PS.2.1] Make software integrity verification information available to software acquirers](#psps2ps21-make-software-integrity-verification-information-available-to-software-acquirers) | Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. | Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. | +| [[PS/PS.3/PS.3.1] Securely archive the necessary files and supporting data to be retained for each software release](#psps3ps31-securely-archive-the-necessary-files-and-supporting-data-to-be-retained-for-each-software-release) | Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release | Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. | +| [[PS/PS.3/PS.3.2] Collect, safeguard, maintain, and share provenance data for all components of each software release](#psps3ps32-collect-safeguard-maintain-and-share-provenance-data-for-all-components-of-each-software-release) | Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) | Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. | ## Evidence Defaults @@ -44,11 +36,9 @@ Evaluate PS rules from the SSDF initiative Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access. - ### Mitigation Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -64,11 +54,9 @@ Implement strict access controls, enforce multi-factor authentication (MFA), and Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with. - ### Mitigation Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -80,11 +68,9 @@ Use cryptographic signatures to sign software releases and provide a way for use Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release - ### Mitigation Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure. - ### Rules | Rule ID | Rule Name | Rule Description | @@ -98,11 +84,9 @@ Ensure that provenance information is available for each software release Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM]) - ### Mitigation Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures. - ### Rules | Rule ID | Rule Name | Rule Description | From a7eb9e8434ea356d43b6e02d3b45cd1839df7fc2 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 9 Apr 2025 13:01:31 +0300 Subject: [PATCH 171/191] updated list of supported fields in the Match Context --- docs/valint/initiatives.md | 96 +++++++++++++++++++++++++------------- 1 file changed, 64 insertions(+), 32 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index d998ed7d7..d5720de11 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -602,53 +602,85 @@ The parameters are named the same way as they are in the evidence context. ```yaml name -context_type -input_scheme +product_version +labels +predicate_type input_name +input_scheme input_tag -predicate_type -product_version -pipeline_name -gate_type -gate_name -deliverable + +content_body_type +context_type +target_type +signed + tool -parser -tool_version tool_vendor -content_body_type +tool_version +format_encoding format_type format_version -format_encoding -labels -signed +gate_type +gate_name -workflow -job_name -run_id -build_num -actor +sbomname +sbomgroup +sbompurl +sbomversion +sbomhashs +sbomcomponents + +imageID +image_name +repoDigest +tag -git_url git_branch -git_tag +git_uuid git_commit git_ref -git_uuid +git_tag +git_url -sbomtype -sbomgroup -sbomname -sbomversion -sbompurl -sbomcomponents +pipeline_name +job_name +workflow +run_id +build_num +actor -target_git_url -target_git_branch -target_git_tag +target_git_brahc target_git_commit +target_git_uuid target_git_ref -target_type +target_git_tag +target_git_url + +dir_id +dir_path + +file_id +file_path + +parser +event_name +target_k8s_name +target_kind +target_namespace +content_type +organization +sbomtype + +ref +store + +warning +allow + +asset_id +asset_name +asset_type +asset_platform ``` From 973286aec51aabdb72c9beedce6792b2e9791b53 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 9 Apr 2025 13:01:44 +0300 Subject: [PATCH 172/191] updated the beautify flag description --- docs/valint/initiatives.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index d5720de11..5c61e521f 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -1028,6 +1028,7 @@ fail-on-missing-evidence: true ... ``` -### Unicode strings in rule results +### Rich text support in rule results -To make the rule results more readable, one can use Unicode emojis in the rule results by specifying the `--allow-unicode` flag at runtime. This would result in replacing rule levels and results in `valint` logs with emojis. +To make rule results more readable, one can specify the `--beautify` flag at runtime. This allows `valint` to use emojis and hyperlinks in result tables. +It affects both `valint` logs and other outputs, except for SARIF. From e8dfff34a942d7a09d186e1b6659a1a73ff4e9a9 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 9 Apr 2025 13:50:41 +0300 Subject: [PATCH 173/191] cosign update --- .../admission-controller/kyverno.md | 73 ++++++++++++++- docs/valint/cosign.md | 89 +++++++++++++++++++ 2 files changed, 160 insertions(+), 2 deletions(-) diff --git a/docs/integrating-scribe/admission-controller/kyverno.md b/docs/integrating-scribe/admission-controller/kyverno.md index 24ec04eda..fa05f9260 100644 --- a/docs/integrating-scribe/admission-controller/kyverno.md +++ b/docs/integrating-scribe/admission-controller/kyverno.md @@ -28,10 +28,10 @@ valint [bom,slsa] image -o attest --oci [--oci-repo repo] #### **Example** ```bash -valint my_account/my_image:latest -o attest --oci --oci-repo my_account/evidence --provenance +valint [bom, slsa, verify] [image] -o attest --oci --oci-repo my_account/evidence --provenance ``` -This command generates both SBOM and SLSA provenance and attaches them to the OCI store. +This command generates both SBOM and SLSA provenance or Policy Results and attaches them to the image on the OCI store. --- @@ -44,6 +44,8 @@ Use Valint to verify attestations or validate them against specific Kyverno poli valint verify [image] -i [attest, attest-slsa] --oci [--oci-repo evidence_repo] ``` + + ## Step 3 **Setting Kyverno `verifyImages` Rules** For detailed guidance on setting up Kyverno to verify image signatures, refer to the official **[Kyverno Verify Images documentation](https://kyverno.io/docs/writing-policies/verify-images/sigstore/#verifying-image-signatures)**. @@ -84,6 +86,7 @@ spec: url: https://rekor.sigstore.dev ``` + ### **X509 Key-Based Verification** Generate SLSA and Cyclonedx attestations signed with X509 certificates using the following command: @@ -222,3 +225,69 @@ X509v3 extensions: ... ``` +### Verifying Policy Initiative Results + +When Valint produces SARIF attestations, you may want to **enforce** that a specific **initiative** or **control** has passed before the image can run. For instance, you might block images unless their **`initiative-id`** is `"SP-800-190"` and **`initiative-result`** is `"pass"`, or you might need a particular control ID—like `"SP-800-190/4.1"`—to pass. + +Below is an example **Kyverno** policy snippet showing how to reference these fields under `conditions` in the `verifyImages` rule. **Uncomment or edit** the checks that meet your needs: + +```yaml +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: check-image-keyless-evidence +spec: + validationFailureAction: Enforce + webhookTimeoutSeconds: 30 + rules: + - name: check-evidence + match: + any: + - resources: + kinds: + - Pod + verifyImages: + - imageReferences: + - "my_account/my_image*" + repository: "my_account/evidence/container" + attestations: + - predicateType: "http://docs.oasis-open.org/sarif/sarif/2.1.0" + attestors: + - entries: + - keyless: + subject: "mdstrauss91@gmail.com" + issuer: "https://github.com/login/oauth" + rekor: + url: "https://rekor.sigstore.dev" + conditions: + - all: + # Uncomment the checks you wish to enforce: + + # 1) Ensure the initiative result is "pass": + - key: "{{ content.runs[0].invocations[0].properties.properties.\"initiative-result\" }}" + operator: Equals + value: "pass" + + # 2) Verify the initiative ID is "SP-800-190": + - key: "{{ content.runs[0].invocations[0].properties.properties.\"initiative-id\" }}" + operator: Equals + value: "SP-800-190" + + # 3) Confirm a specific control ID—"SP-800-190/4.1"—passed: + - key: "{{ content.runs[0].invocations[0].properties.properties.\"control-result\".\"control-id:SP-800-190/4.1\" }}" + operator: Equals + value: "pass" +``` + +To generate and evaluate evidence for `sp-800-190` in this example, run: + +```bash +trivy image --format sarif -o my_image_trivy_report.sarif my_account/my_image:latest + +valint verify my_account/my_image:latest \ + --bom \ # Required for container-targeted rules + --input my_image_trivy_report.sarif \ # Required for CVE rules + --oci --oci-repo my_account/evidence/container \ + --initiative sp-800-190@v2 \ + -o attest +``` \ No newline at end of file diff --git a/docs/valint/cosign.md b/docs/valint/cosign.md index 2d236bf3c..f69962222 100644 --- a/docs/valint/cosign.md +++ b/docs/valint/cosign.md @@ -106,3 +106,92 @@ X509v3 extensions: ... ``` +Below is an **example** of how you can fill in three new headings regarding verifying SBOMs, SLSA, and policy results with Cosign. Each section uses **keyless** signing as an example, though the same commands can be adapted for key-based or certificate-based flows. + +--- + +### Verifying SBOMs with Cosign + +If you’ve generated an SBOM (for example, CycloneDX) and pushed it to the registry as an attestation, you can verify its authenticity with Cosign. In this **keyless** example, Cosign retrieves the SBOM attestation from the registry and checks its signature: + +```bash +# Generate and attach SBOM attestation with Valint +valint bom my_account/my_image:latest --oci -o attest + +# Verify the SBOM attestation using cosign +cosign verify-attestation my_account/my_image:latest \ + --type https://cyclonedx.org/bom/v1.5 \ + --certificate-identity="name@example.com" \ + --certificate-oidc-issuer="https://github.com/login/oauth" +``` + +> **Note**: `--type https://cyclonedx.org/bom/v1.5` tells Cosign to fetch only SBOM attestations of that type. +> **Reminder**: These examples use Cosign **keyless** signing. +--- + +### Verifying SLSA with Cosign + +Valint can generate an **SLSA** (Supply chain Levels for Software Artifacts) provenance statement. After signing and pushing it to your OCI registry, you can confirm its validity with Cosign: + +```bash +# Generate and attach SLSA provenance +valint slsa my_account/my_image:latest --oci -o attest + +# Verify the SLSA attestation using cosign (keyless flow) +cosign verify-attestation my_account/my_image:latest \ + --type https://slsa.dev/provenance/v1 \ + --certificate-identity="name@example.com" \ + --certificate-oidc-issuer="https://github.com/login/oauth" +``` + +This ensures your SLSA provenance is signed by the correct subject and issuer. + +> **Reminder**: These examples use Cosign **keyless** signing. +--- + +### Verifying Policy Results with Cosign + +You might also store policy or compliance results (e.g., from Valint scanning) as an attestation—often in SARIF format. Cosign can verify these policy-result attestations, ensuring they’re both **trusted** and **unaltered**: + +```bash +# Generate and push SARIF-based policy results +valint verify my_account/my_image:latest --oci \ + --predicate results.sarif \ + --type "http://docs.oasis-open.org/sarif/sarif/2.1.0" \ + -o attest + +# Verify the SARIF attestation with Cosign (keyless) +cosign verify-attestation my_account/my_image:latest \ + --type http://docs.oasis-open.org/sarif/sarif/2.1.0 \ + --certificate-identity="name@example.com" \ + --certificate-oidc-issuer="https://github.com/login/oauth" +``` + +By confirming the attestation’s signature, you ensure the **policy results** remain **authentic** and tamper-free when consumed by other parts of your supply chain (e.g., an admission controller). + +> **Reminder**: These examples use Cosign **keyless** signing. +--- + +### Using `--oci-repo` and the `COSIGN_REPOSITORY` Environment Variable + +When using **Valint** with the `--oci-repo` flag to push evidence (SBOMs, SLSA, policy results) to an OCI registry, you typically need to align your **Cosign** settings accordingly. Specifically, **Cosign** references an environment variable called `COSIGN_REPOSITORY` to know which path in the registry to store or fetch attestation artifacts. + +1. **Valint** pushes evidence to `--oci-repo`, suffixed with `"/container"` for container artifacts. +2. **Cosign** must have `COSIGN_REPOSITORY` set to **` + "/container"`** so it looks in the correct path. + +For example, if you run: + +```bash +valint [bom, verify, slsa, etc.] my_account/my_image:latest \ + --oci \ + --oci-repo my_account/evidence \ + -o attest +``` +Valint will place container artifacts under `my_account/evidence/container` in the registry. +To ensure Cosign sees them correctly, set: +```bash +export COSIGN_REPOSITORY="my_account/evidence/container" +``` + +> **Why the `/container` suffix?** +> Valint (and many OCI-based workflows) distinguish different artifact types (like source code vs. container images) by placing them in subdirectories. This lets you store other assets (e.g., “source” or “sbom” paths) in the same repository without collisions. \ No newline at end of file From 2ad085a58b2ed9ac000d0aa22aeff1088fa38e0a Mon Sep 17 00:00:00 2001 From: mikey strauss Date: Wed, 9 Apr 2025 14:03:04 +0300 Subject: [PATCH 174/191] Update docs/configuration/initiatives/rules/api/scribe-api-cve.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- docs/configuration/initiatives/rules/api/scribe-api-cve.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 2658ceca7..66a460a0a 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -9,8 +9,7 @@ title: Verify No Critical or High Vulnerabilities **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe -Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). - +Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). :::tip Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: From 7b052427700f2ca565d6177cd2cd44d449fc13ee Mon Sep 17 00:00:00 2001 From: mikey strauss Date: Wed, 9 Apr 2025 14:03:12 +0300 Subject: [PATCH 175/191] Update docs/configuration/initiatives/rules/api/scribe-api-cve-product.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../initiatives/rules/api/scribe-api-cve-product.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index 013c9e460..75fb7eff2 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -9,8 +9,7 @@ title: Verify No Critical or High Vulnerabilities in Product **Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** SCA, Blueprint, Scribe -Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. - +Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. :::tip Evidence **IS NOT** required for this rule. ::: From f9cfe55170dd6cba9a2b614f8dc3fbba1a1fbedf Mon Sep 17 00:00:00 2001 From: mikey strauss Date: Wed, 9 Apr 2025 14:03:29 +0300 Subject: [PATCH 176/191] Update docs/configuration/initiatives/rules/api/scribe-api.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- docs/configuration/initiatives/rules/api/scribe-api.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index 77616e83a..c6d9d3c9f 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -8,8 +8,7 @@ title: Apply Scribe Template Policy **Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) **Labels:** Scribe -Verify XX using the Scribe API template rule. - +Verify the application of the Scribe Template Policy using the Scribe API template rule. :::tip Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: From ac9489e85f0ee805345aef77681a122653d5331e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 9 Apr 2025 15:33:03 +0300 Subject: [PATCH 177/191] updated list of supported fields in the Match Context --- docs/valint/initiatives.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 5c61e521f..bec91be56 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -671,9 +671,6 @@ content_type organization sbomtype -ref -store - warning allow From c85c9e9ad2f2fa806348dad601f432570113273e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 14 Apr 2025 17:31:33 +0300 Subject: [PATCH 178/191] added migration example --- docs/guides/enforcing-sdlc-initiative.md | 30 +++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 78b80529b..e16e24762 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -362,9 +362,37 @@ including smart filtering as shown in the [Rule Filtering](../valint/initiatives ::: :::note -Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [here](#sample-policy-catalog) for more details. +Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details. ::: +#### Example + +Let's take SLSA L2 as an example. Prior to `valint v2.0.0`, one could verify a single SLSA L2 rule using the following command: + +```bash +valint verify alpine:latest --rule slsa/l2-provenance-authenticated@v1 --product-key --product-version +``` + +This command would verify the `alpine:latest` image against the `slsa/l2-provenance-authenticated` rule. + +To run v2 of the same rule, you could simply replace `@v1` with `@v2` in the command shown above. +However, with the initiatives available, it is recommended to run the following command: + +```bash +valint verify alpine:latest --initiative slsa.l2@v2 --product-key --product-version +``` + +This command will verify the `alpine:latest` image against all rules in the SLSA L2 initiative, including `slsa/l2-provenance-authenticated`. + +We recommend using the initiative configuration also for SLSA L1, as it provides better result descriptions and integration with the Scribe service. +In that case, the command will look like this: + +```bash +valint verify alpine:latest --initiative slsa.l1@v2 --product-key --product-version +``` + +To get more information about initiatives provided in the Scribe Policy Catalog, see the [Sample Policy Catalog](#sample-policy-catalog) section. + ## Sample Policy Catalog We provide a set of sample initiatives and rules that can be used to verify the compliance of your software supply chain. This catalog is used by `valint` by default. From fce3543e0dec0833864eff21e747d0aa5c36809e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 14 Apr 2025 17:53:44 +0300 Subject: [PATCH 179/191] updated generated docs --- docs/configuration/initiatives/index.md | 12 +- .../rules/api/scribe-api-cve-product.md | 1 + .../initiatives/rules/api/scribe-api-cve.md | 1 + .../initiatives/rules/api/scribe-api.md | 3 +- docs/configuration/initiatives/sspb.md | 6 +- docs/guides/enforcing-sdlc-initiative.md | 413 +++++++++--------- 6 files changed, 217 insertions(+), 219 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 851d4f296..ad42b8b35 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -5,12 +5,12 @@ | Name | Description | |------|-------------| -| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | +| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | | [NIST Supply Chain Integrity Initiative](/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | +| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | | [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | | [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab | -| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | ## Rules @@ -47,7 +47,7 @@ | [Fresh Image](/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | | [Allowed Main Image Source](/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | | [Require Signed Container Image](/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | | [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/sbom/banned-users.md) | Verify specific users are not allowed in an SBOM. | | [Enforce SBOM Dependencies](/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies. | | [Enforce SBOM License Completeness](/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | @@ -303,4 +303,6 @@ | [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | | [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | | [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | -| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. | + + \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index 75fb7eff2..69daeee85 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -10,6 +10,7 @@ title: Verify No Critical or High Vulnerabilities in Product **Labels:** SCA, Blueprint, Scribe Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. + :::tip Evidence **IS NOT** required for this rule. ::: diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 66a460a0a..9cf3d3ac8 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -10,6 +10,7 @@ title: Verify No Critical or High Vulnerabilities **Labels:** SCA, Blueprint, Scribe Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). + :::tip Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index c6d9d3c9f..77616e83a 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -8,7 +8,8 @@ title: Apply Scribe Template Policy **Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) **Labels:** Scribe -Verify the application of the Scribe Template Policy using the Scribe API template rule. +Verify XX using the Scribe API template rule. + :::tip Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: diff --git a/docs/configuration/initiatives/sspb.md b/docs/configuration/initiatives/sspb.md index 2f8b7ea58..5a0380551 100644 --- a/docs/configuration/initiatives/sspb.md +++ b/docs/configuration/initiatives/sspb.md @@ -146,7 +146,7 @@ Early detection reduces remediation costs, but also requires a well-defined vuln | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CTL-8] Validate artifact digest @@ -206,7 +206,7 @@ Container images must be scanned before deployment to prevent the inclusion of i | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | ## [CTL-12] Validate artifact signatures and digests @@ -248,4 +248,4 @@ Production images should be validated to ensure that controls enforced during ea |---------|-----------|------------------| | [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | | [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | -| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index e16e24762..f599a7a91 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -403,332 +403,325 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | Name | Description | |------|-------------| -| [Blueprint for Secure Pipelines](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/bp1) | Blueprint for secure pipelines - Gitlab | -| [SLSA L1 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1) | Evaluate SLSA Level 1 | -| [NIST Supply Chain Integrity Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-53) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | -| [SSDF Client Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/ssdf) | Evaluate PS rules from the SSDF initiative | -| [NIST Application Container Security Initiative](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/sp-800-190) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | -| [SLSA L2 Framework](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2) | Evaluate SLSA Level 2 | +| [NIST Application Container Security Initiative](/docs/configuration/initiatives/sp-800-190.md) | This initiative enforces container security controls as outlined in NIST SP 800-190. It ensures that containerized applications follow security best practices, including vulnerability scanning, trusted image sources, registry security, and proper configuration to minimize risk. The initiative enables policy-driven enforcement of security controls throughout the software development lifecycle (SDLC), providing real-time feedback to developers and enforcement in CI/CD pipelines. | +| [NIST Supply Chain Integrity Initiative](/docs/configuration/initiatives/sp-800-53.md) | This initiative enforces key supply chain requirements from NIST SP 800-53. It mandates that container builds include: - A Software Bill of Materials (SBOM) to ensure component inventory and traceability, addressing requirements from SR-4 and CM-8. - Provenance data to support architectural traceability, as outlined in SA-8. Both the SBOM and the provenance artifacts must be cryptographically signed to meet integrity requirements specified in SA-12. | +| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | +| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | +| [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | +| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab | ## Rules ### SBOM -**Evidence Type:** [SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Apply Scribe Template Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api) | Verify XX using the Scribe API template rule. | -| [Scribe Published Policy](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-published) | Verify image Scribe Publish flag is set for container image. | -| [NTIA SBOM Compliance Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/NTIA-compliance) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | -| [Enforce SBOM Freshness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/fresh-sbom) | Verify the SBOM is not older than the specified duration. