diff --git a/.github/workflows/export.yaml b/.github/workflows/export.yaml
index bed2d3f6c..de694dfe6 100644
--- a/.github/workflows/export.yaml
+++ b/.github/workflows/export.yaml
@@ -12,7 +12,7 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-24.04] # TODO: only build
- repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
+ repo: ["valint", "action-bom", "action-verify", "action-slsa", "action-evidence", "orbs", "azure-tasks", "helm-charts", "valint-pipe"]
runs-on: ${{ matrix.os }}
defaults:
run:
diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md
index 3981263ec..30035d07a 100644
--- a/docs/configuration/initiatives/index.md
+++ b/docs/configuration/initiatives/index.md
@@ -10,7 +10,8 @@
| [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 |
| [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 |
| [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative |
-| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gl.md) | Blueprint for secure pipelines - Gitlab |
+| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gh.md) | Blueprint for secure pipelines - GitHub |
## Rules
@@ -32,7 +33,6 @@
| Rule Name | Description |
|-----------|-------------|
-| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. |
| [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. |
| [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. |
| [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. |
@@ -92,6 +92,7 @@
| Rule Name | Description |
|-----------|-------------|
+| [3rd Party Scanner Violations](/docs/configuration/initiatives/rules/generic/3rd-pty.md) | Limit allowed violations in 3rd party scanner reports |
| [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists |
| [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. |
| [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. |
@@ -128,6 +129,7 @@
| Rule Name | Description |
|-----------|-------------|
+| [Pull request approval policy check for GitHub repository](/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy |
| [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. |
| [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. |
| [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. |
diff --git a/docs/configuration/initiatives/rules/generic/3rd-pty.md b/docs/configuration/initiatives/rules/generic/3rd-pty.md
new file mode 100644
index 000000000..abd484628
--- /dev/null
+++ b/docs/configuration/initiatives/rules/generic/3rd-pty.md
@@ -0,0 +1,79 @@
+---
+sidebar_label: 3rd Party Scanner Violations
+title: 3rd Party Scanner Violations
+---
+# 3rd Party Scanner Violations
+**Type:** Rule
+**ID:** `3rd-pty`
+**Source:** [v2/rules/generic/3rd-pty.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.yaml)
+**Rego Source:** [3rd-pty.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.rego)
+**Labels:** 3rd-pty, SCA
+
+Limit allowed violations in 3rd party scanner reports
+
+:::note
+This rule requires Generic Statement. See [here](/docs/valint/generic) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: generic/3rd-pty@v2
+with:
+ severities:
+ - Critical
+ - High
+ titles:
+ - "CVE-2023-1234"
+ - "CVE-2023-5678"
+ - "CVE-2025"
+ cwes:
+ - "CWE-123"
+ - "CWE-456"
+ descriptions:
+ - "Vulnerability in component X"
+ - "Misconfiguration in component Y"
+ descriptions_to_ignore:
+ - "False positive in component Z"
+ - "Known issue in component A"
+ component_names:
+ - library-x
+ - library-y
+```
+
+## Mitigation
+Restricts the number and type of violations from third-party scanner reports, helping to enforce organizational security and compliance policies.
+
+
+## Description
+This rule verifies that the number and type of violations reported by third-party scanners are within allowed thresholds.
+It checks the evidence for findings matching the specified severities, titles, CWEs, descriptions, and component names.
+Violations are recorded if any findings exceed the configured limits or match blocklisted criteria.
+
+### **Evidence Requirements**
+- Evidence must be provided by a supported third-party scanner and formatted as generic findings (see the `--parser` flag in `valint`).
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/finding/v0.1 |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| severities | array | False | List of severities to filter by. |
+| titles | array | False | List of titles to filter by. |
+| cwes | array | False | List of CWE identifiers to filter by. |
+| descriptions | array | False | List of descriptions to filter by. |
+| descriptions_to_ignore | array | False | List of descriptions to ignore from findings. |
+| component_names | array | False | List of component names to filter by. |
+
diff --git a/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md b/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md
new file mode 100644
index 000000000..21ebba0c3
--- /dev/null
+++ b/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md
@@ -0,0 +1,59 @@
+---
+sidebar_label: Pull request approval policy check for GitHub repository
+title: Pull request approval policy check for GitHub repository
+---
+# Pull request approval policy check for GitHub repository
+**Type:** Rule
+**ID:** `github-repo-pr-approval`
+**Source:** [v2/rules/github/repository/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.yaml)
+**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.rego)
+**Labels:** Blueprint, GitHub, Repository
+
+Verify the repository's pull request approval policy
+
+:::note
+This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details.
+:::
+:::tip
+Signed Evidence for this rule **IS NOT** required by default but is recommended.
+:::
+:::warning
+Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
+:::
+
+## Usage example
+
+```yaml
+uses: github/repository/approvals-policy-check@v2
+with:
+ approvals_required_min: 1
+```
+
+## Mitigation
+Ensure that the repository's PR approval policy complies with requirements to prevent unauthorized merges.
+
+
+## Description
+This rule ensures that the repository's PR approval policy complies with requirements.
+It performs the following steps:
+
+1. Checks the settings of the GitHub repository.
+2. Verifies that the repository's PR approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field.
+
+**Evidence Requirements:**
+- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources.
+
+## Evidence Requirements
+| Field | Value |
+|-------|-------|
+| signed | False |
+| content_body_type | generic |
+| target_type | data |
+| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 |
+| labels | - platform=github
- asset_type=repository |
+
+## Input Definitions
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| approvals_required_min | number | True | Minimum number of approvals required for pull requests. |
+
diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md
index f8706fe13..2c4b9596b 100644
--- a/docs/configuration/initiatives/rules/images/allowed-base-image.md
+++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md
@@ -63,4 +63,5 @@ is found, a violation is recorded indicating that the necessary base image infor
| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| approved_sources | array | False | A list of approved base image pattern. |
+| fail_on_no_base_image | boolean | False | Whether to fail the rule if no base image is found. |
diff --git a/docs/configuration/initiatives/rules/multievidence/_category_.json b/docs/configuration/initiatives/rules/multievidence/_category_.json
deleted file mode 100644
index 9696ec52e..000000000
--- a/docs/configuration/initiatives/rules/multievidence/_category_.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
- "label": "