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/evidence-exists) | Verify the SBOM exists as evidence. | -| [Require SBOM Signature](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed) | Verify the SBOM is signed. | -| [Require SBOM Existence](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/require-sbom) | Verify the SBOM exists as evidence. | +| [Apply Scribe Template Policy](/docs/configuration/initiatives/rules/api/scribe-api.md) | Verify XX using the Scribe API template rule. | +| [Scribe Published Policy](/docs/configuration/initiatives/rules/api/scribe-api-published.md) | Verify image Scribe Publish flag is set for container image. | +| [NTIA SBOM Compliance Check](/docs/configuration/initiatives/rules/sbom/NTIA-compliance.md) | Validates that SBOM metadata meets basic NTIA requirements for authors and supplier. | +| [Enforce SBOM Freshness](/docs/configuration/initiatives/rules/sbom/fresh-sbom.md) | Verify the SBOM is not older than the specified duration. | +| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | +| [Require SBOM Signature](/docs/configuration/initiatives/rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [Require SBOM Existence](/docs/configuration/initiatives/rules/sbom/require-sbom.md) | Verify the SBOM exists as evidence. | ### Image SBOM -**Evidence Type:** [Image SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [Image SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Verify File Integrity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/multievidence/files_integrity) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | -| [Verify Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels) | Verify specified labels key-value pairs exist in the image. | -| [Forbid Large Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/forbid-large-images) | Verify the image size is below the specified threshold. | -| [Disallow Container Shell Entrypoint](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint) | Verify the container image disallows shell entrypoint. | -| [Fresh Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-base-image) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | -| [Banned Ports](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-ports) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Restrict Build Scripts](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/blocklist-build-scripts) | Verify no build scripts commands appear in block list. | -| [Registry Connection HTTPS](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/enforce-https-registry) | Checks if the container's registry scheme is HTTPS | -| [Require Image Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/verify-labels-exist) | Verify the image has the specified labels. | -| [Require Healthcheck](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/require-healthcheck) | Checks that the container image includes at least one healthcheck property. | -| [Allowed Base Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-base-image) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | -| [Fresh Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/fresh-image) | Verify the image is not older than the specified threshold. | -| [Allowed Main Image Source](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/allowed-image-source) | Ensures the main container image referenced in the SBOM is from an approved source. | -| [Require Signed Container Image](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/images/image-signed) | Enforces that container images (target_type=container) are cryptographically signed. | -| [Verify No Critical or High Vulnerabilities](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve) | Verify via Scribe API that there no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | -| [Disallow Specific Users in SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-users) | Verify specific users are not allowed in an SBOM. | -| [Enforce SBOM Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/required-packages) | Verify the artifact includes all required dependencies. | -| [Enforce SBOM License Completeness](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/complete-licenses) | Verify all dependencies in the artifact have a license. | -| [Restrict Disallowed SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/banned-licenses) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | -| [Enforce Allowed SBOM Components](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/allowed-components) | Verify the artifact contains only allowed components. | -| [Require Specified SBOM Licenses](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/verify-huggingface-license) | Verify the artifact includes all specified licenses. | -| [Restrict Disallowed Dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/blocklist-packages) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | +| [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | +| [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | +| [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | +| [Fresh Base Image](/docs/configuration/initiatives/rules/images/fresh-base-image.md) | Verifies that each base image is not older than the specified threshold (max_days) from its creation date. | +| [Banned Ports](/docs/configuration/initiatives/rules/images/banned-ports.md) | Ensures that the container image does not expose ports that are disallowed by organizational policy. The rule examines properties in the SBOM metadata and checks each value (expected in the format "port/protocol") against a provided banned ports list. It fails if any banned port is exposed or if no banned ports list is provided. | +| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/images/banned-users.md) | Verify specific users are not allowed in an SBOM. | +| [Restrict Build Scripts](/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md) | Verify no build scripts commands appear in block list. | +| [Registry Connection HTTPS](/docs/configuration/initiatives/rules/images/enforce-https-registry.md) | Checks if the container's registry scheme is HTTPS | +| [Require Image Labels](/docs/configuration/initiatives/rules/images/verify-labels-exist.md) | Verify the image has the specified labels. | +| [Require Healthcheck](/docs/configuration/initiatives/rules/images/require-healthcheck.md) | Checks that the container image includes at least one healthcheck property. | +| [Allowed Base Image](/docs/configuration/initiatives/rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | +| [Fresh Image](/docs/configuration/initiatives/rules/images/fresh-image.md) | Verify the image is not older than the specified threshold. | +| [Allowed Main Image Source](/docs/configuration/initiatives/rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | +| [Require Signed Container Image](/docs/configuration/initiatives/rules/images/image-signed.md) | Enforces that container images (target_type=container) are cryptographically signed. | +| [Verify No Critical or High Vulnerabilities](/docs/configuration/initiatives/rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +| [Disallow Specific Users in SBOM](/docs/configuration/initiatives/rules/sbom/banned-users.md) | Verify specific users are not allowed in an SBOM. | +| [Enforce SBOM Dependencies](/docs/configuration/initiatives/rules/sbom/required-packages.md) | Verify the artifact includes all required dependencies. | +| [Enforce SBOM License Completeness](/docs/configuration/initiatives/rules/sbom/complete-licenses.md) | Verify all dependencies in the artifact have a license. | +| [Restrict Disallowed SBOM Licenses](/docs/configuration/initiatives/rules/sbom/banned-licenses.md) | Verify the number of disallowed licenses in SBOM dependencies remains below the specified threshold. | +| [Enforce Allowed SBOM Components](/docs/configuration/initiatives/rules/sbom/allowed-components.md) | Verify the artifact contains only allowed components. | +| [Require Specified SBOM Licenses](/docs/configuration/initiatives/rules/sbom/verify-huggingface-license.md) | Verify the artifact includes all specified licenses. | +| [Restrict Disallowed Dependencies](/docs/configuration/initiatives/rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | ### Git SBOM -**Evidence Type:** [Git SBOM](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sbom) +**Evidence Type:** [Git SBOM](/docs/valint/sbom) | Rule Name | Description | |-----------|-------------| -| [Restrict Coding Permissions](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/coding-permissions) | Verify only allowed users committed to the repository. | -| [Required Git Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/evidence-exists) | Verify required Git evidence exists. | -| [Git Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/artifact-signed) | Verify the Git artifact is signed. | -| [Disallow Commits to Main Branch](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-commit-to-main) | Verify commits made directly to the main branch are disallowed. | -| [Disallow Unsigned Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/git/no-unsigned-commits) | Verify all commits are signed. | +| [Restrict Coding Permissions](/docs/configuration/initiatives/rules/git/coding-permissions.md) | Verify only allowed users committed to the repository. | +| [Required Git Evidence Exists](/docs/configuration/initiatives/rules/git/evidence-exists.md) | Verify required Git evidence exists. | +| [Git Artifact Signed](/docs/configuration/initiatives/rules/git/artifact-signed.md) | Verify the Git artifact is signed. | +| [Disallow Commits to Main Branch](/docs/configuration/initiatives/rules/git/no-commit-to-main.md) | Verify commits made directly to the main branch are disallowed. | +| [Disallow Unsigned Commits](/docs/configuration/initiatives/rules/git/no-unsigned-commits.md) | Verify all commits are signed. | ### SARIF Evidence -**Evidence Type:** [SARIF Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/sarif) +**Evidence Type:** [SARIF Evidence](/docs/valint/sarif) | Rule Name | Description | |-----------|-------------| -| [Verify Attack Vector Exists in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-attack-vector) | Verify required evidence validates attack vectors in the SARIF report. | -| [Verify IaC Misconfiguration Threshold in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/report-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | -| [Verify Required Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/evidence-exists) | Verify all required evidence exists as defined by the SARIF policy. | -| [Verify Artifact Signature in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/artifact-signed) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | -| [Verify Rule Compliance in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-sarif) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | -| [Verify Tool Evidence in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-tool-evidence) | Verify required tools were used to generate the SARIF report. | -| [Verify Semgrep Rule in SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/verify-semgrep-report) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify Trivy SARIF Report Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | -| [Verify IaC Misconfiguration Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | -| [Trivy Blocklist CVE Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve) | Verify a CVE Blocklist against a SARIF report | -| [Trivy Vulnerability Findings Check](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | -| [Verify Attack Vector Threshold in Trivy SARIF](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | -| [SARIF Update Needed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed) | Verify no security packages require updates. | -| [K8s Jailbreak](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/k8s-jailbreak) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | +| [Verify Attack Vector Exists in SARIF](/docs/configuration/initiatives/rules/sarif/verify-attack-vector.md) | Verify required evidence validates attack vectors in the SARIF report. | +| [Verify IaC Misconfiguration Threshold in SARIF](/docs/configuration/initiatives/rules/sarif/report-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the SARIF report remains below the specified threshold. | +| [Verify Required Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/evidence-exists.md) | Verify all required evidence exists as defined by the SARIF policy. | +| [Verify Artifact Signature in SARIF](/docs/configuration/initiatives/rules/sarif/artifact-signed.md) | Verify the artifact referenced in the SARIF report is signed to confirm its integrity. | +| [Verify Rule Compliance in SARIF](/docs/configuration/initiatives/rules/sarif/verify-sarif.md) | Verify the SARIF report complies with defined generic rules for compliance and security. vulnerability profiles. | +| [Verify Tool Evidence in SARIF](/docs/configuration/initiatives/rules/sarif/verify-tool-evidence.md) | Verify required tools were used to generate the SARIF report. | +| [Verify Semgrep Rule in SARIF](/docs/configuration/initiatives/rules/sarif/verify-semgrep-report.md) | Verify the Semgrep SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify Trivy SARIF Report Compliance](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-report.md) | Verify the Trivy SARIF report complies with predefined rules to ensure compliance and detect issues. | +| [Verify IaC Misconfiguration Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/report-trivy-iac-errors.md) | Verify the number of infrastructure-as-code (IaC) errors in the Trivy SARIF report remains below the specified threshold. | +| [Trivy Blocklist CVE Check](/docs/configuration/initiatives/rules/sarif/trivy/blocklist-cve.md) | Verify a CVE Blocklist against a SARIF report | +| [Trivy Vulnerability Findings Check](/docs/configuration/initiatives/rules/sarif/trivy/verify-cve-severity.md) | Verifies that vulnerability findings in the SARIF evidence from Trivy do not exceed the defined severity threshold. | +| [Verify Attack Vector Threshold in Trivy SARIF](/docs/configuration/initiatives/rules/sarif/trivy/verify-trivy-attack-vector.md) | Verify no attack vector in the Trivy SARIF report exceeds the specified threshold. | +| [SARIF Update Needed](/docs/configuration/initiatives/rules/sarif/patcheck/updates-needed.md) | Verify no security packages require updates. | +| [K8s Jailbreak](/docs/configuration/initiatives/rules/generic/k8s-jailbreak.md) | Verify no misconfigurations from the prohibited ids list in the Kuberentes scan is below specified threshold | ### Generic Statement -**Evidence Type:** [Generic Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) +**Evidence Type:** [Generic Statement](/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Required Trivy Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/trivy-exists) | Verify required Trivy evidence exists | -| [Required Generic Evidence Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/evidence-exists) | Verify required evidence exists. | -| [Generic Artifact Signed](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/generic/artifact-signed) | Verify required evidence is signed. | +| [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | +| [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. | +| [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. | ### Github Organization Discovery Evidence -**Evidence Type:** [Github Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) +**Evidence Type:** [Github Organization Discovery Evidence](/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify members_can_create_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-repos) | Verify `members_can_create_repositories` is appropriately configured in the GitHub repository. | -| [Verify `secret_scanning_push_protection` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection-sa) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | -| [Verify `secret_scanning_validity_checks_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks) | Verify `secret_scanning_validity_checks` is configured in the GitHub repository. | -| [Verify dependabot_security_updates_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | -| [Verify `secret_scanning` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning-sa) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Limit Admin Number in GitHub Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins) | Verify the maximum number of GitHub organization admins is restricted. | -| [Verify `advanced_security_enabled_for_new_repositories` setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/advanced-security) | Verify `advanced_security` is enabled for new repositories in the GitHub organization. | -| [Verify dependency_graph_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependency-graph) | Verify `dependency_graph` is enabled for new repositories in the GitHub organization. | -| [Verify GitHub Organization Requires Signoff on Web Commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff) | Verify contributors sign commits through the GitHub web interface. | -| [Verify two_factor_requirement_enabled setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa) | Verify `two_factor_requirement` is enabled in the GitHub organization. | -| [Verify GitHub Organization Secrets Are Not Too Old](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/old-secrets) | Verify secrets in the GitHub organization are not older than the specified threshold. | -| [Allowed GitHub Organization Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | -| [Verify secret_scanning_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/secret-scanning) | Verify `secret_scanning` is enabled for new repositories in the GitHub organization. | -| [Allowed GitHub Organization Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/allow-users) | Verify only users in the Allowed List have user access to the GitHub organization. | -| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/pp-custom-link) | Verify `secret_scanning_push_protection_custom_link` is enabled in the GitHub organization. | -| [Verify dependabot_security_updates setting in security_and_analysis](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa) | Verify Dependabot security updates are configured in the GitHub organization. | -| [Verify members_can_create_private_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/create-private-repos) | Verify `members_can_create_private_repositories` is configured in the GitHub organization (supported only in GitHub Enterprise). | -| [Verify Repo Visibility Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/repo-visibility) | Verify only repositories in the Allowed List are public in the GitHub organization. | -| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/validity-checks-sa) | Verify `secret_scanning_validity_checks` is configured in the GitHub organization. | -| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/push-protection) | Verify `secret_scanning_push_protection` is enabled for new repositories in the GitHub organization. | -| [Verify dependabot_alerts_enabled_for_new_repositories setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/dependabot-alerts) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | +| [Verify members_can_create_repositories setting](/docs/configuration/initiatives/rules/github/org/create-repos.md) | Verify only allowed users can create repositories in the GitHub organization. | +| [Verify `secret_scanning_push_protection` Setting](/docs/configuration/initiatives/rules/github/org/push-protection-sa.md) | Verify secret scanning push protection is configured in the GitHub repository. | +| [Verify `secret_scanning_validity_checks_enabled` Setting](/docs/configuration/initiatives/rules/github/org/validity-checks.md) | Verify validity checks for secrets are configured for the GitHub repository. | +| [Verify dependabot_security_updates_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates.md) | Verify Dependabot security updates for new repositories are configured in the GitHub organization. | +| [Verify `secret_scanning` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/secret-scanning-sa.md) | Verify secret scanning is configured in the GitHub repository. | +| [Limit Admin Number in GitHub Organization](/docs/configuration/initiatives/rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | +| [Verify `advanced_security_enabled_for_new_repositories` setting](/docs/configuration/initiatives/rules/github/org/advanced-security.md) | Verify Advanced Security is enabled for new repositories in the GitHub organization. | +| [Verify dependency_graph_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependency-graph.md) | Verify dependency graph is enabled for new repositories in the GitHub organization. | +| [Verify GitHub Organization Requires Signoff on Web Commits](/docs/configuration/initiatives/rules/github/org/web-commit-signoff.md) | Verify contributors sign commits through the GitHub web interface. | +| [Verify Two-Factor Authentication (2FA) Requirement Enabled](/docs/configuration/initiatives/rules/github/org/2fa.md) | Verify Two-factor Authentication is required in the GitHub organization. | +| [Verify GitHub Organization Secrets Are Not Too Old](/docs/configuration/initiatives/rules/github/org/old-secrets.md) | Verify secrets in the GitHub organization are not older than the specified threshold. | +| [Allowed GitHub Organization Admins](/docs/configuration/initiatives/rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | +| [Verify secret_scanning_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/secret-scanning.md) | Verify secret scanning is configured for new repositories in the GitHub organization. | +| [Allowed GitHub Organization Users](/docs/configuration/initiatives/rules/github/org/allow-users.md) | Verify only users in the Allowed List have user access to the GitHub organization. | +| [Verify `secret_scanning_push_protection_custom_link_enabled` Setting](/docs/configuration/initiatives/rules/github/org/pp-custom-link.md) | Verify secret scanning push protection custom link is enabled in the GitHub organization. | +| [Verify dependabot_security_updates setting in security_and_analysis](/docs/configuration/initiatives/rules/github/org/dependabot-security-updates-sa.md) | Verify Dependabot security updates are configured in the GitHub organization. | +| [Verify that members can create private repositories setting is configured](/docs/configuration/initiatives/rules/github/org/create-private-repos.md) | Verify only allowed users can create private repositories in the GitHub organization. | +| [Verify Repo Visibility Setting](/docs/configuration/initiatives/rules/github/org/repo-visibility.md) | Verify only repositories in the Allowed List are public in the GitHub organization. | +| [Verify `secret_scanning_validity_checks` Setting in `security_and_analysis`](/docs/configuration/initiatives/rules/github/org/validity-checks-sa.md) | Verify validity checks for secrets are configured for the GitHub organization. | +| [Verify `secret_scanning_push_protection_enabled_for_new_repositories` Setting](/docs/configuration/initiatives/rules/github/org/push-protection.md) | Verify secret scanning push protection is enabled for new repositories in the GitHub organization. | +| [Verify dependabot_alerts_enabled_for_new_repositories setting](/docs/configuration/initiatives/rules/github/org/dependabot-alerts.md) | Verify Dependabot alerts for new repositories are enabled in the GitHub organization. | ### Github Repository Discovery Evidence -**Evidence Type:** [Github Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#github-discovery) +**Evidence Type:** [Github Repository Discovery Evidence](/docs/platforms/discover#github-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify secret scanning.](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/validity-checks) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | -| [Verify Dependabot security updates setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/dependabot) | Verify Dependabot security updates are configured in the GitHub repository. | -| [Verify Repository Is Private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private) | Verify the GitHub repository is private. | -| [Verify Repository Requires Commit Signoff](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/web-commit-signoff) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | -| [Verify Default Branch Protection](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/default-branch-protection) | Verify the default branch protection is configured in the GitHub repository. | -| [Verify No Old Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/old-secrets) | Verify secrets in the GitHub repository are not older than the specified threshold. | -| [Verify No Organization Secrets Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-org-secrets) | Verify no organization secrets exist in the GitHub repository. | -| [Verify Branch Verification Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-verification) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | -| [Verify Branch Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection) | Verify branch protection is configured in the GitHub repository. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/signed-commits) | Verify all commits are signed in a repository attestation. | -| [Verify secret_scanning setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/secret-scanning) | Verify `secret_scanning` is configured in the GitHub repository. | -| [Verify No Cache Usage Exists in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/no-cache-usage) | Verify the GitHub repository has no cache usage. | -| [Verify All Commits Are Signed in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/check-signed-commits) | Verify all commits in the GitHub repository are signed. | -| [Verify Only Ephemeral Runners Exist in Repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only) | Verify self-hosted runners are disallowed in the GitHub repository. | -| [Allowed Public Repositories](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/visibility) | Verify only GitHub repositories in the Allowed List are public. | -| [Verify Push Protection Setting](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/push-protection) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | +| [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | +| [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | +| [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | +| [Verify Repository Requires Commit Signoff](/docs/configuration/initiatives/rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | +| [Verify Default Branch Protection](/docs/configuration/initiatives/rules/github/repository/default-branch-protection.md) | Verify the default branch protection is configured in the GitHub repository. | +| [Verify No Old Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/old-secrets.md) | Verify secrets in the GitHub repository are not older than the specified threshold. | +| [Verify No Organization Secrets Exist in Repository](/docs/configuration/initiatives/rules/github/repository/no-org-secrets.md) | Verify no organization secrets exist in the GitHub repository. | +| [Verify Branch Verification Setting](/docs/configuration/initiatives/rules/github/repository/branch-verification.md) | Verify branch verification in the GitHub repository matches the value defined in the configuration file. | +| [Verify Branch Protection Setting](/docs/configuration/initiatives/rules/github/repository/branch-protection.md) | Verify branch protection is configured in the GitHub repository. | +| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | +| [Verify secret_scanning setting](/docs/configuration/initiatives/rules/github/repository/secret-scanning.md) | Verify `secret_scanning` is configured in the GitHub repository. | +| [Verify No Cache Usage Exists in Repository](/docs/configuration/initiatives/rules/github/repository/no-cache-usage.md) | Verify the GitHub repository has no cache usage. | +| [Verify All Commits Are Signed in Repository](/docs/configuration/initiatives/rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | +| [Verify Only Ephemeral Runners Exist in Repository](/docs/configuration/initiatives/rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | +| [Allowed Public Repositories](/docs/configuration/initiatives/rules/github/repository/visibility.md) | Verify only GitHub repositories in the Allowed List are public. | +| [Verify Push Protection Setting](/docs/configuration/initiatives/rules/github/repository/push-protection.md) | Verify `secret_scanning_push_protection` is configured in the GitHub repository. | ### Gitlab Organization Discovery Evidence -**Evidence Type:** [Gitlab Organization Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Organization Discovery Evidence](/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Limit Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/max-admins) | Verify the maximum number of admins for the GitLab project is restricted. | -| [Ensure Active Projects in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/inactive-projects) | Verify no GitLab organization projects are inactive. | -| [Restrict Public Visibility in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/projects-visibility) | Verify only allowed projects in the GitLab organization have public visibility. | -| [Allowed Admins in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-admins) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | -| [Forbid Long-Lived Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens) | Verify no GitLab organization tokens have an excessively long lifespan. | -| [Forbid Unused Tokens in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/unused-tokens) | Verify there are no unused GitLab organization tokens. | -| [Allowed Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-users) | Verify only users in the Allowed List have access to the GitLab organization. | -| [Restrict Token Scopes in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | -| [Block Users in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/blocked-users) | Verify no users in the GitLab organization are on the block list. | -| [Prevent Token Expiration in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens) | Verify no GitLab organization tokens are about to expire. | -| [Forbid Token Scopes in GitLab Organization](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes) | Verify no GitLab organization tokens have disallowed scopes. | +| [Limit Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [Ensure Active Projects in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/inactive-projects.md) | Verify no GitLab organization projects are inactive. | +| [Restrict Public Visibility in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/projects-visibility.md) | Verify only allowed projects in the GitLab organization have public visibility. | +| [Allowed Admins in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | +| [Forbid Long-Lived Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/longlive-tokens.md) | Verify no GitLab organization tokens have an excessively long lifespan. | +| [Forbid Unused Tokens in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/unused-tokens.md) | Verify there are no unused GitLab organization tokens. | +| [Allowed Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/allow-users.md) | Verify only users in the Allowed List have access to the GitLab organization. | +| [Restrict Token Scopes in GitLab](/docs/configuration/initiatives/rules/gitlab/org/allow-token-scopes.md) | Verify all tokens in the GitLab organization are restricted to allowed scopes to prevent excessive permission. | +| [Block Users in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/blocked-users.md) | Verify no users in the GitLab organization are on the block list. | +| [Prevent Token Expiration in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/expiring-tokens.md) | Verify no GitLab organization tokens are about to expire. | +| [Forbid Token Scopes in GitLab Organization](/docs/configuration/initiatives/rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | ### Gitlab Project Discovery Evidence -**Evidence Type:** [Gitlab Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#gitlab-discovery) +**Evidence Type:** [Gitlab Project Discovery Evidence](/docs/platforms/discover#gitlab-discovery) | Rule Name | Description | |-----------|-------------| -| [Merge approval policy check for GitLab project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check) | Verify the project's merge approval policy complies with requirements. | -| [Set Push Rules for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-rules-set) | Verify push rules are set for the GitLab project. | -| [Disable Committers' Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | -| [Restrict Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check) | Verify only GitLab project users in the Allowed List have commit author permissions. | -| [Require Minimal Approvers in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers) | Verify the required number of approvers for the GitLab project is met. | -| [Enforce Medium Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit) | Verify the maximum allowed medium severity alerts for the GitLab project. | -| [Enforce Merge Access Level Policy for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-access-level) | Verify the GitLab project's merge access level complies with requirements. | -| [Set Author Email Regex in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/author-email-regex) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | -| [Check CWE Compliance](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-cwe) | Verify that specified CWEs were not detected in the GitLab project. | -| [Enforce Critical Severity Limit](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit) | Verify the maximum allowed critical severity alerts for the GitLab project. | -| [Verify Commit Message Format](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-message-check) | Verify that commit messages in the GitLab project adhere to the specified format template. | -| [Enable Member Check for GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/member-check) | Verify `member_check` is enabled for the GitLab project. | -| [Restrict Selective Code Owner Removals in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals) | Verify `selective_code_owner_removals` is set for the GitLab project. | -| [Run Secrets Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning) | Verify secrets scanning is performed for the GitLab project. | -| [Reset Approvals on Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push) | Verify `reset_approvals_on_push` is set for the GitLab project. | -| [Reject Unsigned Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | -| [Enable Commit Committer Check in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check) | Verify `commit_committer_check` is enabled for the GitLab project. | -| [Protect CI Secrets in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets) | Verify secrets in the GitLab project are not shared. | -| [Validate All Commits in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commits-validated) | Verify all commits in the GitLab project are validated. | -| [Disallow Banned Approvers](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers) | Verify approvers in the GitLab project are not on the banned list. | -| [Allowed Committer Emails in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-email-check) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | -| [Set Push Access Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/push-access-level) | Verify the GitLab project's push access level policy complies with requirements. | -| [Disallow Force Push in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/force-push-protection) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | -| [Set Visibility Level in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/visibility-check) | Verify the GitLab project's visibility matches the required level. | -| [Restrict Approvers Per Merge Request](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | -| [Allowed Commit Authors in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check) | Verify only users in the Allowed List author commits in the GitLab project. | -| [Disable Author Approval for Merge Requests in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | -| [Enable Secrets Prevention in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check) | Verify `prevent_secrets` is enabled for the GitLab project. | -| [Ensure All Commits Are Signed in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits) | Verify all commits in the GitLab project are signed. | -| [Check Description Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/description-substring-check) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | -| [Verify Project Activity](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/abandoned-project) | Verify the GitLab project is active for a specified duration. | -| [Allowed Committer Names in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/committer-name-check) | Verify only users in the Allowed List commit by name in the GitLab project. | -| [Check Message Substring](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/message-substring-check) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | -| [Run SAST Scanning in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scanning) | Verify SAST scanning is performed for the GitLab project. | -| [Require Code Owner Approval in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/co-approval-required) | Verify code owner approval is required for specific branches in the GitLab project. | -| [Ensure SAST Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass) | Verify SAST scanning is successful for the GitLab project. | -| [Ensure Secrets Scanning Passes](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass) | Verify secrets scanning is successful for the GitLab project. | -| [Require Password for Approvals in GitLab Project](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | +| [Merge approval policy check for GitLab project](/docs/configuration/initiatives/rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +| [Set Push Rules for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-rules-set.md) | Verify push rules are set for the GitLab project. | +| [Disable Committers' Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-disable-committers-approval.md) | Verify `merge_requests_disable_committers_approval` is set for the GitLab project. | +| [Restrict Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-email-check.md) | Verify only GitLab project users in the Allowed List have commit author permissions. | +| [Require Minimal Approvers in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/required-minimal-approvers.md) | Verify the required number of approvers for the GitLab project is met. | +| [Enforce Medium Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/medium-severity-limit.md) | Verify the maximum allowed medium severity alerts for the GitLab project. | +| [Enforce Merge Access Level Policy for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/merge-access-level.md) | Verify the GitLab project's merge access level complies with requirements. | +| [Set Author Email Regex in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/author-email-regex.md) | Verify the `author_email_regex` for the GitLab project is set to the specified value. | +| [Check CWE Compliance](/docs/configuration/initiatives/rules/gitlab/project/check-cwe.md) | Verify that specified CWEs were not detected in the GitLab project. | +| [Enforce Critical Severity Limit](/docs/configuration/initiatives/rules/gitlab/project/critical-severity-limit.md) | Verify the maximum allowed critical severity alerts for the GitLab project. | +| [Verify Commit Message Format](/docs/configuration/initiatives/rules/gitlab/project/commit-message-check.md) | Verify that commit messages in the GitLab project adhere to the specified format template. | +| [Enable Member Check for GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/member-check.md) | Verify `member_check` is enabled for the GitLab project. | +| [Restrict Selective Code Owner Removals in GitLab](/docs/configuration/initiatives/rules/gitlab/project/selective-code-owner-removals.md) | Verify `selective_code_owner_removals` is set for the GitLab project. | +| [Run Secrets Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/secrets-scanning.md) | Verify secrets scanning is performed for the GitLab project. | +| [Reset Approvals on Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reset-pprovals-on-push.md) | Verify `reset_approvals_on_push` is set for the GitLab project. | +| [Reject Unsigned Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/reject-unsigned-commits.md) | Verify `reject_unsigned_commits` is enabled for the GitLab project. | +| [Enable Commit Committer Check in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-committer-check.md) | Verify `commit_committer_check` is enabled for the GitLab project. | +| [Protect CI Secrets in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/protect-ci-secrets.md) | Verify secrets in the GitLab project are not shared. | +| [Validate All Commits in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commits-validated.md) | Verify all commits in the GitLab project are validated. | +| [Disallow Banned Approvers](/docs/configuration/initiatives/rules/gitlab/project/disallowed-banned-approvers.md) | Verify approvers in the GitLab project are not on the banned list. | +| [Allowed Committer Emails in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-email-check.md) | Verify only users in the Allowed List use committer email addresses in the GitLab project. | +| [Set Push Access Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/push-access-level.md) | Verify the GitLab project's push access level policy complies with requirements. | +| [Disallow Force Push in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/force-push-protection.md) | Verify force pushes in the GitLab project are disallowed to maintain repository integrity. | +| [Set Visibility Level in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/visibility-check.md) | Verify the GitLab project's visibility matches the required level. | +| [Restrict Approvers Per Merge Request](/docs/configuration/initiatives/rules/gitlab/project/approvers-per-merge-request.md) | Verify the binary field `disable_overriding_approvers_per_merge_request` is set for the GitLab project. | +| [Allowed Commit Authors in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/commit-author-name-check.md) | Verify only users in the Allowed List author commits in the GitLab project. | +| [Disable Author Approval for Merge Requests in GitLab](/docs/configuration/initiatives/rules/gitlab/project/merge-requests-author-approval.md) | Verify the binary field `merge_requests_author_approval` is set for the GitLab project. | +| [Enable Secrets Prevention in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/prevent-secrets-check.md) | Verify `prevent_secrets` is enabled for the GitLab project. | +| [Ensure All Commits Are Signed in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/check-signed-commits.md) | Verify all commits in the GitLab project are signed. | +| [Check Description Substring](/docs/configuration/initiatives/rules/gitlab/project/description-substring-check.md) | Verify a specific substring is not found in the description attribute of vulnerabilities for the GitLab project. | +| [Verify Project Activity](/docs/configuration/initiatives/rules/gitlab/project/abandoned-project.md) | Verify the GitLab project is active for a specified duration. | +| [Allowed Committer Names in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/committer-name-check.md) | Verify only users in the Allowed List commit by name in the GitLab project. | +| [Check Message Substring](/docs/configuration/initiatives/rules/gitlab/project/message-substring-check.md) | Verify a specific substring is not found in the message attribute of vulnerabilities for the GitLab project. | +| [Run SAST Scanning in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/sast-scanning.md) | Verify SAST scanning is performed for the GitLab project. | +| [Require Code Owner Approval in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/co-approval-required.md) | Verify code owner approval is required for specific branches in the GitLab project. | +| [Ensure SAST Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/sast-scan-pass.md) | Verify SAST scanning is successful for the GitLab project. | +| [Ensure Secrets Scanning Passes](/docs/configuration/initiatives/rules/gitlab/project/secrets-scan-pass.md) | Verify secrets scanning is successful for the GitLab project. | +| [Require Password for Approvals in GitLab Project](/docs/configuration/initiatives/rules/gitlab/project/require-password-to-approve.md) | Verify the binary field `require_password_to_approve` is set for the GitLab project. | ### K8s Namespace Discovery Evidence -**Evidence Type:** [K8s Namespace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Namespace Discovery Evidence](/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Container Images](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-images) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | -| [Verify Namespace Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Namespaces](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | -| [Verify Namespace Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | -| [Allowed Namespace Registries](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | -| [Allowed Pods in Namespace](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | +| [Allowed Container Images](/docs/configuration/initiatives/rules/k8s/namespace/allowed-images.md) | Verify only container images specified in the Allowed List run within the Kubernetes namespace. | +| [Verify Namespace Termination](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-termination.md) | Verify Kubernetes namespaces are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Namespaces](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-namespaces.md) | Verify only namespaces specified in the Allowed List are allowed within the cluster. | +| [Verify Namespace Runtime Duration](/docs/configuration/initiatives/rules/k8s/namespace/verify-namespace-duration.md) | Verify Kubernetes namespaces adhere to a specified runtime duration to enforce lifecycle limits. | +| [Allowed Namespace Registries](/docs/configuration/initiatives/rules/k8s/namespace/allowed-registries.md) | Verify container images in Kubernetes namespaces originate from registries in the Allowed List. | +| [Allowed Pods in Namespace](/docs/configuration/initiatives/rules/k8s/namespace/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List run within a Kubernetes namespace. | ### K8s Pod Discovery Evidence -**Evidence Type:** [K8s Pod Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#k8s-discovery) +**Evidence Type:** [K8s Pod Discovery Evidence](/docs/platforms/discover#k8s-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify Pod Runtime Duration](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | -| [Verify Pod Termination](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | -| [Allowed Pods](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod) | Verify only pods explicitly listed in the Allowed List are allowed to run. | +| [Verify Pod Runtime Duration](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-duration.md) | Verify Kubernetes pods adhere to a specified runtime duration to enforce lifecycle limits. | +| [Verify Pod Termination](/docs/configuration/initiatives/rules/k8s/pods/verify-pod-termination.md) | Verify Kubernetes pods are properly terminated to prevent lingering resources and maintain cluster hygiene. | +| [Allowed Pods](/docs/configuration/initiatives/rules/k8s/pods/white-listed-pod.md) | Verify only pods explicitly listed in the Allowed List are allowed to run. | ### Bitbucket Project Discovery Evidence -**Evidence Type:** [Bitbucket Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Project Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Prevent Long-Lived Tokens](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens) | Verify Bitbucket API tokens expire before the maximum time to live. | -| [Allowed Project Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | -| [Allowed Project Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | -| [Prevent Credential Exposure](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | +| [Prevent Long-Lived Tokens](/docs/configuration/initiatives/rules/bitbucket/project/long-live-tokens.md) | Verify Bitbucket API tokens expire before the maximum time to live. | +| [Allowed Project Admins](/docs/configuration/initiatives/rules/bitbucket/project/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket project. | +| [Allowed Project Users](/docs/configuration/initiatives/rules/bitbucket/project/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket project. | +| [Prevent Credential Exposure](/docs/configuration/initiatives/rules/bitbucket/project/exposed-credentials.md) | Verify access to the Bitbucket project is blocked if exposed credentials are detected. | ### Bitbucket Repository Discovery Evidence -**Evidence Type:** [Bitbucket Repository Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Repository Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Repository Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | -| [Verify Default Branch Protection Setting Is Configured](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection) | Verify the default branch protection is enabled in the Bitbucket repository. | -| [Allowed Repository Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/repository/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | +| [Allowed Repository Admins](/docs/configuration/initiatives/rules/bitbucket/repository/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket repository. | +| [Verify Default Branch Protection Setting Is Configured](/docs/configuration/initiatives/rules/bitbucket/repository/branch-protection.md) | Verify the default branch protection is enabled in the Bitbucket repository. | +| [Allowed Repository Users](/docs/configuration/initiatives/rules/bitbucket/repository/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket repository. | ### Bitbucket Workspace Discovery Evidence -**Evidence Type:** [Bitbucket Workspace Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#bitbucket-discovery) +**Evidence Type:** [Bitbucket Workspace Discovery Evidence](/docs/platforms/discover#bitbucket-discovery) | Rule Name | Description | |-----------|-------------| -| [Allowed Workspace Admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | -| [Allowed Workspace Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | +| [Allowed Workspace Admins](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-admins.md) | Verify only users specified in the Allowed List have admin privileges in the Bitbucket workspace. | +| [Allowed Workspace Users](/docs/configuration/initiatives/rules/bitbucket/workspace/allow-users.md) | Verify only users specified in the Allowed List have user access to the Bitbucket workspace. | ### Discovery Evidence -**Evidence Type:** [Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover) +**Evidence Type:** [Discovery Evidence](/docs/platforms/discover) | Rule Name | Description | |-----------|-------------| -| [Verify GitLab Pipeline Labels](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels) | Verify the pipeline includes all required label keys and values. | -| [GitLab pipeline verify labels exist](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist) | Verify the pipeline has all required label keys and values. | -| [Verify Exposed Credentials](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials) | Verify there are no exposed credentials. | +| [Verify GitLab Pipeline Labels](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels.md) | Verify the pipeline includes all required label keys and values. | +| [GitLab pipeline verify labels exist](/docs/configuration/initiatives/rules/gitlab/pipeline/verify-labels-exist.md) | Verify the pipeline has all required label keys and values. | +| [Verify Exposed Credentials](/docs/configuration/initiatives/rules/jenkins/folder/exposed-credentials.md) | Verify there are no exposed credentials. | ### Dockerhub Project Discovery Evidence -**Evidence Type:** [Dockerhub Project Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#dockerhub-discovery) +**Evidence Type:** [Dockerhub Project Discovery Evidence](/docs/platforms/discover#dockerhub-discovery) | Rule Name | Description | |-----------|-------------| -| [Verify DockerHub Tokens are Active](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-expiration) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | -| [Verify no unused Dockerhub](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/dockerhub/token-not-used) | Verify that there are no unused Dockerhub. | +| [Verify DockerHub Tokens are Active](/docs/configuration/initiatives/rules/dockerhub/token-expiration.md) | Verify that all discovered Dockerhub tokens are set to Active in Dockerhub. | +| [Verify no unused Dockerhub](/docs/configuration/initiatives/rules/dockerhub/token-not-used.md) | Verify that there are no unused Dockerhub. | ### Jenkins Instance Discovery Evidence -**Evidence Type:** [Jenkins Instance Discovery Evidence](https://deploy-preview-299--scribe-security.netlify.app/docs/platforms/discover#jenkins-discovery) +**Evidence Type:** [Jenkins Instance Discovery Evidence](/docs/platforms/discover#jenkins-discovery) | Rule Name | Description | |-----------|-------------| -| [Disallow Unused Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/unused-users) | Verify there are no users with zero activity. | -| [Verify Inactive Users](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/jenkins/instance/inactive-users) | Verify there are no inactive users. | +| [Disallow Unused Users](/docs/configuration/initiatives/rules/jenkins/instance/unused-users.md) | Verify there are no users with zero activity. | +| [Verify Inactive Users](/docs/configuration/initiatives/rules/jenkins/instance/inactive-users.md) | Verify there are no inactive users. | ### SLSA Provenance -**Evidence Type:** [SLSA Provenance](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/help/valint_slsa) +**Evidence Type:** [SLSA Provenance](/docs/valint/help/valint_slsa) | Rule Name | Description | |-----------|-------------| -| [Verify that provenance is authenticated](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated) | Verify the artifact is signed. | -| [SLSA Field Exists in Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/field-exists) | Verify the specified field exists in the provenance document. | -| [Verify Provenance Document Exists](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists) | Verify that the Provenance document evidence exists. | -| [Disallow dependencies in SLSA Provenance Document](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/banned-builder-deps) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | -| [Verify build time](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/build-time) | Verify the artifact was created within the specified time window. | -| [Verify that artifact was created by the specified builder](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-builder) | Verify the artifact was created by the specified builder. | -| [Verify that artifact has no disallowed builder dependencies](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/verify-byproducts) | Verify the artifact has no disallowed builder dependencies. | +| [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | +| [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | +| [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | +| [Disallow dependencies in SLSA Provenance Document](/docs/configuration/initiatives/rules/slsa/banned-builder-deps.md) | Verify that dependencies in the block list do not appear in the SLSA Proveance document. | +| [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | +| [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | +| [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | ### Statement -**Evidence Type:** [Statement](https://deploy-preview-299--scribe-security.netlify.app/docs/valint/generic) +**Evidence Type:** [Statement](/docs/valint/generic) | Rule Name | Description | |-----------|-------------| -| [Verify Selected Commits Are Signed API](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-list) | Verify selected commits are signed in the GitHub organization. | -| [Branch protection enabled in GitHub repository](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/branch-protection) | Verify GitHub branch protection rules | -| [Disallow Unsigned Commits In Time Range](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/github/api/signed-commits-range) | Verify commits in the specified time range are signed. | -| [Branch protected](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-branch-protection) | PS.1 Require branch protection for the repository | -| [Image-verifiable](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-2-image-verifiable) | PS.2 Provide a mechanism to verify the integrity of the image | -| [Require signoff on web commits](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-web-commit-signoff) | PS.1 Require contributors to sign when committing to Github through the web interface | -| [SBOM archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.2-archived-sbom) | PS.3.2 Archive SBOM | -| [Repo private](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-repo-private) | PS.1 Assure the repository is private | -| [Limit admins](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-limit-admins) | PS.1 Restrict the maximum number of organization admins | -| [Enforce 2FA](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-1-2fa) | PS.1 Require 2FA for accessing code | -| [Code archived](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/ssdf/ps-3.1-code-archived) | PS.3.1 Verify that the software release data is archived. We assume running in Github thus the code is allways stored in a repository | -| [Sign Selected Commits in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list) | Verify the selected commits are signed in the GitLab organization. | -| [Set Push Rules in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/push-rules) | Verify GitLab push rules are configured via the API. | -| [Sign Selected Commit Range in GitLab](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range) | Verify the selected range of commits is signed via the GitLab API. | -| [Verify No Critical or High Vulnerabilities in Product](https://deploy-preview-299--scribe-security.netlify.app/docs/configuration/initiatives/rules/api/scribe-api-cve-product) | Verify via Scribe API that there no critical or high severity vulnerabilities in any deliverable component of the product. | +| [Verify Selected Commits Are Signed API](/docs/configuration/initiatives/rules/github/api/signed-commits-list.md) | Verify selected commits are signed in the GitHub organization. | +| [Branch protection enabled in GitHub repository](/docs/configuration/initiatives/rules/github/api/branch-protection.md) | Verify GitHub branch protection rules | +| [Disallow Unsigned Commits In Time Range](/docs/configuration/initiatives/rules/github/api/signed-commits-range.md) | Verify commits in the specified time range are signed. | +| [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | +| [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | +| [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | +| [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. | + ### General Information From 5e679e249f84f2188fdeddb8499f5a7b48d8fc56 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 14 Apr 2025 18:54:18 +0300 Subject: [PATCH 180/191] added descriptions for new SLSA rules --- docs/configuration/initiatives/index.md | 2 + .../rules/slsa/verify-custom-fields.md | 53 +++++++++++++++++++ .../rules/slsa/verify-external-parameters.md | 52 ++++++++++++++++++ docs/guides/enforcing-sdlc-initiative.md | 2 + 4 files changed, 109 insertions(+) create mode 100644 docs/configuration/initiatives/rules/slsa/verify-custom-fields.md create mode 100644 docs/configuration/initiatives/rules/slsa/verify-external-parameters.md diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index ad42b8b35..666e3b27f 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -284,6 +284,7 @@ | Rule Name | Description | |-----------|-------------| +| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified exterenal parameters value match in the provenance document. | | [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | | [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | | [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | @@ -291,6 +292,7 @@ | [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | | [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | | [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | +| [SLSA Field Value Matches in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md) | Verify the specified field value matches in the provenance document. | ### Statement **Evidence Type:** [Statement](/docs/valint/generic) diff --git a/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md new file mode 100644 index 000000000..58df2cbb1 --- /dev/null +++ b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md @@ -0,0 +1,53 @@ +--- +sidebar_label: SLSA Field Value Matches in Provenance Document +title: SLSA Field Value Matches in Provenance Document +--- +# SLSA Field Value Matches in Provenance Document +**Type:** Rule +**ID:** `slsa-field-matches` +**Source:** [v2/rules/slsa/verify-custom-fields.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-custom-fields.yaml) +**Rego Source:** [verify-custom-fields.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-custom-fields.rego) +**Labels:** SLSA + +Verify the specified field value matches in the provenance document. + +:::note +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: slsa/verify-custom-fields@v2 +with: + fields: + "predicate/buildDefinition/externalParameters/key": "value" +``` + +## Mitigation +Ensure that the field exists in the provenance document and that its value matches the expected value. + + +## Description +This rule verifies that the specified field value matches in the provenance document. +It checks if the field exists and if its value matches the expected value. +The parameters are passed as key-value pairs. +The key must be a path within the Provenance document, and the value must be a string. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| fields | array | False | The expected field values to match in the provenance document. | + diff --git a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md new file mode 100644 index 000000000..9cb6aa674 --- /dev/null +++ b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md @@ -0,0 +1,52 @@ +--- +sidebar_label: SLSA External Parameters Match in Provenance Document +title: SLSA External Parameters Match in Provenance Document +--- +# SLSA External Parameters Match in Provenance Document +**Type:** Rule +**ID:** `slsa-external-parameters` +**Source:** [v2/rules/slsa/verify-external-parameters.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-external-parameters.yaml) +**Rego Source:** [verify-external-parameters.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-external-parameters.rego) +**Labels:** SLSA + +Verify the specified exterenal parameters value match in the provenance document. + +:::note +This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: slsa/verify-external-parameters@v2 +with: + parameters: + - "key": "value" +``` + +## Mitigation +Ensure that the external parameters field is present in the provenance document and that its value matches the expected value. To add such field, pass it as `key=value` in the `--external` flag for `valint slsa` command. + + +## Description +This rule verifies that the specified external parameters value matches in the provenance document. +It checks if the external parameters field exists and if its value matches the expected value. +The parameters are passed as key-value pairs. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | slsa | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| parameters | array | False | The expected external parameters to match in the provenance document. | + diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index f599a7a91..5c33ecac5 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -700,6 +700,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | Rule Name | Description | |-----------|-------------| +| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified exterenal parameters value match in the provenance document. | | [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | | [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | | [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | @@ -707,6 +708,7 @@ To use a custom initiatives rule catalog, you can specify the path to the catalo | [Verify build time](/docs/configuration/initiatives/rules/slsa/build-time.md) | Verify the artifact was created within the specified time window. | | [Verify that artifact was created by the specified builder](/docs/configuration/initiatives/rules/slsa/verify-builder.md) | Verify the artifact was created by the specified builder. | | [Verify that artifact has no disallowed builder dependencies](/docs/configuration/initiatives/rules/slsa/verify-byproducts.md) | Verify the artifact has no disallowed builder dependencies. | +| [SLSA Field Value Matches in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md) | Verify the specified field value matches in the provenance document. | ### Statement From de9e7f0ff86af6132da2c57328877a1409052009 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 14 Apr 2025 19:06:31 +0300 Subject: [PATCH 181/191] fixed new SLSA rules descriptions --- .../initiatives/rules/slsa/verify-custom-fields.md | 2 +- .../initiatives/rules/slsa/verify-external-parameters.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md index 58df2cbb1..00f59e02f 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md +++ b/docs/configuration/initiatives/rules/slsa/verify-custom-fields.md @@ -49,5 +49,5 @@ The key must be a path within the Provenance document, and the value must be a s ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| fields | array | False | The expected field values to match in the provenance document. | +| fields | object | False | The expected field values to match in the provenance document given as a `key:value` map. | diff --git a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md index 9cb6aa674..cb40c414e 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md +++ b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md @@ -27,7 +27,7 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: slsa/verify-external-parameters@v2 with: parameters: - - "key": "value" + "key": "value" ``` ## Mitigation @@ -48,5 +48,5 @@ The parameters are passed as key-value pairs. ## Input Definitions | Parameter | Type | Required | Description | |-----------|------|----------|-------------| -| parameters | array | False | The expected external parameters to match in the provenance document. | +| parameters | object | False | The expected external parameters to match in the provenance document given as `key:value` map. | From 6f67c8885382319134eeb88d5372cade5860c73e Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 15 Apr 2025 13:13:43 +0300 Subject: [PATCH 182/191] updated results example --- docs/guides/enforcing-sdlc-initiative.md | 227 ++- docs/valint/policy-results.md | 2053 +++++++++++++--------- 2 files changed, 1308 insertions(+), 972 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 5c33ecac5..8cf685f19 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -28,7 +28,7 @@ For a detailed initiative description, see the **[initiatives](../valint/initiat 2. Create an SBOM of the type you want to verify. For a Docker image, the command would be: ```bash - valint bom busybox:latest -o statement \ + valint bom busybox:latest -o attest \ --product-key -- product-version \ --scribe.client-secret ``` @@ -56,30 +56,56 @@ Alternatively, you can use GitHub actions, as described in detail in [Setting up Initiative results ```bash - INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: - ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ - ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ - │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ - ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ - │ PS.2 │ Image-verifiable │ error │ false │ pass │ Evidence signature verified │ busybox:1.36.1 │ - ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ - │ PS.3.2 │ SBOM archived │ error │ false │ pass │ Evidence signature verified │ busybox:1.36.1 │ - ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ - │ CONTROL RESULT │ │ │ │ PASS │ │ │ - └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ - - INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: - ┌──────────────────────────────────────────────────────────────────┐ - │ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ - ├───────────────────┬───────────────┬─────────────────────┬────────┤ - │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ - ├───────────────────┼───────────────┼─────────────────────┼────────┤ - │ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ - │ │ │ PS.3.2(pass) │ │ - ├───────────────────┼───────────────┼─────────────────────┼────────┤ - │ INITIATIVE RESULT │ │ │ PASS │ - └───────────────────┴───────────────┴─────────────────────┴────────┘ + INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary: + ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │ + │ on Summary │ + ├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ + │ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ + ├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ + │ CONTROL RESULT │ │ │ │ PASS │ │ │ + └────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ + INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary: + ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │ + │ release" Evaluation Summary │ + ├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ + │ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │ + ├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ + │ CONTROL RESULT │ │ │ │ FAIL │ │ │ + └───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘ + INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary: + ┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │ + │ ware release" Evaluation Summary │ + ├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ + │ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ + ├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ + │ CONTROL RESULT │ │ │ │ PASS │ │ │ + └────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ + INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: + ┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ + ├───────────────────┬──────────────────────────────────────────────────────────────────┬────────────────────────────┬────────┤ + │ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ + ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ + │ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │ + │ │ ftware acquirers │ │ │ + ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ + │ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │ + │ │ etained for each software release │ │ │ + ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ + │ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │ + │ │ components of each software release │ │ │ + ├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ + │ INITIATIVE RESULT │ │ │ FAIL │ + └───────────────────┴──────────────────────────────────────────────────────────────────┴────────────────────────────┴────────┘ Evaluation Target Name 'index.docker.io/library/busybox:latest' ``` @@ -113,15 +139,15 @@ Similar to [initiatives](#verifying-an-initiative), you can verify a single rule Rule evaluation results ```bash - ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ - │ [default] Control "Default" Evaluation Summary │ - ├───────────────────────────────────┬───────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────┬────────────────┤ - │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ - ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────┤ - │ sbom-require-complete-license-set │ Enforce SBOM License Completeness │ error │ false │ pass │ All packages have licenses │ busybox:1.36.1 │ - ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────┤ - │ CONTROL RESULT │ │ │ │ PASS │ │ │ - └───────────────────────────────────┴───────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────┴────────────────┘ + ┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ + │ [default] Control "Default" Evaluation Summary │ + ├───────────────────────────────────┬───────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────┬────────────────────────┤ + │ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ + ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────────────┤ + │ sbom-require-complete-license-set │ Enforce SBOM License Completeness │ error │ false │ pass │ All packages have licenses │ busybox:1.36.1 (image) │ + ├───────────────────────────────────┼───────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────┼────────────────────────┤ + │ CONTROL RESULT │ │ │ │ PASS │ │ │ + └───────────────────────────────────┴───────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────┴────────────────────────┘ ``` You will also see the results table of the initiative evaluation: @@ -222,65 +248,80 @@ valint verify --initiative ssdf@v2 --all-evidence \ Initiative results ```bash -INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ -├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ CONTROL RESULT │ │ │ │ PASS │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ - -INFO SSDF-ORG: Control "SSDF ORG" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ [SSDF-ORG] Control "SSDF ORG" Evaluation Summary │ -├────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.1 │ Enforce 2FA │ error │ true │ pass │ 2FA authentication is enabled │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.3 │ Limit admins │ error │ true │ fail │ 9 admins | 3 max allowed │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.5 │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │ -├────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ FAIL │ │ │ -└────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ - -INFO SSDF-REPO: Control "SSDF REPO" Evaluation Summary: -┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ [SSDF-REPO] Control "SSDF REPO" Evaluation Summary | -├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────────────────────────┬───────────────────────────────────────| -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET | -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.2 │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-org/my-repo (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ PS.1.4 │ Repo private │ error │ true │ pass │ The repository is private │ my-org/my-repo (github repo) │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤ -│ CONTROL RESULT │ │ │ │ FAIL │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘ - -INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: -┌───────────────────────────────────────────────────────────────────┐ -│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ -├───────────────────┬───────────────┬──────────────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ -│ │ │ PS.3.2(pass) │ │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-ORG │ SSDF ORG │ PS.1.1(pass), │ fail │ -│ │ │ PS.1.3(fail), │ │ -│ │ │ PS.1.5(fail) │ │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ SSDF-REPO │ SSDF REPO │ PS.1.2(fail), │ fail │ -│ │ │ PS.1.4(pass) │ │ -├───────────────────┼───────────────┼──────────────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ FAIL │ -└───────────────────┴───────────────┴──────────────────────┴────────┘ +INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │ +│ release" Evaluation Summary │ +├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ +│ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │ +├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘ +INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │ +│ ware release" Evaluation Summary │ +├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ +├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ +INFO PS/PS.1/PS.1.1: Control "Store all forms of code based on the principle of least privilege" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.1/PS.1.1] Control "Store all forms of code based on the principle of least privilege" Evaluation Summary │ +├────────────────────┬────────────────────────────────┬───────┬──────────┬────────┬────────────────────────────────────────┬───────────────────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ 2fa │ Enforce 2FA │ error │ true │ fail │ 2FA authentication is NOT enabled │ my-org (github organization) │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ branch-protection │ Branch protected │ error │ true │ fail │ 1 unprotected branches | 0 max allowed │ my-repo (github repo) │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ max-admins │ Limit admins │ error │ true │ fail │ 6 admins | 3 max allowed │ my-org (github organization) │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ repo-is-private │ Repo private │ none │ true │ pass │ The repository is private │ my-repo (github repo) │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ web-commit-signoff │ Require signoff on web commits │ error │ true │ fail │ web_commit_signoff_required is NOT set │ my-org (github organization) │ +├────────────────────┼────────────────────────────────┼───────┼──────────┼────────┼────────────────────────────────────────┼───────────────────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└────────────────────┴────────────────────────────────┴───────┴──────────┴────────┴────────────────────────────────────────┴───────────────────────────────────────┘ +INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │ +│ on Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ +INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: +┌─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬──────────────────────────────────────────────────────────────────┬─────────────────────────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤ +│ PS/PS.1/PS.1.1 │ Store all forms of code based on the principle of least privileg │ - Branch protected (fail), │ fail │ +│ │ e │ - Repo private (pass), │ │ +│ │ │ - Enforce 2FA (fail), │ │ +│ │ │ - Limit admins (fail), │ │ +│ │ │ - Require signoff on web commits (fail) │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤ +│ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │ +│ │ ftware acquirers │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤ +│ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │ +│ │ etained for each software release │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤ +│ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │ +│ │ components of each software release │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴──────────────────────────────────────────────────────────────────┴─────────────────────────────────────────┴────────┘ ``` diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md index 02877563b..cfe4a3c83 100644 --- a/docs/valint/policy-results.md +++ b/docs/valint/policy-results.md @@ -82,31 +82,56 @@ After executing these commands, the results of the evaluation are displayed in t After policy evaluation, the results are shown in the output log as a table: ```bash -INFO SSDF-IMAGE: Control "SSDF IMAGE" Evaluation Summary: -┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ -│ [SSDF-IMAGE] Control "SSDF IMAGE" Evaluation Summary │ -├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────┤ -│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.2 │ Image-verifiable │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ PS.3.2 │ SBOM archived │ error │ true │ pass │ Evidence signature verified │ busybox:1.36.1 │ -├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────┤ -│ CONTROL RESULT │ │ │ │ PASS │ │ │ -└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────┘ - -INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: -┌───────────────────────────────────────────────────────────────┐ -│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ -│ │ -├───────────────────────┬───────────────┬──────────────┬────────┤ -│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ -├───────────────────────┼───────────────┼──────────────┼────────┤ -│ SSDF-IMAGE │ SSDF IMAGE │ PS.2(pass), │ pass │ -│ │ │ PS.3.2(pass) │ │ -├───────────────────────┼───────────────┼──────────────┼────────┤ -│ INITIATIVE RESULT │ │ │ PASS │ -└───────────────────────┴───────────────┴──────────────┴────────┘ +INFO PS/PS.2/PS.2.1: Control "Make software integrity verification information available to software acquirers" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.2/PS.2.1] Control "Make software integrity verification information available to software acquirers" Evaluati │ +│ on Summary │ +├────────────────┬──────────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ sbom-is-signed │ Image-verifiable │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ +├────────────────┼──────────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴──────────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ +INFO PS/PS.3/PS.3.1: Control "Securely archive the necessary files and supporting data to be retained for each software release" Evaluation Summary: +┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.3/PS.3.1] Control "Securely archive the necessary files and supporting data to be retained for each software │ +│ release" Evaluation Summary │ +├───────────────────┬───────────────────┬───────┬──────────┬────────┬─────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ +│ provenance-exists │ Provenance exists │ error │ false │ fail │ SLSA Provenance missing │ busybox:1.36.1 (image) │ +├───────────────────┼───────────────────┼───────┼──────────┼────────┼─────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ FAIL │ │ │ +└───────────────────┴───────────────────┴───────┴──────────┴────────┴─────────────────────────┴────────────────────────┘ +INFO PS/PS.3/PS.3.2: Control "Collect, safeguard, maintain, and share provenance data for all components of each software release" Evaluation Summary: +┌───────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [PS/PS.3/PS.3.2] Control "Collect, safeguard, maintain, and share provenance data for all components of each soft │ +│ ware release" Evaluation Summary │ +├────────────────┬───────────────┬───────┬──────────┬────────┬─────────────────────────────┬────────────────────────┤ +│ RULE ID │ RULE NAME │ LEVEL │ VERIFIED │ RESULT │ SUMMARY │ TARGET │ +├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ sbom-is-signed │ SBOM archived │ none │ true │ pass │ Evidence signature verified │ busybox:1.36.1 (image) │ +├────────────────┼───────────────┼───────┼──────────┼────────┼─────────────────────────────┼────────────────────────┤ +│ CONTROL RESULT │ │ │ │ PASS │ │ │ +└────────────────┴───────────────┴───────┴──────────┴────────┴─────────────────────────────┴────────────────────────┘ +INFO SSDF: Initiative "SSDF Client Initiative" Evaluation Summary: +┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐ +│ [SSDF] Initiative "SSDF Client Initiative" Evaluation Summary │ +├───────────────────┬──────────────────────────────────────────────────────────────────┬────────────────────────────┬────────┤ +│ CONTROL ID │ CONTROL NAME │ RULE LIST │ RESULT │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ +│ PS/PS.2/PS.2.1 │ Make software integrity verification information available to so │ - Image-verifiable (pass) │ pass │ +│ │ ftware acquirers │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ +│ PS/PS.3/PS.3.1 │ Securely archive the necessary files and supporting data to be r │ - Provenance exists (fail) │ fail │ +│ │ etained for each software release │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ +│ PS/PS.3/PS.3.2 │ Collect, safeguard, maintain, and share provenance data for all │ - SBOM archived (pass) │ pass │ +│ │ components of each software release │ │ │ +├───────────────────┼──────────────────────────────────────────────────────────────────┼────────────────────────────┼────────┤ +│ INITIATIVE RESULT │ │ │ FAIL │ +└───────────────────┴──────────────────────────────────────────────────────────────────┴────────────────────────────┴────────┘ Evaluation Target Name 'index.docker.io/library/busybox:latest' ``` @@ -137,17 +162,30 @@ Results are also presented as a SARIF report inside an in-toto statement. "_type": "https://in-toto.io/Statement/v0.1", "predicateType": "http://docs.oasis-open.org/sarif/sarif/2.1.0", "subject": [ + { + "name": "index.docker.io/library/busybox:latest", + "digest": { + "sha256": "3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + } + }, + { + "name": "index.docker.io/library/busybox:latest", + "digest": { + "sha256": "a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + } + }, { "name": "", "digest": { - "sha256": "3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104" + "sha256": "ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252" } } ], "predicate": { "environment": { "hostname": "thinkpad", - "user": "viktor", + "user": "user", + "name": "my-product", "labels": [ "component-group=base_image", "component-group=metadata" @@ -156,7 +194,7 @@ Results are also presented as a SARIF report inside an in-toto statement. "component-group=base_image", "component-group=metadata" ], - "timestamp": "2025-03-06T15:36:53+02:00", + "timestamp": "2025-04-15T13:05:55+03:00", "input_name": "busybox", "input_tag": "latest", "content_type": "statement-sarif", @@ -164,14 +202,10 @@ Results are also presented as a SARIF report inside an in-toto statement. "context_type": "local", "predicate_type": "http://docs.oasis-open.org/sarif/sarif/2.1.0", "tool": "valint", - "tool_version": "1.5.18", + "tool_version": "2.0.0", "format_type": "sarif", "format_version": "2.1.0", "format_encoding": "json", - "git_url": "https://github.com/scribe-security/valint.git", - "git_branch": "feat/sh-5802_initiatives_config", - "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", - "git_ref": "refs/heads/feat/sh-5802_initiatives_config", "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", "repoDigest": [ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" @@ -181,546 +215,650 @@ Results are also presented as a SARIF report inside an in-toto statement. "1.36.1", "latest" ], + "image_name": "index.docker.io/library/busybox:latest", "size": 4261550, "platform": "linux/amd64", "created": "2023-07-18T23:19:33.655005962Z", - "file_id": "sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "file_id": "sha256:ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252", "file_path": "index.docker.io/library/busybox:latest", "target_type": "policy-results", "sbomtype": "container", "sbomgroup": "data", "sbomname": "index.docker.io/library/busybox:latest", - "sbomversion": "sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "sbomversion": "sha256:ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252", "sbomhashs": [ - "sha256-3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104" + "sha256-ea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252" ], - "sbompurl": "pkg:data/index.docker.io/library/busybox:latest@sha256:3a79c55aa71a43aad2ea882f60876582b1fc52182a8c59ec11bb729012b90104", + "sbompurl": "pkg:data/index.docker.io/library/busybox%3Alatest@sha256%3Aea2388e936e9fc9ea554691cd1a425309f08bee95e57ed1b66a09b9ea286c252", "sbomcomponents": [ "base_image", "metadata" ], - "initiative": { - "name": "SSDF Client Initiative", - "id": "SSDF", - "version": "1.0.0", - "description": "Evaluate PS rules from the SSDF initiative", - "url": "https://csrc.nist.gov/pubs/sp/800/218/final", - "fingerprint": "788a0897074facf3eb9572dc04172e4db8ca30582fe02b2d31c93d3428d38043" - }, "controls": [ - "SSDF-IMAGE::SSDF" + "SSDF/PS/PS.2/PS.2.1", + "SSDF/PS/PS.3/PS.3.1", + "SSDF/PS/PS.3/PS.3.2" ], "rules": [ - "PS.2::SSDF-IMAGE::SSDF", - "PS.3.2::SSDF-IMAGE::SSDF" + "SSDF/PS/PS.2/PS.2.1/sbom-is-signed", + "SSDF/PS/PS.3/PS.3.1/provenance-exists", + "SSDF/PS/PS.3/PS.3.2/sbom-is-signed" ], - "allow": true, "rule-scripts": { - "artifact-signed.rego": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", - "data.rego": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474" + "artifact-signed.rego": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad" }, "bundle_info": { "git_branch": "v2", - "git_target": "/home/viktor/.cache/valint/.tmp/git_tmp_3916451226", + "git_target": "/home/user/.cache/valint/.tmp/git_tmp_2907983709", "git_repo": "https://github.com/scribe-public/sample-policies.git", "git_ref": "refs/heads/v2", - "git_commit": "fcf251b0d3910a9679be812cf4a87a4e86e0aafc" - } + "git_commit": "45919a8c4f3ae20fceb9afa01219741f651bc2ef" + }, + "initiative-name": "SSDF Client Initiative", + "initiative-id": "SSDF", + "initiative-version": "1.0.0", + "initiative-description": "Evaluate PS rules from the SSDF initiative", + "initiative-url": "https://csrc.nist.gov/pubs/sp/800/218/final", + "initiative-fingerprint": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2", + "ref": "17700", + "store": "scribe" }, "mimeType": "application/json", "content": { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", "version": "2.1.0", - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "runs": [ { - "tool": { - "driver": { - "informationUri": "https://scribesecurity.com", - "name": "valint", + "automationDetails": { + "id": "valint/1744711556" + }, + "invocations": [ + { + "commandLine": "valint verify busybox:latest --format=statement --initiative=ssdf@v2", + "executionSuccessful": true, + "exitCode": 0, + "exitCodeDescription": "valint exited with 0, control evaluation result is: fail", + "properties": { + "control-result": { + "control-id:SSDF/PS/PS.2/PS.2.1": "pass", + "control-id:SSDF/PS/PS.3/PS.3.1": "fail", + "control-id:SSDF/PS/PS.3/PS.3.2": "pass" + }, + "initiative-hash": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2", + "initiative-id": "SSDF", + "initiative-name": "SSDF Client Initiative", + "initiative-result": "fail" + } + } + ], + "language": "en-US", + "newlineSequences": [ + "\r\n", + "\n" + ], + "policies": [ + { + "associatedComponent": { + "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c", + "index": 0, + "name": "SSDF Client Initiative" + }, + "fullDescription": { + "markdown": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.\n\n### Mitigation\nImplement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.", + "text": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering.\nMitigation: Implement strict access controls, enforce multi-factor authentication (MFA), and regularly audit access logs to ensure only authorized personnel can access and modify the code. Use branch protection rules, require signed commits, and make repositories private to prevent unauthorized access and tampering." + }, + "guid": "e80acb74-de42-5ef3-b959-783ff48b69b2", + "name": "Store all forms of code based on the principle of least privilege", + "properties": { + "id": "control-id:SSDF/PS/PS.1/PS.1.1" + }, "rules": [ { - "id": "PS.2::SSDF-IMAGE::SSDF", - "name": "Image-verifiable", - "shortDescription": { - "text": "PS.2 Provide a mechanism to verify the integrity of the image" - }, - "fullDescription": { - "text": "PS.2 Provide a mechanism to verify the integrity of the image" - }, "defaultConfiguration": { - "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "filter-by": [ - "product", - "target" + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" ], - "Match": { - "content_body_type": "cyclonedx-json", - "labels": null, - "signed": true, - "target_type": "container" - } - }, - "input-args": { - "identity": { - "common-names": [], - "emails": [] - } + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "desired_value": true } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.2 Provide a mechanism to verify the integrity of the image", - "markdown": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF IMAGE", - "file-hash": "a8db33184159e89d7a8bd843d64e215c3af73958e281893f0a3ef1715287c131", - "labels": [ - "SSDF", - "SBOM", - "Blueprint" - ], - "rego-hash": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", - "rule-hash": "04ff5b7a55fcf138f420837d38c5029cb9a82202dc77063fe06b24851744e673" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/2fa", + "name": "Enforce 2FA", + "shortDescription": { + "markdown": "PS.1 Require 2FA for accessing code", + "text": "PS.1 Require 2FA for accessing code" } }, { - "id": "PS.3.2::SSDF-IMAGE::SSDF", - "name": "SBOM archived", - "shortDescription": { - "text": "PS.3.2 Archive SBOM" - }, - "fullDescription": { - "text": "PS.3.2 Archive SBOM" - }, "defaultConfiguration": { - "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "filter-by": [ - "product", - "target" + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" ], - "Match": { - "content_body_type": "cyclonedx-json", - "labels": null, - "signed": true - } - }, - "input-args": { - "identity": { - "common-names": [], - "emails": [] - } + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "max_admins": 3 } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.3.2 Archive SBOM", - "markdown": "PS.3.2 Archive SBOM" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF IMAGE", - "file-hash": "926477da64e501041207be467f9ee194b19b81305116c15cb3043a6214290a20", - "labels": [ - "SSDF", - "SBOM", - "Blueprint" - ], - "rego-hash": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", - "rule-hash": "892641a5829f5104dbd4a8a8d7e39f67a96b32eaf0363685997a27bd85e87459" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/max-admins", + "name": "Limit admins", + "shortDescription": { + "markdown": "PS.1 Restrict the maximum number of organization admins", + "text": "PS.1 Restrict the maximum number of organization admins" } }, { - "id": "PS.1.1::SSDF-ORG::SSDF", - "name": "Enforce 2FA", - "shortDescription": { - "text": "PS.1 Require 2FA for accessing code" - }, - "fullDescription": { - "text": "PS.1 Require 2FA for accessing code" - }, "defaultConfiguration": { - "enabled": false, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": false + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "desired_value": true } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.1 Require 2FA for accessing code", - "markdown": "PS.1 Require 2FA for accessing code" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF ORG", - "file-hash": "973ab95c2e10dbc7f30239ba863856db4b63e80006e9bcaac00663ba109cd955", - "labels": [ - "SSDF", - "GitHub", - "Organization" - ], - "rego-hash": "7886079cbb1645876dc699c59ed1a313d50fed2d303003def656093685504f8e", - "rule-hash": "3a562d2a6d9c2b4f2543e53c7877d770ae4cc526afb466090eef58dd86beacb9" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/web-commit-signoff", + "name": "Require signoff on web commits", + "shortDescription": { + "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface", + "text": "PS.1 Require contributors to sign when committing to Github through the web interface" } }, { - "id": "PS.1.3::SSDF-ORG::SSDF", - "name": "Limit admins", - "shortDescription": { - "text": "PS.1 Restrict the maximum number of organization admins" - }, - "fullDescription": { - "text": "PS.1 Restrict the maximum number of organization admins" - }, "defaultConfiguration": { - "enabled": false, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "max_admins": 3 + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "branches": [ + "main", + "master" + ], + "desired_protected": true } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.1 Restrict the maximum number of organization admins", - "markdown": "PS.1 Restrict the maximum number of organization admins" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF ORG", - "file-hash": "d06ae8fa2d1c9b5368742ce74cc08ce8c2a51c00b15cb56e30ac66897cce4d99", - "labels": [ - "SSDF", - "Blueprint", - "GitHub", - "Organization" - ], - "rego-hash": "6db3e98fb06073d449477ab08f08bd7c507578d5be89c1ec74edc56c2f7e52b8", - "rule-hash": "b5ef81aca0c597cf2019b2652feb17ba0257b90551a2000962dd4e84149fe724" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/branch-protection", + "name": "Branch protected", + "shortDescription": { + "markdown": "PS.1 Require branch protection for the repository", + "text": "PS.1 Require branch protection for the repository" } }, { - "id": "PS.1.5::SSDF-ORG::SSDF", - "name": "Require signoff on web commits", - "shortDescription": { - "text": "PS.1 Require contributors to sign when committing to Github through the web interface" - }, - "fullDescription": { - "text": "PS.1 Require contributors to sign when committing to Github through the web interface" - }, "defaultConfiguration": { - "enabled": false, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": true + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "desired_private": true } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.1 Require contributors to sign when committing to Github through the web interface", - "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF ORG", - "file-hash": "87e452e4adfd2f96320a19529be38c3636c9018b2c93b162fd7f47b72152f0ec", - "labels": [ - "SSDF", - "GitHub", - "Organization" - ], - "rego-hash": "56fea30cb520fff9d9d32ba0926857b521d8e1b5b971d081b0283ea2ae206fd8", - "rule-hash": "f9bad566b0b69003b19fcdb0e28448d1491c5da3700ea9b47ac7c6d10082bccb" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/repo-is-private", + "name": "Repo private", + "shortDescription": { + "markdown": "PS.1 Assure the repository is private", + "text": "PS.1 Assure the repository is private" } - }, + } + ], + "shortDescription": { + "markdown": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.", + "text": "Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access." + } + }, + { + "associatedComponent": { + "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c", + "index": 0, + "name": "SSDF Client Initiative" + }, + "fullDescription": { + "markdown": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.\n\n### Mitigation\nUse cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.", + "text": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity.\nMitigation: Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Ensure that the signing keys are stored securely and that access to them is restricted. Implement automated processes to sign releases and verify their integrity before distribution. Regularly audit the signing process and keys to ensure their security and integrity." + }, + "guid": "e4664761-7b9b-5b70-85f3-839aaa4b36f1", + "name": "Make software integrity verification information available to software acquirers", + "properties": { + "id": "control-id:SSDF/PS/PS.2/PS.2.1" + }, + "rules": [ { - "id": "PS.3.1::SSDF-REPO::SSDF", - "name": "Code archived", - "shortDescription": { - "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" - }, - "fullDescription": { - "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" - }, "defaultConfiguration": { "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "labels": null, - "signed": false - } - }, - "input-args": { - "allow": true, - "description": "Since the code is within a repository, it is archived.", - "reason": "The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository.", - "short_description": "Code is archived.", - "violations": [ - { - "violation1": "thing 1" - }, - { - "something2": [ - "some", - "thing" - ], - "violation2": "thing 2" - } - ] + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true, + "target_type": "container" + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] } } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n", - "markdown": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF REPO", - "file-hash": "6f5ec45673d0172e0b9213fb695e5315b5072c0355e5648a5babf5661fce902f", - "labels": [ - "SSDF" - ], - "rego-hash": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474", - "rule-hash": "49b62752968edd1f0e536dc584cc69a6bf00e5b8ee2f1768307716c097c08b1a" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "id": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed", + "name": "Image-verifiable", + "shortDescription": { + "markdown": "PS.2 Provide a mechanism to verify the integrity of the image", + "text": "PS.2 Provide a mechanism to verify the integrity of the image" } - }, + } + ], + "shortDescription": { + "markdown": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with.", + "text": "Help software acquirers ensure that the software they acquire is legitimate and has not been tampered with." + } + }, + { + "associatedComponent": { + "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c", + "index": 0, + "name": "SSDF Client Initiative" + }, + "fullDescription": { + "markdown": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.\n\n### Mitigation\nUse secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.", + "text": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure.\nMitigation: Use secure, version-controlled repositories to store software releases and their supporting data. Implement access controls to restrict who can modify or delete these repositories. Use cryptographic signatures to sign software releases and provide a way for users to verify these signatures. Regularly back up the repositories to prevent data loss and ensure that software releases are preserved even in the event of a system failure." + }, + "guid": "c9de79fa-af19-5574-a99b-4f1523d7375b", + "name": "Securely archive the necessary files and supporting data to be retained for each software release", + "properties": { + "id": "control-id:SSDF/PS/PS.3/PS.3.1" + }, + "rules": [ { - "id": "PS.1.2::SSDF-REPO::SSDF", - "name": "Branch protected", - "shortDescription": { - "text": "PS.1 Require branch protection for the repository" - }, - "fullDescription": { - "text": "PS.1 Require branch protection for the repository" - }, "defaultConfiguration": { - "enabled": false, + "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=repository", - "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "branches": [ - "main", - "master" - ], - "desired_protected": true + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "slsa", + "labels": null, + "signed": false } - } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.1 Require branch protection for the repository", - "markdown": "PS.1 Require branch protection for the repository" + }, + "input-args": {} + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF REPO", - "file-hash": "8778a4509cf0f8c93c57f3dc106ebe00a865ee3c2deb0f5aa57e2d1b67c91164", - "labels": [ - "SSDF", - "GitHub", - "Repository" - ], - "rego-hash": "76018c06ddb321ab19e9fae6d3fdf4ebd1b04f4425239c724081f6fb8d914647", - "rule-hash": "49f62941f62a7607efd7c086f7d3734985405e3f514e9dd0daf4a4bd3c1fff8e" + "helpUri": "https://slsa.dev/spec/v1.0/requirements", + "id": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists", + "name": "Provenance exists", + "shortDescription": { + "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n", + "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n" } - }, + } + ], + "shortDescription": { + "markdown": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release", + "text": "Securely archive the necessary files and supporting data (e.g., integrity verification information, provenance data) to be retained for each software release" + } + }, + { + "associatedComponent": { + "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c", + "index": 0, + "name": "SSDF Client Initiative" + }, + "fullDescription": { + "markdown": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.\n\n### Mitigation\nUse software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.", + "text": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures.\nMitigation: Use software bill of materials (SBOM) to document the provenance of each software release and its components. Store SBOMs in a secure, version-controlled repository to ensure they can be retrieved and analyzed in the future. Implement access controls to restrict who can modify or delete SBOMs. Use cryptographic signatures to sign SBOMs and provide a way for users to verify these signatures. Regularly back up the repository to prevent data loss and ensure that SBOMs are preserved even in the event of a system failure. Document the SBOM creation process and train personnel on its importance and proper handling procedures." + }, + "guid": "aaed3f57-b11e-5c28-a500-a280f861e622", + "name": "Collect, safeguard, maintain, and share provenance data for all components of each software release", + "properties": { + "id": "control-id:SSDF/PS/PS.3/PS.3.2" + }, + "rules": [ { - "id": "PS.1.4::SSDF-REPO::SSDF", - "name": "Repo private", - "shortDescription": { - "text": "PS.1 Assure the repository is private" - }, - "fullDescription": { - "text": "PS.1 Assure the repository is private" - }, "defaultConfiguration": { - "enabled": false, + "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=repository", - "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": true + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] } } - } - }, - "helpUri": "https://scribe-security.netlify.app/docs/valint/policies", - "help": { - "text": "PS.1 Assure the repository is private", - "markdown": "PS.1 Assure the repository is private" + }, + "rank": -1 }, - "properties": { - "conditions": {}, - "control-name": "SSDF REPO", - "file-hash": "9330a8fe3aa89fa06d5f5ec52d844e345e0420a99ac3ea2ddbdc4266bdacee18", - "labels": [ - "SSDF", - "GitHub", - "Repository" - ], - "rego-hash": "d39b92225c2fbf94d2874c2e47cc1384175730db23ae9006404ee385f97385ff", - "rule-hash": "d6c637d07a348636d5e68d440f4f26908bc71ac4b42cf0b5029d1dd043f679db" + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "id": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed", + "name": "SBOM archived", + "shortDescription": { + "markdown": "PS.3 Archive SBOM", + "text": "PS.3 Archive SBOM" } } ], - "semanticVersion": "1.5.18", - "version": "1.5.18" - } - }, - "invocations": [ - { - "commandLine": "valint verify busybox:latest --bundle-branch=v2 --initiative=ssdf@v2", - "executionSuccessful": true, - "exitCode": 0, - "exitCodeDescription": "valint exited with 0, control evaluation result is: pass" + "shortDescription": { + "markdown": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])", + "text": "Collect, safeguard, maintain, and share provenance data for all components of each software release (e.g., in a software bill of materials [SBOM])" + } } ], - "results": [ - { - "properties": { - "asset": { - "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "asset-name": "busybox:1.36.1", - "asset-type": "image" - }, - "evidence": { - "content_body_type": "cyclonedx-json", - "content_type": "attest-cyclonedx-json", - "context_type": "local", - "created": "2023-07-18T23:19:33.655005962Z", - "email_addresses": [ - "victor.kartashov@gmail.com" - ], - "extra_labels": [ - "component-group=dep", + "properties": { + "verifier-context": { + "hostname": "thinkpad", + "user": "user", + "name": "my-product", + "labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "timestamp": "2025-04-15T13:05:55+03:00", + "input_name": "busybox", + "input_tag": "latest", + "content_type": "statement-sarif", + "content_body_type": "sarif", + "context_type": "local", + "predicate_type": "http://scribesecurity.com/evidence/generic/v0.1", + "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "repoDigest": [ + "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" + ], + "tag": [ + "latest", + "1.36.1", + "latest" + ], + "image_name": "index.docker.io/library/busybox:latest", + "size": 4261550, + "platform": "linux/amd64", + "created": "2023-07-18T23:19:33.655005962Z", + "target_type": "policy-results", + "sbomtype": "container", + "sbomgroup": "container", + "sbomname": "index.docker.io/library/busybox:latest", + "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "sbomhashs": [ + "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", + "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" + ], + "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "controls": [ + "SSDF/PS/PS.2/PS.2.1", + "SSDF/PS/PS.3/PS.3.1", + "SSDF/PS/PS.3/PS.3.2" + ], + "rules": [ + "SSDF/PS/PS.2/PS.2.1/sbom-is-signed", + "SSDF/PS/PS.3/PS.3.1/provenance-exists", + "SSDF/PS/PS.3/PS.3.2/sbom-is-signed" + ], + "rule-scripts": { + "artifact-signed.rego": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad" + }, + "bundle_info": { + "git_branch": "v2", + "git_target": "/home/user/.cache/valint/.tmp/git_tmp_2907983709", + "git_repo": "https://github.com/scribe-public/sample-policies.git", + "git_ref": "refs/heads/v2", + "git_commit": "45919a8c4f3ae20fceb9afa01219741f651bc2ef" + }, + "initiative-name": "SSDF Client Initiative", + "initiative-id": "SSDF", + "initiative-version": "1.0.0", + "initiative-description": "Evaluate PS rules from the SSDF initiative", + "initiative-url": "https://csrc.nist.gov/pubs/sp/800/218/final", + "initiative-fingerprint": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2", + "ref": "17700", + "store": "scribe" + } + }, + "results": [ + { + "fingerprints": { + "sha256/v1": "7897409b0d5c3397e11d786d137ef1eb4ea8223e6545f9d5b2d3e0cf026d1390" + }, + "kind": "pass", + "level": "none", + "locations": [ + { + "id": -1, + "message": { + "text": "URL" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } + } + }, + { + "id": -1, + "message": { + "text": "PRODUCT" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "my-product" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } + } + }, + { + "id": -1, + "message": { + "text": "NAME" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "busybox" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } + } + }, + { + "id": -1, + "message": { + "text": "PURL" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } + } + }, + { + "id": -1, + "message": { + "text": "REF" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "17700" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } + } + } + ], + "message": { + "markdown": "Evidence signature verified. Signed Image-SBOM origin and signature verified", + "text": "Evidence signature verified. Signed Image-SBOM origin and signature verified" + }, + "properties": { + "asset": { + "asset-display-name": "busybox:1.36.1 (image)", + "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "asset-name": "busybox:1.36.1", + "asset-type": "image" + }, + "evidence": { + "common_name": "Keys", + "content_body_type": "cyclonedx-json", + "content_type": "attest-cyclonedx-json", + "context_type": "local", + "created": "2023-07-18T23:19:33.655005962Z", + "extra_labels": [ + "component-group=packages", + "component-group=dep", "component-group=base_image", "component-group=metadata", - "component-group=packages", - "signer=victor.kartashov@gmail.com", - "signer-issuer=sigstore-intermediate" + "signer=Keys", + "signer-issuer=Scribe-Test-CA" ], "format_encoding": "json", "format_type": "cyclonedx", "format_version": "1.5", - "git_branch": "feat/sh-5802_initiatives_config", - "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", - "git_ref": "refs/heads/feat/sh-5802_initiatives_config", - "git_url": "https://github.com/scribe-security/valint.git", "hostname": "thinkpad", "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "image_name": "index.docker.io/library/busybox:latest", "input_name": "busybox", "input_scheme": "docker", "input_tag": "latest", - "issuer": "sigstore-intermediate", + "issuer": "Scribe-Test-CA", "labels": [ "component-group=base_image", "component-group=dep", "component-group=metadata", "component-group=packages", - "signer-issuer=sigstore-intermediate", - "signer=victor.kartashov@gmail.com" + "signer-issuer=Scribe-Test-CA", + "signer=Keys" ], + "name": "my-product", "platform": "linux/amd64", "predicate_type": "https://cyclonedx.org/bom/v1.5", - "ref": "/home/viktor/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", + "product_version": "v3.0.49", + "ref": "17700", "repoDigest": [ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" ], @@ -736,138 +874,223 @@ Results are also presented as a SARIF report inside an in-toto statement. "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" ], "sbomname": "index.docker.io/library/busybox:latest", - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", "sbomtype": "container", "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", "signed": true, "size": 4261550, - "store": "cache", + "store": "scribe", "tag": [ "latest", "1.36.1", "latest" ], "target_type": "container", - "timestamp": "2025-03-06T15:35:50+02:00", + "timestamp": "2025-04-15T12:59:46+03:00", "tool": "valint", "tool_vendor": "Scribe Security", - "tool_version": "1.5.18", - "user": "viktor" + "tool_version": "2.0.0", + "user": "user" + }, + "identity": { + "common-names": [ + "Keys" + ], + "issuer": "Scribe-Test-CA", + "require-signed": true, + "signed-verified": true } }, - "ruleId": "PS.3.2::SSDF-IMAGE::SSDF", - "ruleIndex": 1, - "kind": "pass", - "level": "note", - "message": { - "text": "1/1 evidence origin and signature verified. Evidence signature verified", - "markdown": "1/1 evidence origin and signature verified. Evidence signature verified" + "rank": -1, + "ruleId": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed", + "ruleIndex": 5 + }, + { + "fingerprints": { + "sha256/v1": "fa657e62d3664be07e4ad4e3f88a61149b7baef922f60d1f2f0b4b45ce1d8957" }, + "kind": "fail", + "level": "error", "locations": [ { + "id": -1, + "message": { + "text": "URL" + }, "physicalLocation": { "artifactLocation": { - "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + "index": -1, + "uri": "scribesecurity.com" }, "region": { + "byteOffset": -1, + "charOffset": -1, "startLine": 1 } - }, + } + } + ], + "message": { + "markdown": "SLSA Provenance missing", + "text": "SLSA Provenance missing" + }, + "properties": { + "asset": { + "asset-display-name": "busybox:1.36.1 (image)", + "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "asset-name": "busybox:1.36.1", + "asset-type": "image" + }, + "identity": { + "require-signed": false, + "signed-verified": false + } + }, + "rank": -1, + "ruleId": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists", + "ruleIndex": 6 + }, + { + "fingerprints": { + "sha256/v1": "53d93583ac130044624c610f997509a0222360b508727094a1b05e237d95c62f" + }, + "kind": "pass", + "level": "none", + "locations": [ + { + "id": -1, "message": { "text": "URL" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } } }, { + "id": -1, + "message": { + "text": "PRODUCT" + }, "physicalLocation": { "artifactLocation": { - "uri": "busybox" + "index": -1, + "uri": "my-product" }, "region": { + "byteOffset": -1, + "charOffset": -1, "startLine": 1 } - }, - "message": { - "text": "NAME" } }, { + "id": -1, + "message": { + "text": "NAME" + }, "physicalLocation": { "artifactLocation": { - "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" + "index": -1, + "uri": "busybox" }, "region": { + "byteOffset": -1, + "charOffset": -1, "startLine": 1 } - }, - "message": { - "text": "PURL" } }, { + "id": -1, + "message": { + "text": "PURL" + }, "physicalLocation": { "artifactLocation": { - "uri": "%2Fhome%2Fviktor%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" + "index": -1, + "uri": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" }, "region": { + "byteOffset": -1, + "charOffset": -1, "startLine": 1 } - }, + } + }, + { + "id": -1, "message": { "text": "REF" + }, + "physicalLocation": { + "artifactLocation": { + "index": -1, + "uri": "17700" + }, + "region": { + "byteOffset": -1, + "charOffset": -1, + "startLine": 1 + } } } ], - "fingerprints": { - "sha256/v1": "3b1ea9e86542f89ba143f8bc12567da7a520e0f0b478a3284b6da62a29271591" - } - }, - { + "message": { + "markdown": "Evidence signature verified. Signed Image-SBOM origin and signature verified", + "text": "Evidence signature verified. Signed Image-SBOM origin and signature verified" + }, "properties": { "asset": { + "asset-display-name": "busybox:1.36.1 (image)", "asset-id": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", "asset-name": "busybox:1.36.1", "asset-type": "image" }, "evidence": { + "common_name": "Keys", "content_body_type": "cyclonedx-json", "content_type": "attest-cyclonedx-json", "context_type": "local", "created": "2023-07-18T23:19:33.655005962Z", - "email_addresses": [ - "victor.kartashov@gmail.com" - ], "extra_labels": [ + "component-group=packages", "component-group=dep", "component-group=base_image", "component-group=metadata", - "component-group=packages", - "signer=victor.kartashov@gmail.com", - "signer-issuer=sigstore-intermediate" + "signer=Keys", + "signer-issuer=Scribe-Test-CA" ], "format_encoding": "json", "format_type": "cyclonedx", "format_version": "1.5", - "git_branch": "feat/sh-5802_initiatives_config", - "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", - "git_ref": "refs/heads/feat/sh-5802_initiatives_config", - "git_url": "https://github.com/scribe-security/valint.git", "hostname": "thinkpad", "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", + "image_name": "index.docker.io/library/busybox:latest", "input_name": "busybox", "input_scheme": "docker", "input_tag": "latest", - "issuer": "sigstore-intermediate", + "issuer": "Scribe-Test-CA", "labels": [ "component-group=base_image", "component-group=dep", "component-group=metadata", "component-group=packages", - "signer-issuer=sigstore-intermediate", - "signer=victor.kartashov@gmail.com" + "signer-issuer=Scribe-Test-CA", + "signer=Keys" ], + "name": "my-product", "platform": "linux/amd64", "predicate_type": "https://cyclonedx.org/bom/v1.5", - "ref": "/home/viktor/.cache/valint/sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json", + "product_version": "v3.0.49", + "ref": "17700", "repoDigest": [ "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" ], @@ -883,477 +1106,549 @@ Results are also presented as a SARIF report inside an in-toto statement. "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" ], "sbomname": "index.docker.io/library/busybox:latest", - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", + "sbompurl": "pkg:docker/index.docker.io/library/busybox%3Alatest@sha256%3Aa416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", "sbomtype": "container", "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", "signed": true, "size": 4261550, - "store": "cache", + "store": "scribe", "tag": [ "latest", "1.36.1", "latest" ], "target_type": "container", - "timestamp": "2025-03-06T15:35:50+02:00", + "timestamp": "2025-04-15T12:59:46+03:00", "tool": "valint", "tool_vendor": "Scribe Security", - "tool_version": "1.5.18", - "user": "viktor" + "tool_version": "2.0.0", + "user": "user" + }, + "identity": { + "common-names": [ + "Keys" + ], + "issuer": "Scribe-Test-CA", + "require-signed": true, + "signed-verified": true } }, - "ruleId": "PS.2::SSDF-IMAGE::SSDF", - "ruleIndex": 0, - "kind": "pass", - "level": "note", - "message": { - "text": "1/1 evidence origin and signature verified. Evidence signature verified", - "markdown": "1/1 evidence origin and signature verified. Evidence signature verified" - }, - "locations": [ + "rank": -1, + "ruleId": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed", + "ruleIndex": 7 + } + ], + "tool": { + "driver": { + "contents": [ + "localizedData", + "nonLocalizedData" + ], + "informationUri": "https://scribesecurity.com", + "language": "en-US", + "name": "valint", + "rules": [ { - "physicalLocation": { - "artifactLocation": { - "uri": "index.docker.io/library/busybox?version=sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824\u0026tag=latest" + "defaultConfiguration": { + "level": "error", + "parameters": { + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" + } + }, + "input-args": { + "desired_value": true + } }, - "region": { - "startLine": 1 - } + "rank": -1 }, - "message": { - "text": "URL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "busybox" - }, - "region": { - "startLine": 1 - } + "fullDescription": { + "markdown": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.\n\n### Mitigation\nEnforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials.", + "text": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.\nMitigation: Enforces two-factor authentication (2FA) for organizational accounts, significantly reducing the risk of unauthorized access through compromised credentials." }, - "message": { - "text": "NAME" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64" - }, - "region": { - "startLine": 1 - } + "guid": "7a4aecb8-d512-55e3-989a-b6fe14fa2c31", + "help": { + "markdown": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled.", + "text": "This rule verifies that two-factor authentication (2FA) is enabled for the organization by examining the provided evidence.\nIt checks the organization's details (retrieved from the SARIF or equivalent evidence) and compares the value of the \n`organization_details.two_factor_requirement_enabled` field against the expected value.\n\nThe rule iterates over the organization data in the evidence, and if the `two_factor_requirement_enabled` field does not match \nthe desired value, a violation is recorded. This ensures that all organizational accounts enforce 2FA, providing an additional \nlayer of security against unauthorized access.\n\n### **Evidence Requirements**\n- Evidence must include organization data with a field named `organization_details.two_factor_requirement_enabled`.\n- The data should come from a trusted source (e.g., a GitHub organization scan).\n- The evidence must clearly indicate whether 2FA is enabled." }, - "message": { - "text": "PURL" - } - }, - { - "physicalLocation": { - "artifactLocation": { - "uri": "%2Fhome%2Fviktor%2F.cache%2Fvalint%2Fsha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824.bom.sig.json" - }, - "region": { - "startLine": 1 - } + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/2fa", + "name": "Enforce 2FA", + "properties": { + "control-id": "control-id:SSDF/PS/PS.1/PS.1.1", + "control-name": "Store all forms of code based on the principle of least privilege", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/2fa", + "file-hash": "dbe86363a09014d6de4950d2e375cfa46ced22f7ca1908ffd2a14be8dfc95e39", + "labels": [ + "GitHub", + "Organization" + ], + "rego-hash": "7886079cbb1645876dc699c59ed1a313d50fed2d303003def656093685504f8e", + "rule-hash": "1d57f5273f15bda915b3d7b2e4ede2a12b98c9942464f571c65be225235783f3", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/2fa.yaml", + "tags": [ + "GitHub", + "Organization" + ] }, - "message": { - "text": "REF" + "shortDescription": { + "markdown": "PS.1 Require 2FA for accessing code", + "text": "PS.1 Require 2FA for accessing code" } - } - ], - "fingerprints": { - "sha256/v1": "f537ff644900611fcbcf28880e796911e3c93c4759edce3cfbf9bb383edd1c00" - } - } - ], - "automationDetails": { - "id": "valint/1741268214" - }, - "policies": [ - { - "fullDescription": { - "text": "SSDF IMAGE control evaluation" - }, - "name": "SSDF IMAGE", - "rules": [ + }, { - "id": "PS.2::SSDF-IMAGE::SSDF", - "shortDescription": { - "text": "PS.2 Provide a mechanism to verify the integrity of the image" - }, "defaultConfiguration": { - "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "filter-by": [ - "product", - "target" + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" ], - "Match": { - "content_body_type": "cyclonedx-json", - "labels": null, - "signed": true, - "target_type": "container" - } - }, - "input-args": { - "identity": { - "common-names": [], - "emails": [] - } + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "max_admins": 3 } - } + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\n\n### Mitigation\nEnsures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions.", + "text": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\nMitigation: Ensures that the number of admins in the GitHub organization is kept within a manageable limit, reducing the risk of unauthorized administrative actions." + }, + "guid": "8e55e676-bd13-586d-9a56-11aab1fb5b8b", + "help": { + "markdown": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.", + "text": "This rule ensures that the number of admins in the GitHub organization does not exceed the specified maximum.\nIt performs the following steps:\n\n1. Checks the list of admins in the GitHub organization.\n2. Verifies that the number of admins does not exceed the value specified in the `with.max_admins` configuration.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources." + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/max-admins", + "name": "Limit admins", + "properties": { + "control-id": "control-id:SSDF/PS/PS.1/PS.1.1", + "control-name": "Store all forms of code based on the principle of least privilege", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/max-admins", + "file-hash": "5093c9dcb056f04f20fcd1d5ca485ce2a23b404afdf9b57eb602fb330fec4a68", + "labels": [ + "GitHub", + "Organization" + ], + "rego-hash": "6db3e98fb06073d449477ab08f08bd7c507578d5be89c1ec74edc56c2f7e52b8", + "rule-hash": "a70d1eed7c7f5da1f77a364b5b7897910ece24da6dc6301484f33b25d534a3d9", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/max-admins.yaml", + "tags": [ + "GitHub", + "Organization" + ] + }, + "shortDescription": { + "markdown": "PS.1 Restrict the maximum number of organization admins", + "text": "PS.1 Restrict the maximum number of organization admins" } }, { - "id": "PS.3.2::SSDF-IMAGE::SSDF", - "shortDescription": { - "text": "PS.3.2 Archive SBOM" - }, "defaultConfiguration": { - "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "filter-by": [ - "product", - "target" + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=organization", + "{{- if eq (index .Context \"asset_type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" ], - "Match": { - "content_body_type": "cyclonedx-json", - "labels": null, - "signed": true - } - }, - "input-args": { - "identity": { - "common-names": [], - "emails": [] - } + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "desired_value": true } - } - } - } - ], - "shortDescription": { - "text": "SSDF IMAGE control evaluation" - }, - "properties": { - "conditions": {}, - "id": "SSDF-IMAGE::SSDF" - } - }, - { - "fullDescription": { - "text": "SSDF ORG control evaluation" - }, - "name": "SSDF ORG", - "rules": [ - { - "id": "PS.1.1::SSDF-ORG::SSDF", - "shortDescription": { - "text": "PS.1 Require 2FA for accessing code" + }, + "rank": -1 }, - "defaultConfiguration": { - "enabled": false, - "level": "error", - "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": false - } - } - } + "fullDescription": { + "markdown": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\n\n### Mitigation\nEnsure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability.", + "text": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.\nMitigation: Ensure that the Web Commit Signoff setting under the GitHub organization is enabled to require signoff on all web-based commits, enhancing security and accountability." + }, + "guid": "34acfba7-fcb7-5bc6-acef-10ed2992e32e", + "help": { + "markdown": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources.", + "text": "This rule checks if the `web_commit_signoff` setting is enabled to ensure all web-based commits are signed off.\nIt performs the following steps:\n\n1. Checks the web commit signoff settings of the GitHub organization.\n2. Verifies that the web commit signoff setting is enabled.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub organization resources." + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/web-commit-signoff", + "name": "Require signoff on web commits", + "properties": { + "control-id": "control-id:SSDF/PS/PS.1/PS.1.1", + "control-name": "Store all forms of code based on the principle of least privilege", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/org/web-commit-signoff", + "file-hash": "4c895ffaa308b4090cd047a494ddaa61d4f1ad9053fd51dacc0e9987655341b8", + "labels": [ + "GitHub", + "Organization" + ], + "rego-hash": "56fea30cb520fff9d9d32ba0926857b521d8e1b5b971d081b0283ea2ae206fd8", + "rule-hash": "513a2bafa4019e6f0392af565698c87fa79af5f59fa540b99510f101001179f5", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/org/web-commit-signoff.yaml", + "tags": [ + "GitHub", + "Organization" + ] + }, + "shortDescription": { + "markdown": "PS.1 Require contributors to sign when committing to Github through the web interface", + "text": "PS.1 Require contributors to sign when committing to Github through the web interface" } }, { - "id": "PS.1.3::SSDF-ORG::SSDF", - "shortDescription": { - "text": "PS.1 Restrict the maximum number of organization admins" - }, "defaultConfiguration": { - "enabled": false, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "max_admins": 3 + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "branches": [ + "main", + "master" + ], + "desired_protected": true } - } + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\n\n### Mitigation\nEnsure branch protection settings are correctly configured to reduce the risk of unauthorized changes.", + "text": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\nMitigation: Ensure branch protection settings are correctly configured to reduce the risk of unauthorized changes." + }, + "guid": "c925c9ec-a181-5a93-b631-72452c83fa69", + "help": { + "markdown": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.", + "text": "This rule ensures that branch protection is configured in the GitHub repository.\nIt performs the following steps:\n\n1. Checks the repository settings for branch protection.\n2. Verifies that the protection settings match the expected values.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings." + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/branch-protection", + "name": "Branch protected", + "properties": { + "control-id": "control-id:SSDF/PS/PS.1/PS.1.1", + "control-name": "Store all forms of code based on the principle of least privilege", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/branch-protection", + "file-hash": "f64f1ea140ea2b0de656283bce732c7c3ce516d7d86458cdd47f7a24d0682c1b", + "labels": [ + "GitHub", + "Repository" + ], + "rego-hash": "76018c06ddb321ab19e9fae6d3fdf4ebd1b04f4425239c724081f6fb8d914647", + "rule-hash": "f6cc83c266be32b6c998324ebb418fcf2132905593350b7aaea56f9aca8ff658", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/repository/branch-protection.yaml", + "tags": [ + "GitHub", + "Repository" + ] + }, + "shortDescription": { + "markdown": "PS.1 Require branch protection for the repository", + "text": "PS.1 Require branch protection for the repository" } }, { - "id": "PS.1.5::SSDF-ORG::SSDF", - "shortDescription": { - "text": "PS.1 Require contributors to sign when committing to Github through the web interface" - }, "defaultConfiguration": { - "enabled": false, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=organization", - "{{- if eq (index .Context \"asset-type\") \"organization\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": true + "evidence": { + "Match": { + "content_body_type": "generic", + "labels": [ + "platform=github", + "asset_type=repository", + "{{- if eq (index .Context \"asset_type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset_name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" + ], + "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", + "signed": false, + "target_type": "data" } + }, + "input-args": { + "desired_private": true } - } + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\n\n### Mitigation\nEnsures that the repository is private, reducing the risk of unauthorized access.", + "text": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.\nMitigation: Ensures that the repository is private, reducing the risk of unauthorized access." + }, + "guid": "4bb28598-0f5a-50d9-836d-45a1e39020ec", + "help": { + "markdown": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings.", + "text": "This rule ensures that the GitHub repository is private.\nIt performs the following steps:\n\n1. Checks the repository settings for privacy.\n2. Verifies that the repository is private.\n\n**Evidence Requirements:**\n- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository settings." + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private", + "id": "rule-id:SSDF/PS/PS.1/PS.1.1/repo-is-private", + "name": "Repo private", + "properties": { + "control-id": "control-id:SSDF/PS/PS.1/PS.1.1", + "control-name": "Store all forms of code based on the principle of least privilege", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/github/repository/repo-private", + "file-hash": "685f36b245c750260d57d82538cb28174473655d859c676a915c89592dace8e4", + "labels": [ + "GitHub", + "Repository" + ], + "rego-hash": "d39b92225c2fbf94d2874c2e47cc1384175730db23ae9006404ee385f97385ff", + "rule-hash": "b12031e2be3cc944fe056782649c09a3bea25d85ae220409f4310d76062d9c60", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/github/repository/repo-private.yaml", + "tags": [ + "GitHub", + "Repository" + ] + }, + "shortDescription": { + "markdown": "PS.1 Assure the repository is private", + "text": "PS.1 Assure the repository is private" } - } - ], - "shortDescription": { - "text": "SSDF ORG control evaluation" - }, - "properties": { - "conditions": {}, - "id": "SSDF-ORG::SSDF" - } - }, - { - "fullDescription": { - "text": "SSDF REPO control evaluation" - }, - "name": "SSDF REPO", - "rules": [ + }, { - "id": "PS.3.1::SSDF-REPO::SSDF", - "shortDescription": { - "text": "PS.3.1 Verify that the software release data is archived.\nWe assume running in Github thus the code is allways stored in a repository\n" - }, "defaultConfiguration": { "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "labels": null, - "signed": false - } - }, - "input-args": { - "allow": true, - "description": "Since the code is within a repository, it is archived.", - "reason": "The code is archived in a repository. This is a demo rule, planned to run from a workflow in a repository.", - "short_description": "Code is archived.", - "violations": [ - { - "violation1": "thing 1" - }, - { - "something2": [ - "some", - "thing" - ], - "violation2": "thing 2" - } - ] + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true, + "target_type": "container" + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] } } - } + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "PS.2 Provide a mechanism to verify the integrity of the image", + "text": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "guid": "bfc20ac6-43bd-5736-ae94-424ca894da2e", + "help": { + "markdown": "PS.2 Provide a mechanism to verify the integrity of the image", + "text": "PS.2 Provide a mechanism to verify the integrity of the image" + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "id": "rule-id:SSDF/PS/PS.2/PS.2.1/sbom-is-signed", + "name": "Image-verifiable", + "properties": { + "control-id": "control-id:SSDF/PS/PS.2/PS.2.1", + "control-name": "Make software integrity verification information available to software acquirers", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "file-hash": "97a32ff04b930f3b093d2e201585cbb7ac6ffdfd05ac8160092219d3e7cba055", + "labels": [ + "SBOM", + "Blueprint" + ], + "rego-hash": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad", + "rule-hash": "1b1c35c08c91266ca90211a4661146641258c4c5bae35c79d1dba4e42ce1c66d", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/sbom/artifact-signed.yaml", + "tags": [ + "SBOM", + "Blueprint" + ] + }, + "shortDescription": { + "markdown": "PS.2 Provide a mechanism to verify the integrity of the image", + "text": "PS.2 Provide a mechanism to verify the integrity of the image" } }, { - "id": "PS.1.2::SSDF-REPO::SSDF", - "shortDescription": { - "text": "PS.1 Require branch protection for the repository" - }, "defaultConfiguration": { - "enabled": false, + "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=repository", - "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "branches": [ - "main", - "master" - ], - "desired_protected": true + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "slsa", + "labels": null, + "signed": false } - } - } + }, + "input-args": {} + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n\n\n### Mitigation\nRecording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed.", + "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n\nMitigation: Recording comprehensive provenance metadata allows organizations to verify the integrity of the build process and ensures that only authorized and untampered artifacts are deployed." + }, + "guid": "ee86e0b5-fce6-57d7-8340-b4e0400a4257", + "help": { + "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n", + "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n" + }, + "helpUri": "https://slsa.dev/spec/v1.0/requirements", + "id": "rule-id:SSDF/PS/PS.3/PS.3.1/provenance-exists", + "name": "Provenance exists", + "properties": { + "control-id": "control-id:SSDF/PS/PS.3/PS.3.1", + "control-name": "Securely archive the necessary files and supporting data to be retained for each software release", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/slsa/l1-provenance-exists", + "file-hash": "f33680678db455905d921dbb799e84077db4136f20bd39696f5ba38dff8ac62b", + "help-uri": "https://slsa.dev/spec/v1.0/requirements", + "labels": [ + "SLSA" + ], + "rego-hash": "2d2a69a6f9325a7eb60862a84a791ce1d2209b213840d4431d810da290227121", + "rule-hash": "49632226ef0db07882bc5ec0e29749bfd57d967fda1400ea5ade54646fd22482", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/slsa/l1-provenance-exists.yaml", + "tags": [ + "SLSA" + ] + }, + "shortDescription": { + "markdown": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n", + "text": "PS.3 Provenance exists\nEnsure that provenance information is available for each software release\n" } }, { - "id": "PS.1.4::SSDF-REPO::SSDF", - "shortDescription": { - "text": "PS.1 Assure the repository is private" - }, "defaultConfiguration": { - "enabled": false, + "enabled": true, "level": "error", "parameters": { - "properties": { - "evidence": { - "Match": { - "content_body_type": "generic", - "labels": [ - "platform=github", - "asset_type=repository", - "{{- if eq (index .Context \"asset-type\") \"repository\" -}} {{- asset_on_target (index .Context \"asset-name\") -}} {{- else -}} {{- asset_on_target nil -}} {{- end -}}" - ], - "predicate_type": "http://scribesecurity.com/evidence/discovery/v0.1", - "signed": false, - "target_type": "data" - } - }, - "input-args": { - "desired_value": true + "evidence": { + "filter-by": [ + "product", + "target" + ], + "Match": { + "content_body_type": "cyclonedx-json", + "labels": null, + "signed": true + } + }, + "input-args": { + "identity": { + "common-names": [], + "emails": [] } } - } + }, + "rank": -1 + }, + "fullDescription": { + "markdown": "PS.3 Archive SBOM", + "text": "PS.3 Archive SBOM" + }, + "guid": "3e48369b-35d6-5726-aa74-3f03bfaa526f", + "help": { + "markdown": "PS.3 Archive SBOM", + "text": "PS.3 Archive SBOM" + }, + "helpUri": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "id": "rule-id:SSDF/PS/PS.3/PS.3.2/sbom-is-signed", + "name": "SBOM archived", + "properties": { + "control-id": "control-id:SSDF/PS/PS.3/PS.3.2", + "control-name": "Collect, safeguard, maintain, and share provenance data for all components of each software release", + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/rules/sbom/artifact-signed", + "file-hash": "97a32ff04b930f3b093d2e201585cbb7ac6ffdfd05ac8160092219d3e7cba055", + "labels": [ + "SBOM", + "Blueprint" + ], + "rego-hash": "bb8e7472921cf089cb03c1806690e8401d2393e0b224d62ffbab0d521c71f3ad", + "rule-hash": "0f5245e0d08f8d1a31af2b943d67fb31a0daa336111cd65e3fae52d3f4317c68", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/rules/sbom/artifact-signed.yaml", + "tags": [ + "SBOM", + "Blueprint" + ] + }, + "shortDescription": { + "markdown": "PS.3 Archive SBOM", + "text": "PS.3 Archive SBOM" } } ], - "shortDescription": { - "text": "SSDF REPO control evaluation" - }, - "properties": { - "conditions": {}, - "id": "SSDF-REPO::SSDF" - } - } - ], - "properties": { - "verifier-context": { - "hostname": "thinkpad", - "user": "viktor", - "labels": [ - "component-group=base_image", - "component-group=metadata" - ], - "extra_labels": [ - "component-group=base_image", - "component-group=metadata" - ], - "timestamp": "2025-03-06T15:36:53+02:00", - "input_name": "busybox", - "input_tag": "latest", - "content_type": "statement-sarif", - "content_body_type": "sarif", - "context_type": "local", - "predicate_type": "http://scribesecurity.com/evidence/generic/v0.1", - "git_url": "https://github.com/scribe-security/valint.git", - "git_branch": "feat/sh-5802_initiatives_config", - "git_commit": "c929f96c7fcde3284c3f6988546f12fe1e63c77d", - "git_ref": "refs/heads/feat/sh-5802_initiatives_config", - "imageID": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "repoDigest": [ - "busybox@sha256:3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79" - ], - "tag": [ - "latest", - "1.36.1", - "latest" - ], - "size": 4261550, - "platform": "linux/amd64", - "created": "2023-07-18T23:19:33.655005962Z", - "target_type": "policy-results", - "sbomtype": "container", - "sbomgroup": "container", - "sbomname": "index.docker.io/library/busybox:latest", - "sbomversion": "sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824", - "sbomhashs": [ - "sha256-3fbc632167424a6d997e74f52b878d7cc478225cffac6bc977eedfe51c7f4e79", - "sha256-a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824" - ], - "sbompurl": "pkg:docker/index.docker.io/library/busybox:latest@sha256:a416a98b71e224a31ee99cff8e16063554498227d2b696152a9c3e0aa65e5824?arch=amd64", - "sbomcomponents": [ - "base_image", - "metadata" - ], - "initiative": { + "semanticVersion": "1.5.18-3", + "version": "1.5.18-3" + }, + "extensions": [ + { + "contents": [ + "localizedData", + "nonLocalizedData" + ], + "guid": "9d2a317f-93c1-5a37-b08d-21362788ca2c", + "informationUri": "https://csrc.nist.gov/pubs/sp/800/218/final", + "language": "en-US", + "locations": [ + { + "index": -1, + "uri": "https://github.com/scribe-public/sample-policies/blob/v2/v2/initiatives/ssdf.yaml" + } + ], "name": "SSDF Client Initiative", - "id": "SSDF", - "version": "1.0.0", - "description": "Evaluate PS rules from the SSDF initiative", - "url": "https://csrc.nist.gov/pubs/sp/800/218/final", - "fingerprint": "788a0897074facf3eb9572dc04172e4db8ca30582fe02b2d31c93d3428d38043" - }, - "controls": [ - "SSDF-IMAGE::SSDF" - ], - "rules": [ - "PS.2::SSDF-IMAGE::SSDF", - "PS.3.2::SSDF-IMAGE::SSDF" - ], - "allow": true, - "rule-scripts": { - "artifact-signed.rego": "7382b99c181b9a97db6da57b03f702fe9efae5b0d91592ddd5dc2fc23cd6c729", - "data.rego": "b845d9e0800f74f2a3f37c3a1ec75cb1ec2c0cd81e8645fa901be673163ea474" - }, - "bundle_info": { - "git_branch": "v2", - "git_target": "/home/viktor/.cache/valint/.tmp/git_tmp_3916451226", - "git_repo": "https://github.com/scribe-public/sample-policies.git", - "git_ref": "refs/heads/v2", - "git_commit": "fcf251b0d3910a9679be812cf4a87a4e86e0aafc" + "properties": { + "doc-url": "https://scribe-security.netlify.app/docs/configuration/initiatives/ssdf", + "help-uri": "https://csrc.nist.gov/pubs/sp/800/218/final", + "initiative-hash": "d9e4049ae300a219f21eb55047c4461f3bec75bf914e84742cb18a28e29c2ca2", + "initiative-id": "SSDF", + "initiative-name": "SSDF Client Initiative", + "report-version": "2.0.0", + "source-url": "https://github.com/scribe-public/sample-policies/blob/v2/v2/initiatives/ssdf.yaml" + }, + "shortDescription": { + "markdown": "Evaluate PS rules from the SSDF initiative", + "text": "Evaluate PS rules from the SSDF initiative" + }, + "version": "1.0.0" } - } + ] } } - ] + ], + "properties": {} } } } From 41ceca8e6d15789a47a4980a19d03a996c96a63b Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 15 Apr 2025 14:42:23 +0300 Subject: [PATCH 183/191] fix: updated default list of filter-by groups --- docs/valint/initiatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index bec91be56..74d09d68a 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -567,7 +567,7 @@ By default, the `target` and `product` groups are enabled for each rule. - `product_version` - the version of the product (provided to `valint` as a `--product-version` argument) Users can specify any combination of these three groups or a special value `none` to indicate that the parameter should not be derived automatically. -By default, the `target` and `product` groups are used. +By default, the `product` group is used. The list of groups to be used should be provided to the `.evidence.filter-by` field in the configuration file. Any value provided overrides the default list. See the usage example below for more details. From 476e069c0778a86b070699974d951d7c4bb8d130 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Tue, 15 Apr 2025 19:19:17 +0300 Subject: [PATCH 184/191] fixed SARIF paths for kyverno --- docs/integrating-scribe/admission-controller/kyverno.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/integrating-scribe/admission-controller/kyverno.md b/docs/integrating-scribe/admission-controller/kyverno.md index fa05f9260..8f6482e81 100644 --- a/docs/integrating-scribe/admission-controller/kyverno.md +++ b/docs/integrating-scribe/admission-controller/kyverno.md @@ -264,17 +264,17 @@ spec: # Uncomment the checks you wish to enforce: # 1) Ensure the initiative result is "pass": - - key: "{{ content.runs[0].invocations[0].properties.properties.\"initiative-result\" }}" + - key: "{{ content.runs[0].invocations[0].properties.\"initiative-result\" }}" operator: Equals value: "pass" # 2) Verify the initiative ID is "SP-800-190": - - key: "{{ content.runs[0].invocations[0].properties.properties.\"initiative-id\" }}" + - key: "{{ content.runs[0].invocations[0].properties.\"initiative-id\" }}" operator: Equals value: "SP-800-190" # 3) Confirm a specific control ID—"SP-800-190/4.1"—passed: - - key: "{{ content.runs[0].invocations[0].properties.properties.\"control-result\".\"control-id:SP-800-190/4.1\" }}" + - key: "{{ content.runs[0].invocations[0].properties.\"control-result\".\"control-id:SP-800-190/4.1\" }}" operator: Equals value: "pass" ``` From 53befde61cc2c2a964b64881e10b1f1f52b8c253 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Wed, 16 Apr 2025 16:25:20 +0300 Subject: [PATCH 185/191] update rule descriptions --- docs/configuration/initiatives/index.md | 2 +- .../rules/github/org/allow-admins.md | 2 +- .../rules/images/blocklist-build-scripts.md | 4 ++++ .../rules/images/forbid-large-images.md | 4 ++++ .../rules/images/restrict-shell-entrypoint.md | 4 ++++ .../rules/images/verify-labels-exist.md | 4 ++++ .../initiatives/rules/images/verify-labels.md | 4 ++++ .../rules/slsa/verify-external-parameters.md | 20 +++++++++++++++---- 8 files changed, 38 insertions(+), 6 deletions(-) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 666e3b27f..e0deef505 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -284,7 +284,7 @@ | Rule Name | Description | |-----------|-------------| -| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified exterenal parameters value match in the provenance document. | +| [SLSA External Parameters Match in Provenance Document](/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md) | Verify the specified external parameters value match in the provenance document. | | [Verify that provenance is authenticated](/docs/configuration/initiatives/rules/slsa/l2-provenance-authenticated.md) | Verify the artifact is signed. | | [SLSA Field Exists in Provenance Document](/docs/configuration/initiatives/rules/slsa/field-exists.md) | Verify the specified field exists in the provenance document. | | [Verify Provenance Document Exists](/docs/configuration/initiatives/rules/slsa/l1-provenance-exists.md) | Verify that the Provenance document evidence exists. | diff --git a/docs/configuration/initiatives/rules/github/org/allow-admins.md b/docs/configuration/initiatives/rules/github/org/allow-admins.md index 04b60260f..8ef25f7f2 100644 --- a/docs/configuration/initiatives/rules/github/org/allow-admins.md +++ b/docs/configuration/initiatives/rules/github/org/allow-admins.md @@ -4,7 +4,7 @@ title: Allowed GitHub Organization Admins --- # Allowed GitHub Organization Admins **Type:** Rule -**ID:** `github-orgallowed-admins` +**ID:** `github-org-allowed-admins` **Source:** [v2/rules/github/org/allow-admins.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.yaml) **Rego Source:** [allow-admins.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/org/allow-admins.rego) **Labels:** GitHub, Organization diff --git a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md index 44927c5d6..c9b26b396 100644 --- a/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md +++ b/docs/configuration/initiatives/rules/images/blocklist-build-scripts.md @@ -20,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by target and product. +::: ## Usage example @@ -46,6 +49,7 @@ If a match is found, the rule generates a violation indicating that a disallowed | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/images/forbid-large-images.md b/docs/configuration/initiatives/rules/images/forbid-large-images.md index 456fd5442..8a4558cae 100644 --- a/docs/configuration/initiatives/rules/images/forbid-large-images.md +++ b/docs/configuration/initiatives/rules/images/forbid-large-images.md @@ -20,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by target and product. +::: ## Usage example @@ -53,6 +56,7 @@ The extracted size is then converted to a numeric value and compared against the | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md index 5242b965f..809e5a2d8 100644 --- a/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md +++ b/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md @@ -20,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by target and product. +::: ## Usage example @@ -43,4 +46,5 @@ This rule extracts the 'entrypoint' property from the CycloneDX SBOM metadata an | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | diff --git a/docs/configuration/initiatives/rules/images/verify-labels-exist.md b/docs/configuration/initiatives/rules/images/verify-labels-exist.md index 0eff8b5d7..34759b8ab 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels-exist.md +++ b/docs/configuration/initiatives/rules/images/verify-labels-exist.md @@ -20,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by target and product. +::: ## Usage example @@ -58,6 +61,7 @@ This rule checks the CycloneDX SBOM evidence for the container image to verify t | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/images/verify-labels.md b/docs/configuration/initiatives/rules/images/verify-labels.md index 6c8c45e84..c492c1062 100644 --- a/docs/configuration/initiatives/rules/images/verify-labels.md +++ b/docs/configuration/initiatives/rules/images/verify-labels.md @@ -20,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by target and product. +::: ## Usage example @@ -54,6 +57,7 @@ required label (as defined in the `with.labels` parameter) exists with the corre | signed | False | | content_body_type | cyclonedx-json | | target_type | container | +| filter-by | ['target', 'product'] | ## Input Definitions | Parameter | Type | Required | Description | diff --git a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md index cb40c414e..f78b080ee 100644 --- a/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md +++ b/docs/configuration/initiatives/rules/slsa/verify-external-parameters.md @@ -9,7 +9,7 @@ title: SLSA External Parameters Match in Provenance Document **Rego Source:** [verify-external-parameters.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/slsa/verify-external-parameters.rego) **Labels:** SLSA -Verify the specified exterenal parameters value match in the provenance document. +Verify the specified external parameters value match in the provenance document. :::note This rule requires SLSA Provenance. See [here](/docs/valint/help/valint_slsa) for more details. @@ -27,17 +27,29 @@ Rule requires evaluation with a target. Without one, it will be **disabled** unl uses: slsa/verify-external-parameters@v2 with: parameters: - "key": "value" + "key_1": "value_1" # match the value exactly + "key_2": # match any of the values in the array + - "value_2" + - "value_3" + "key_3": # match any of the values in the numeric array + - 4 + - 5 + "key_4": # match a number between min and max + "min": 1 + "max": 10 ``` ## Mitigation -Ensure that the external parameters field is present in the provenance document and that its value matches the expected value. To add such field, pass it as `key=value` in the `--external` flag for `valint slsa` command. +Ensure that the external parameters field is present in the provenance document and that its value matches the expected value. To add such a field, pass it as `key=value` in the `--external` flag for the `valint slsa` command. ## Description This rule verifies that the specified external parameters value matches in the provenance document. It checks if the external parameters field exists and if its value matches the expected value. -The parameters are passed as key-value pairs. +The allowed parameters values can be passed to the rule in the `key: value` format, where `value` can be: +- `string` or `number` -- requires a direct match +- `array` of `strings` or `numbers` -- requires the actual value to match one of the values in the array +- `object` with `min` and `max` -- requires the actual value to be a number between the min and max values ## Evidence Requirements | Field | Value | From 42a0b7f725b968a831ee59b6d52c2c073e4b3763 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 20 Apr 2025 15:01:02 +0300 Subject: [PATCH 186/191] updated filter-by description --- docs/valint/initiatives.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 74d09d68a..778767bbc 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -545,14 +545,17 @@ In order to run a policy rule, `valint` requires relevant evidence, which can be These parameters can be set manually by the user or automatically derived from the context. Parameters that can be derived automatically by `valint` are categorized into three context groups: `target`, `pipeline`, and `product`. -By default, the `target` and `product` groups are enabled for each rule. +By default, the `product` group is enabled for each rule. 1. The `target` context group specifies parameters that can be derived from the target provided to the `valint verify` command (a docker image, a git repo or a file). These parameters are: - `target_type` - the type of the target provided (e.g., image, git, generic, etc.) - `sbomversion` - the version of the SBOM provided (usually it's sha256 or sha1 hash) :::info - If this parameter is set and no target is provided, the rule is disabled with a warning._ + If this parameter is set and no target is provided, the rule is disabled with a warning. + ::: + :::info + If `target_type` is set manually in the rule config and a target of a different type is provided, the rule is disabled with a warning. ::: 2. The `pipeline` context group specifies parameters that can be derived from the running environment. These parameters are: From 7d238fd6f99c0ab7a7c6764620ec54b50c5f5172 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 18 May 2025 13:42:35 +0300 Subject: [PATCH 187/191] updated generated rule docs --- docs/configuration/initiatives/index.md | 1 + .../rules/api/scribe-api-cve-product.md | 3 - .../initiatives/rules/api/scribe-api-cve.md | 2 +- .../rules/api/scribe-api-findings.md | 60 +++++++++++++++++++ .../initiatives/rules/api/scribe-api.md | 8 ++- .../rules/github/api/branch-protection.md | 3 - .../rules/github/api/signed-commits-list.md | 3 - .../rules/github/api/signed-commits-range.md | 3 - .../rules/gitlab/api/push-rules.md | 3 - .../rules/gitlab/api/signed-commits-list.md | 3 - .../rules/gitlab/api/signed-commits-range.md | 3 - 11 files changed, 68 insertions(+), 24 deletions(-) create mode 100644 docs/configuration/initiatives/rules/api/scribe-api-findings.md diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index e0deef505..3981263ec 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -305,6 +305,7 @@ | [Sign Selected Commits in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md) | Verify the selected commits are signed in the GitLab organization. | | [Set Push Rules in GitLab](/docs/configuration/initiatives/rules/gitlab/api/push-rules.md) | Verify GitLab push rules are configured via the API. | | [Sign Selected Commit Range in GitLab](/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md) | Verify the selected range of commits is signed via the GitLab API. | +| [Verify No 3rd Party Findings via Scribe API](/docs/configuration/initiatives/rules/api/scribe-api-findings.md) | Verify via Scribe API that there are no findings reported by 3rd party tools in the target product. | | [Verify No Critical or High Vulnerabilities in Product](/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in any deliverable component of the product. | \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md index 69daeee85..13a519171 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve-product.md @@ -17,9 +17,6 @@ Evidence **IS NOT** required for this rule. :::tip Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/api/scribe-api-cve.md b/docs/configuration/initiatives/rules/api/scribe-api-cve.md index 9cf3d3ac8..420ce34c5 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api-cve.md +++ b/docs/configuration/initiatives/rules/api/scribe-api-cve.md @@ -6,7 +6,7 @@ title: Verify No Critical or High Vulnerabilities **Type:** Rule **ID:** `scribe-cve` **Source:** [v2/rules/api/scribe-api-cve.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.yaml) -**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) +**Rego Source:** [scribe-api-cve.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-cve.rego) **Labels:** SCA, Blueprint, Scribe Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). diff --git a/docs/configuration/initiatives/rules/api/scribe-api-findings.md b/docs/configuration/initiatives/rules/api/scribe-api-findings.md new file mode 100644 index 000000000..f0232b8b3 --- /dev/null +++ b/docs/configuration/initiatives/rules/api/scribe-api-findings.md @@ -0,0 +1,60 @@ +--- +sidebar_label: Verify No 3rd Party Findings via Scribe API +title: Verify No 3rd Party Findings via Scribe API +--- +# Verify No 3rd Party Findings via Scribe API +**Type:** Rule +**ID:** `scribe-findings` +**Source:** [v2/rules/api/scribe-api-findings.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.yaml) +**Rego Source:** [scribe-api-findings.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api-findings.rego) +**Labels:** SCA, Blueprint, Scribe + +Verify via Scribe API that there are no findings reported by 3rd party tools in the target product. + +:::tip +Evidence **IS NOT** required for this rule. +::: +:::tip +Rule requires the Scribe API to be enabled. Ensure that you provide the Scribe Token to the `valint` utility. +::: + +## Usage example + +```yaml +uses: api/scribe-api-findings@v2 +with: + superset: + findings: + severities: + - Critical + - High + tools: + - Trivy + - Snyk + titles: + - "CVE-2023-1234" + - "CVE-2023-5678" + - "CVE-2025" + cwes: + - "CWE-123" + - "CWE-456" + descriptions: + - "Vulnerability in component X" + - "Misconfiguration in component Y" + descriptions_to_ignore: + - "False positive in component Z" + - "Known issue in component A" +``` + +## Mitigation +Ensure that all findings reported by 3rd party tools are addressed before delivering the product. + + +## Description +This rule ensures that there are no findings, such as vulnerabilities, misconfigurations, or other issues reported by 3rd party tools, in any component of the product by verifying via the Scribe API. + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| superset | object | False | Filters for the findings. See usage example. | + diff --git a/docs/configuration/initiatives/rules/api/scribe-api.md b/docs/configuration/initiatives/rules/api/scribe-api.md index 77616e83a..fa486ba30 100644 --- a/docs/configuration/initiatives/rules/api/scribe-api.md +++ b/docs/configuration/initiatives/rules/api/scribe-api.md @@ -6,6 +6,7 @@ title: Apply Scribe Template Policy **Type:** Rule **ID:** `scribe-template` **Source:** [v2/rules/api/scribe-api.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.yaml) +**Rego Source:** [scribe-api.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/api/scribe-api.rego) **Labels:** Scribe Verify XX using the Scribe API template rule. @@ -19,6 +20,9 @@ Signed Evidence for this rule **IS NOT** required by default but is recommended. :::warning Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. ::: +:::info +Rule is scoped by product and target. +::: ## Usage example @@ -29,12 +33,12 @@ uses: api/scribe-api@v2 ## Evidence Requirements | Field | Value | |-------|-------| +| filter-by | ['product', 'target'] | | signed | False | | content_body_type | cyclonedx-json | -| predicate_type | https://cyclonedx.org/bom | ## Rule Parameters (`with`) | Parameter | Default | |-----------|---------| -| superset | None | +| superset | `{'cve': {'max': 0, 'severity': 6}, 'licences': {'max': 500}, 'unmaintained': {'max': 2000}, 'images': {'max': 20}}` | diff --git a/docs/configuration/initiatives/rules/github/api/branch-protection.md b/docs/configuration/initiatives/rules/github/api/branch-protection.md index 12552ec0a..00d7561e9 100644 --- a/docs/configuration/initiatives/rules/github/api/branch-protection.md +++ b/docs/configuration/initiatives/rules/github/api/branch-protection.md @@ -14,9 +14,6 @@ Verify GitHub branch protection rules :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md index ebf40eb64..b4e835d21 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-list.md @@ -14,9 +14,6 @@ Verify selected commits are signed in the GitHub organization. :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md index 9d0b7093a..66010fe4d 100644 --- a/docs/configuration/initiatives/rules/github/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/github/api/signed-commits-range.md @@ -14,9 +14,6 @@ Verify commits in the specified time range are signed. :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md index ed920bec2..61a775b66 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/push-rules.md +++ b/docs/configuration/initiatives/rules/gitlab/api/push-rules.md @@ -14,9 +14,6 @@ Verify GitLab push rules are configured via the API. :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md index 9856be44f..0abbada93 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-list.md @@ -14,9 +14,6 @@ Verify the selected commits are signed in the GitLab organization. :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example diff --git a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md index 341ba70a7..9f526d4e8 100644 --- a/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md +++ b/docs/configuration/initiatives/rules/gitlab/api/signed-commits-range.md @@ -14,9 +14,6 @@ Verify the selected range of commits is signed via the GitLab API. :::tip Evidence **IS NOT** required for this rule. ::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: ## Usage example From 1d52e599bc59fb239ab9e68aee076a439578326d Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 18 May 2025 13:55:37 +0300 Subject: [PATCH 188/191] Partially Revert "upstream valint v1.5.19" (attempt to fix broken build) This reverts commit 51c646eeac456cb9f1927800cb7831a340de860b. --- docs/valint/help/valint.md | 2 +- docs/valint/help/valint_bom.md | 2 +- docs/valint/help/valint_diff.md | 2 +- docs/valint/help/valint_discard.md | 2 +- docs/valint/help/valint_download.md | 2 +- docs/valint/help/valint_evidence.md | 2 +- docs/valint/help/valint_list.md | 2 +- docs/valint/help/valint_slsa.md | 2 +- docs/valint/help/valint_verify.md | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index eb83aaf16..64d6962bd 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -19,7 +19,7 @@ Flags for `valint` | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index 4c51188d3..f18c6ba72 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -70,7 +70,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_diff.md b/docs/valint/help/valint_diff.md index 637c29b69..17c204504 100644 --- a/docs/valint/help/valint_diff.md +++ b/docs/valint/help/valint_diff.md @@ -50,7 +50,7 @@ global flag for all commands | -C | --context-type | CI context type, options=[jenkins github circleci local gitlab] | "local" | | -L | --label | Add Custom labels | | | -D | --level | Log depth level, options=[panic fatal error warning info debug trace] | | -| -d | --output-directory | Output directory path | "${XDG_CACHE_HOME}/valint" | +| -d | --output-directory | Output directory path | "$\{XDG_CACHE_HOME\}/valint" | | -O | --output-file | Output file name | | | -n | --product-key | Scribe Project Key | | | -q | --quiet | Suppress all logging output | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index cbc893b6a..93fce86f9 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -36,7 +36,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index 2f2a03052..a6368c654 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -32,7 +32,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index 6161a0ad7..b7ce82e20 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -54,7 +54,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index ff0f3da48..65c37a5dc 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -43,7 +43,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index dd78e93db..6b7797c9c 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -65,7 +65,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index b98d0aa11..5be7bfdbc 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -76,7 +76,7 @@ Flags for all `valint` subcommands | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | | -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 6c9528680661ca42daa3ebcd46f323e3c7bb66ac Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Fri, 23 May 2025 17:22:01 +0300 Subject: [PATCH 189/191] Update export.yaml fix ubuntu version in the os matrix --- .github/workflows/export.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/export.yaml b/.github/workflows/export.yaml index ce030efe5..bed2d3f6c 100644 --- a/.github/workflows/export.yaml +++ b/.github/workflows/export.yaml @@ -11,7 +11,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-20.04] # TODO: only build + os: [ubuntu-24.04] # TODO: only build repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"] runs-on: ${{ matrix.os }} defaults: @@ -52,4 +52,4 @@ jobs: branch: docs_import_${{ steps.extract_branch.outputs.branch }} path: sub/${{ matrix.repo }} token: ${{ secrets.PR_PAT }} - title: autogen - docs export \ No newline at end of file + title: autogen - docs export From 3004f64418e71d30ce3697fbaa7b3807dcc0530f Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 27 May 2025 09:47:05 +0300 Subject: [PATCH 190/191] update --- .../ci-integrations/azure.md | 56 +++++++------- .../ci-integrations/bitbucket.md | 76 ++++++++++++------- .../ci-integrations/github/action-bom.md | 14 ++-- .../ci-integrations/github/action-evidence.md | 10 ++- .../ci-integrations/github/action-slsa.md | 10 ++- .../ci-integrations/github/action-verify.md | 25 ++++-- scripts/sync_docs.sh | 66 +++++++++++----- 7 files changed, 167 insertions(+), 90 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/azure.md b/docs/integrating-scribe/ci-integrations/azure.md index 5e13c4ee9..d92d186c7 100644 --- a/docs/integrating-scribe/ci-integrations/azure.md +++ b/docs/integrating-scribe/ci-integrations/azure.md @@ -45,8 +45,8 @@ In your Azure DevOps project make sure you have a file named `azure-pipelines.ym vmImage: 'ubuntu-latest' steps: - - task: ScribeInstall@0 - - task: ValintCli@0 + - task: ScribeInstall@2 + - task: ValintCli@2 displayName: SBOM image `busybox:latest`. command: bom target: nginx @@ -62,7 +62,7 @@ In your Azure DevOps project make sure you have a file named `azure-pipelines.ym Generate an SBOM for an image in a public registry ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate cyclonedx json SBOM inputs: commandName: bom @@ -104,9 +104,9 @@ jobs: SUPPLIER_PHONE: 001-001-0011 steps: - - task: scribeInstall@0 + - task: ScribeInstall@2 - - task: ValintCli@0 + - task: ValintCli@2 inputs: command: bom target: nginx @@ -122,7 +122,7 @@ jobs: supplier-email: $(SUPPLIER_EMAIL) supplier-phone: $(SUPPLIER_PHONE) - - task: ValintCli@0 + - task: ValintCli@2 inputs: command: verify target: nginx @@ -138,7 +138,7 @@ jobs: Generate SLSA provenance for an image in a public registry ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate SLSA provenance inputs: commandName: slsa @@ -154,7 +154,7 @@ jobs: Generate an SBOM for for an image built with local docker ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate cyclonedx json SBOM inputs: commandName: bom @@ -169,7 +169,7 @@ jobs: Generate SLSA provenance for for an image built with local docker ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate SLSA provenance inputs: commandName: slsa @@ -186,7 +186,7 @@ jobs: > Add a `docker login` task before the adding the following task: ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate cyclonedx json SBOM inputs: commandName: bom @@ -203,7 +203,7 @@ jobs: > Before the following task add a `docker login` task ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate SLSA provenance inputs: commandName: slsa @@ -229,7 +229,7 @@ jobs: vmImage: 'ubuntu-latest' steps: - - task: ValintCli@0 + - task: ValintCli@2 displayName: Generate cyclonedx json SBOM - add metadata - labels, envs, name inputs: commandName: bom @@ -256,7 +256,7 @@ jobs: vmImage: 'ubuntu-latest' steps: - - task: ValintCli@0 + - task: ValintCli@2 displayName: Generate cyclonedx json SBOM - add metadata - labels, envs, name inputs: commandName: slsa @@ -275,7 +275,7 @@ jobs: > Use `format` input argumnet to set the format. ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: SBOM image `busybox:latest`. inputs: command: bom @@ -301,7 +301,7 @@ jobs: > Use `format` input argumnet to set the format. ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: SLSA image `busybox:latest`. inputs: command: slsa @@ -329,7 +329,7 @@ jobs: mkdir testdir echo "test" > testdir/test.txt -- task: ValintCli@0 +- task: ValintCli@2 displayName: SBOM local directory. inputs: command: bom @@ -348,7 +348,7 @@ jobs: mkdir testdir echo "test" > testdir/test.txt -- task: ValintCli@0 +- task: ValintCli@2 displayName: SLSA local directory. inputs: command: slsa @@ -366,7 +366,7 @@ jobs: For a remote git repo: ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: SBOM remote git repository. inputs: command: bom @@ -381,7 +381,7 @@ For a local git repo: ```YAML - checkout: self -- task: ValintCli@0 +- task: ValintCli@2 displayName: SBOM local git repository. inputs: command: bom @@ -396,7 +396,7 @@ For a local git repo: For a remote git repo: ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: SBOM remote git repository. inputs: command: slsa @@ -410,7 +410,7 @@ For a remote git repo: ```YAML - checkout: self -- task: ValintCli@0 +- task: ValintCli@2 displayName: SLSA local git repository. inputs: command: slsa @@ -441,9 +441,9 @@ Related flags: steps: - script: echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin [my_registry] - - task: scribeInstall@0 + - task: ScribeInstall@2 - - task: ValintCli@0 + - task: ValintCli@2 inputs: commandName: bom target: [target] @@ -452,7 +452,7 @@ Related flags: oci: true ociRepo: [oci_repo] - - task: ValintCli@0 + - task: ValintCli@2 inputs: commandName: verify target: [target] @@ -471,7 +471,7 @@ Related flags: Create SBOM for remote `busybox:latest` image. ```YAML -- task: ValintCli@0 +- task: ValintCli@2 displayName: Generate cyclonedx json SBOM inputs: commandName: bom @@ -517,9 +517,9 @@ For example, using `docker login` command. steps: - script: echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin [my_registry] - - task: scribeInstall@0 + - task: ScribeInstall@2 - - task: ValintCli@0 + - task: ValintCli@2 inputs: commandName: bom target: [target] @@ -528,7 +528,7 @@ For example, using `docker login` command. oci: true ociRepo: [oci_repo] - - task: ValintCli@0 + - task: ValintCli@2 inputs: commandName: verify target: [target] diff --git a/docs/integrating-scribe/ci-integrations/bitbucket.md b/docs/integrating-scribe/ci-integrations/bitbucket.md index 27bbde689..72d8c4827 100644 --- a/docs/integrating-scribe/ci-integrations/bitbucket.md +++ b/docs/integrating-scribe/ci-integrations/bitbucket.md @@ -10,10 +10,13 @@ Use the following instructions to integrate your Bitbucket with Scribe. Add the following snippet to the script section of your `bitbucket-pipelines.yml` file: ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND_NAME: "" TARGET: "" + # INITIATIVE: "" + # INITIATIVE_ID: "" + # INITIATIVE_NAME: "" # VERBOSE: '' # Optional # CONFIG:'' # Optional # FORMAT: '' # Optional @@ -71,6 +74,8 @@ Add the following snippet to the script section of your `bitbucket-pipelines.yml # SCRIBE_URL: '' # Optional # STRUCTURED: '' # Optional # TIMEOUT: '' # Optional + # BOM: '' # Optional + # PROVENANCE: '' # Optional ``` ### Required Variables @@ -116,7 +121,6 @@ Flags for all `valint` subcommands | OUTPUT_FILE | Output file name | | | PIPELINE_NAME | Pipeline name | | | PLATFORM | Select target platform, examples=windows/armv6, arm64 ..) | | -| POLICY_ARGS | Policy arguments | [] | | PREDICATE_TYPE | Custom Predicate type (generic evidence format) | "http://scribesecurity.com/evidence/generic/v0.1" | any | | PRODUCT_KEY | Product Key | | | PRODUCT_VERSION | Product Version | | @@ -190,29 +194,45 @@ if `COMMAND` is set to `evidence`: | TOOL_VENDOR | Tool vendor | | | TOOL_VERSION | Tool version | | | (*) = required variable. | | | +Ah, I see! You want to include the **initiative flags** (e.g., `INITIATIVE`, `INITIATIVE_ID`, `INITIATIVE_NAME`) in the **Verify Command Variables** section. Here's the updated table with the initiative flags included: + +--- ### Verify Command Variables -if `COMMAND` is set to `verify`: +If `COMMAND` is set to `verify`: + +| Variable | Usage | Default | +| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | +| `ATTESTATION` | Attestation for target | Required | +| `BUNDLE` | Policy bundle URI/path (early-availability) | `https://github.com/scribe-public/sample-policies` | +| `COMMON_NAME` | Default policy allowed common names | Optional | +| `EMAIL` | Default policy allowed emails | Optional | +| `FORCE` | Force skip cache | Optional | +| `HELP` | Show help message | Optional | +| `INPUT_FORMAT` | Evidence format, options: `[attest-cyclonedx-json, attest-slsa, statement-slsa, statement-cyclonedx-json, statement-generic, attest-generic]` | `attest-cyclonedx-json` | +| `RULE` | Rule configuration file path (early-availability) | Optional | +| `SKIP_BUNDLE` | Skip bundle download | Optional | +| `SKIP_REPORT` | Skip policy report stage | Optional | +| `URI` | Default policy allowed URIs | Optional | +| `INITIATIVE` | Initiative name (optional) | Optional | +| `INITIATIVE_ID` | Initiative ID (optional) | Optional | +| `INITIATIVE_NAME` | Full name of the initiative (optional) | Optional | + +--- + +### Key Updates: + +* Added the **initiative flags**: `INITIATIVE`, `INITIATIVE_ID`, and `INITIATIVE_NAME` as optional fields. +* Kept the rest of the flags consistent with their usage and defaults. + +Let me know if you need any further modifications! -| Variable | Usage | Default | -| -------------- | -------------------------------------------------------------- | --- | -| ATTESTATION | Attestation for target | | -| BUNDLE | Policy bundle uri/path (early-availability) | "https://github.com/scribe-public/sample-policies" | -| COMMON_NAME | Default policy allowed common names | | -| EMAIL | Default policy allowed emails | | -| FORCE | Force skip cache | | -| HELP | Show help message | | -| INPUT_FORMAT | Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic] | "attest-cyclonedx-json" | -| RULE | Rule configuration file path (early-availability) | | -| SKIP_BUNDLE | Skip bundle download | | -| SKIP_REPORT | Skip Policy report stage | | -| URI | Default policy allowed uris | | ### Usage ```yaml - - pipe: scribe-security/valint-pipe:1.1.0 + - pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND_NAME: bom TARGET: busybox:latest @@ -247,7 +267,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr Generate an SBOM for an image in a public registry ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: bom TARGET: busybox:latest @@ -258,7 +278,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr Generate SLSA provenance for an image in a public registry ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: slsa TARGET: busybox:latest @@ -269,7 +289,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr Generate evidence from a third party tool output ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: evidence TARGET: some_security_report.json @@ -280,7 +300,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr Generate an SBOM for an image built with local docker ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: bom TARGET: image_name:latest @@ -292,7 +312,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr Generate SLSA provenance for an image built with local docker ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: slsa TARGET: image_name:latest @@ -305,7 +325,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr > Add a `docker login` task before adding the following task: ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: bom TARGET: scribesecurity/example:latest @@ -318,7 +338,7 @@ Add the Scribe Hub API token as `SCRIBE_TOKEN` by following the [Bitbucket instr > Add a `docker login` task before adding the following task: ```yaml -- pipe: scribe-security/valint-pipe:1.1.0 +- pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: slsa TARGET: scribesecurity/example:latest @@ -413,7 +433,7 @@ step: script: - mkdir testdir - echo "test" > testdir/test.txt - - pipe: scribe-security/valint-pipe:1.1.0 + - pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: bom TARGET: dir:./testdir @@ -429,7 +449,7 @@ step: script: - mkdir testdir - echo "test" > testdir/test.txt - - pipe: scribe-security/valint-pipe:1.1.0 + - pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND: slsa TARGET: dir:./testdir @@ -529,7 +549,7 @@ pipelines: name: scribe-bitbucket-oci-pipeline script: - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD [my_registry] - - pipe: scribe-security/valint-pipe:1.1.0 + - pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND_NAME: [bom,slsa,evidence] TARGET: [target] @@ -537,7 +557,7 @@ pipelines: OCI: true OCI_REPO: [oci_repo] - - pipe: scribe-security/valint-pipe:1.1.0 + - pipe: scribe-security/valint-pipe:2.0.0 variables: COMMAND_NAME: verify TARGET: [target] diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index d23169dc7..2db76b1eb 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -89,11 +89,11 @@ To overcome the limitation install tool directly - **[installer](https://github. oci-repo: description: Select OCI custom attestation repo package-exclude-type: - description: Exclude package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua] + description: Exclude package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform] package-group: description: Select package group, options=[index install all] package-type: - description: Select package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua] + description: Select package type, options=[ruby python javascript java dpkg apk rpm go dotnet r rust binary sbom nix conan alpm cocoapods swift dart elixir php erlang github portage haskell kernel wordpress lua bitnami terraform] pass: description: Private key password payload: @@ -104,6 +104,8 @@ To overcome the limitation install tool directly - **[installer](https://github. description: Include SLSA Provenance evidence pubkey: description: Public key path + skip-confirmation: + description: Skip Sigstore Confirmation supplier-email: description: Set supplier email supplier-name: @@ -120,8 +122,10 @@ To overcome the limitation install tool directly - **[installer](https://github. description: Mark as deliverable, options=[true, false] env: description: Environment keys to include in evidence - gate: + gate-name: description: Policy Gate name + gate-type: + description: Policy Gate type input: description: Input Evidence target, format (\:\ or \:\:\) label: @@ -173,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v1.5.19 + uses: scribe-security/action-bom@v2.0.0 with: target: 'busybox:latest' ``` @@ -181,7 +185,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v1.5.19 + uses: scribe-security/action-bom-cli@v2.0.0 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index cfe6da83f..5ec62566d 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -71,6 +71,8 @@ The `valint evidence` action is a versatile action designed to include various t description: Private key password pubkey: description: Public key path + skip-confirmation: + description: Skip Sigstore Confirmation tool: description: Evidence Tool name tool-vendor: @@ -85,8 +87,10 @@ The `valint evidence` action is a versatile action designed to include various t description: Mark as deliverable, options=[true, false] env: description: Environment keys to include in evidence - gate: + gate-name: description: Policy Gate name + gate-type: + description: Policy Gate type input: description: Input Evidence target, format (\:\ or \:\:\) label: @@ -138,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v1.5.19 + uses: scribe-security/action-evidence@v2.0.0 with: target: some_file.json ``` @@ -146,7 +150,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v1.5.19 + uses: scribe-security/action-evidence-cli@v2.0.0 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index d6d392b0e..b5dbe3eb1 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -92,6 +92,8 @@ To overcome the limitation install tool directly - [installer](https://github.co description: Import predicate path pubkey: description: Public key path + skip-confirmation: + description: Skip Sigstore Confirmation started-on: description: Set metadata started time (YYYY-MM-DDThh:mm:ssZ) statement: @@ -104,8 +106,10 @@ To overcome the limitation install tool directly - [installer](https://github.co description: Mark as deliverable, options=[true, false] env: description: Environment keys to include in evidence - gate: + gate-name: description: Policy Gate name + gate-type: + description: Policy Gate type input: description: Input Evidence target, format (\:\ or \:\:\) label: @@ -157,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v1.5.19 + uses: scribe-security/action-slsa@v2.0.0 with: target: 'busybox:latest' ``` @@ -165,7 +169,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v1.5.19 + uses: scribe-security/action-slsa-cli@v2.0.0 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index badbaca5e..c8addc0fd 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -25,6 +25,8 @@ The command allows users to verify any target against its evidence. target: description: Target object name format=[, , ] (Optional) required: true + all-evidence: + description: Run all evidence verification attest-config: description: Attestation config path attest-default: @@ -33,6 +35,8 @@ The command allows users to verify any target against its evidence. description: Attestation for target base-image: description: Base image for the target + beautify: + description: Enhance the output using ANSI and Unicode characters bom: description: Create target SBOM evidence bundle: @@ -76,13 +80,19 @@ The command allows users to verify any target against its evidence. git-tag: description: Git tag in the repository initiative: - description: Run only rules with specified initiative + description: Initiative configuration file path (early-availability) + initiative-id: + description: Initiative id + initiative-name: + description: Initiative name input-format: description: Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] key: description: x509 Private key path kms: description: Provide KMS key reference + md: + description: Output Initiative result markdown report file oci: description: Enable OCI store oci-repo: @@ -93,8 +103,6 @@ The command allows users to verify any target against its evidence. description: path of the decoded payload platform: description: Select target platform, examples=windows/armv6, arm64 ..) - policy: - description: Policy configuration file path (early-availability) provenance: description: Create target SLSA Provenance evidence pubkey: @@ -109,6 +117,8 @@ The command allows users to verify any target against its evidence. description: Run only rules with specified label skip-bundle: description: Skip bundle download + skip-confirmation: + description: Skip Sigstore Confirmation skip-report: description: Skip Policy report stage uri: @@ -121,8 +131,10 @@ The command allows users to verify any target against its evidence. description: Mark as deliverable, options=[true, false] env: description: Environment keys to include in evidence - gate: + gate-name: description: Policy Gate name + gate-type: + description: Policy Gate type input: description: Input Evidence target, format (\:\ or \:\:\) label: @@ -162,6 +174,7 @@ The command allows users to verify any target against its evidence. description: Timeout duration verbose: description: Log verbosity level [-v,--verbose=1] = info, [-vv,--verbose=2] = debug + ``` ### Usage @@ -169,7 +182,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v1.5.19 + uses: scribe-security/action-verify@v2.0.0 with: target: 'busybox:latest' ``` @@ -177,7 +190,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v1.5.19 + uses: scribe-security/action-verify-cli@v2.0.0 with: target: 'hello-world:latest' ``` diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index ce78c7d95..665f05660 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -4,7 +4,7 @@ submodules_dir="sub" [ ! -d "${submodules_dir}" ] && mkdir "${submodules_dir}" base="git@github.com:scribe-security" base_public="git@github.com:scribe-public" -supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" ) +supported_repos=( "valint" "platforms_lib" "action-bom" "action-verify" "action-slsa" "action-installer" "orbs" "azure-tasks" "helm-charts" "valint-pipe" "gatekeeper-provider" "sample-policies" ) pull_submodules() { repos=$1 @@ -17,10 +17,23 @@ pull_submodules() { repo_url="${base}/${repo}" fi repo_dir="${submodules_dir}/${repo}" - [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}" + if [ ! -z "$BRANCH" ]; then + git clone --depth 1 --branch "$BRANCH" "${repo_url}" "${repo_dir}" + else + git clone --depth 1 "${repo_url}" "${repo_dir}" + fi pushd "${repo_dir}" - git checkout master || git checkout main - git pull origin master || git pull origin main + # if BRANCH + if [ ! -z "$BRANCH" ]; then + git fetch origin $BRANCH + git checkout $BRANCH + git config pull.rebase false # Or `true` if you prefer rebasing + git pull origin $BRANCH + else + git checkout master || git checkout main + git pull origin master || git pull origin main + fi + popd done } @@ -34,8 +47,14 @@ checkout_submodules() { repo_dir="${submodules_dir}/${repo}" [[ ! -d "${repo_dir}" ]] && git clone --depth 1 "${repo_url}" "${repo_dir}" pushd "${repo_dir}" - git checkout master || git checkout main - git pull origin master || git pull origin main + if [ ! -z "$BRANCH" ]; then + git branch -D $BRANCH + git checkout -b $BRANCH + else + git checkout master || git checkout main + git pull origin master || git pull origin main + fi + git branch -D doc_export git checkout -b doc_export popd @@ -236,28 +255,40 @@ export_orbs() { export_file_rename ${repo} "" "${dst_dir}/circleci.md" } - import_sample-policies() { repo="sample-policies" repo_dir="${submodules_dir}/${repo}" dst_dir="docs/guides" - echo '--- -sidebar_label: "Applying Policies to your SDLC" -title: Applying Policies to your SDLC -sidebar_position: 3 -toc_min_heading_level: 2 -toc_max_heading_level: 5 ----' > "${dst_dir}/enforcing-sdlc-policy.md" +# Copy sample policy docs + cp -r "${repo_dir}/docs/v2/*" "docs/configuration/" + + # Create a temporary file to hold the table content from index.md + tmpfile=$(mktemp) + + # Extract everything between and from index.md + # (excluding the markers themselves) into tmpfile + sed -n '//,// { + //d + //d + p + }' docs/configuration/initiatives/index.md > "${tmpfile}" + + # Replace the block in enforcing-sdlc-initiative.md with the table content from tmpfile + sed -i '//,//{ + //!{ //!d; } + //r '"${tmpfile}"' + }' "${dst_dir}/enforcing-sdlc-initiative.md" - tail -n +2 "${repo_dir}/README.md" >> "${dst_dir}/enforcing-sdlc-policy.md" + # Clean up + rm "${tmpfile}" } export_sample-policies() { repo="sample-policies" repo_dir="${submodules_dir}/${repo}" dst_dir="docs/guides" - export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-policy.md" + export_file_rename ${repo} "" "${dst_dir}/enforcing-sdlc-initiative.md" sed -i '/^---$/,/^---$/c\ # Sample policies' "${repo_dir}/README.md" } @@ -376,7 +407,7 @@ EOF parse_args() { - while getopts "r:IESLdh?x" arg; do + while getopts "b:r:IESLdh?x" arg; do case "$arg" in x) set -x ;; r) repos+=(${OPTARG});; @@ -384,6 +415,7 @@ parse_args() { E) COMMAND="export";; S) COMMAND="status";; L) LOCAL="true";; + b) BRANCH=${OPTARG};; h | \?) usage "$0" ;; esac done From 601ffd32f658eb816a0f33be24a083b0179768ed Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 27 May 2025 11:50:37 +0300 Subject: [PATCH 191/191] add initiative example --- .../ci-integrations/bitbucket.md | 69 +++++++++++++++---- .../ci-integrations/github/action-verify.md | 54 +++++++++++++++ .../ci-integrations/gitlabci.md | 35 ++++++++++ 3 files changed, 145 insertions(+), 13 deletions(-) diff --git a/docs/integrating-scribe/ci-integrations/bitbucket.md b/docs/integrating-scribe/ci-integrations/bitbucket.md index 72d8c4827..00288f358 100644 --- a/docs/integrating-scribe/ci-integrations/bitbucket.md +++ b/docs/integrating-scribe/ci-integrations/bitbucket.md @@ -221,24 +221,67 @@ If `COMMAND` is set to `verify`: --- -### Key Updates: +# Example: Enforcing SP 800-190 Controls with Valint Initiatives -* Added the **initiative flags**: `INITIATIVE`, `INITIATIVE_ID`, and `INITIATIVE_NAME` as optional fields. -* Kept the rest of the flags consistent with their usage and defaults. +This workflow demonstrates how to leverage Valint’s initiative engine to automatically generate evidence (SBOM and vulnerability reports), submit it to Valint, and enforce SP 800-190 controls on your container image. -Let me know if you need any further modifications! +```yaml +pipelines: + pull-requests: + '**': + - step: + name: Build Docker image + image: docker:stable-git + services: + - docker + caches: + - docker + script: + # Build the image tagged with the commit SHA + - docker build -t my_image:latest -f Dockerfile . + + - step: + name: Scan image with Trivy + image: docker:stable-git + services: + - docker + caches: + - docker + script: + # Install Trivy CLI + - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ + | sh -s -- -b /usr/local/bin + # Scan and emit SARIF + - trivy image \ + --format sarif \ + --output trivy-report.sarif \ + --exit-code 0 \ + --ignore-unfixed \ + --severity CRITICAL,HIGH \ + my_image:latest + + - step: + name: Collect Evidence & Evaluate SP 800-190 Initiative + image: docker:stable-git + services: + - docker + script: + - pipe: scribe-security/valint-pipe:2.0.0 + variables: + COMMAND_NAME: "verify" + INITIATIVE: "sp-800-190@v2" + TARGET: "my_image:latest" + BOM: "true" # auto-generate SBOM + BASE_IMAGE: "Dockerfile" # include base-image evidence + INPUT: "sarif:trivy-report.sarif" # vulnerability evidence + INPUT_FORMAT: "attest" # treat SARIF as attest + BEAUTIFY: "true" +``` -### Usage -```yaml - - pipe: scribe-security/valint-pipe:2.0.0 - variables: - COMMAND_NAME: bom - TARGET: busybox:latest - VERBOSE: 2 - FORCE: "true" -``` +> **Note:** Enabling `BOM`, `provenance` `PROVENANCE`, or `INPUT` flags ensures Valint generates and ingests the necessary evidence before policy evaluation. + # Scribe integration diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index c8addc0fd..17e97014d 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -243,6 +243,60 @@ jobs: scribe-client-secret: ${{ secrets.SCRIBE_TOKEN }} ``` +#### Example: Enforcing SP 800-190 Controls with Valint Initiatives + +This workflow demonstrates how to leverage Valint’s initiative engine to automatically generate evidence (SBOM and vulnerability reports), submit it to Valint, and enforce SP 800-190 controls on your container image. + +```yaml +name: sp-800-190-policy-check + +on: + pull_request: + +jobs: + image-policy-check: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Build Docker image + uses: docker/build-push-action@v2 + with: + context: . + file: Dockerfile + push: false + tags: | + ${{ github.sha }} + + - name: Scan image with Trivy + uses: aquasecurity/trivy-action@0.28.0 + continue-on-error: true + with: + image-ref: ${{ github.sha }} + format: sarif + output: trivy-report.sarif + vuln-type: os,library + severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: 0 + + - name: Collect Evidence & Evaluate SP 800-190 Initiative + uses: scribe-security/action-verify@main + with: + initiative: sp-800-190@v2 + target: ${{ github.sha }} + bom: true # Generate CycloneDX SBOM + base-image: Dockerfile # Include base image in SBOM + input: sarif:trivy-report.sarif + input-format: attest + beautify: true +``` + +> **Note:** Enabling `bom`, `provenance`, or `input` flags ensures Valint generates and ingests the necessary evidence before policy evaluation. + + ### Configuration If you prefer using a custom configuration file instead of specifying arguments directly, you have two choices. You can either place the configuration file in the default path, which is `.valint.yaml`, or you can specify a custom path using the `config` argument. diff --git a/docs/integrating-scribe/ci-integrations/gitlabci.md b/docs/integrating-scribe/ci-integrations/gitlabci.md index 3da866867..073b70923 100644 --- a/docs/integrating-scribe/ci-integrations/gitlabci.md +++ b/docs/integrating-scribe/ci-integrations/gitlabci.md @@ -63,6 +63,41 @@ scribe-gitlab-job: -P $SCRIBE_TOKEN ``` +#### Example: Enforcing SP 800-190 Controls with Valint Initiatives + +In this example, we use Valint’s initiative framework to apply a suite of SP 800-190 policies against a container image. The job automatically generates evidence (SBOM or provenance), feeds it into Valint, and evaluates the defined controls. + +```yaml +image: ubuntu:latest + +before_script: + - apt update + - apt install -y git curl + - curl -sSfL https://get.scribesecurity.com/install.sh | sh -s -- -b /usr/local/bin + - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin + +stages: + - validate + +validate-image: + stage: validate + script: + # Run Trivy to produce a SARIF report: + - trivy image --format sarif --output scan_report_trivy.sarif ubuntu:latest + + # Verify the image against SP 800-190 initiatives: + - valint verify [target] + -i attest + --bom # Auto-generate the SBOM for evidence + --base-image Dockerfile # Specify the Dockerfile or base image + --input sarif:scan_report_trivy.sarif + --context-type gitlab + --output-directory ./scribe/valint + -P $SCRIBE_TOKEN +``` + +> **Note:** The `--bom`, `--provenance`, or `--input` flags ensure that Valint includes evidence generation as part of the verification process. + #### Using custom x509 keys Utilizing X509 Keys on Gitlab CI.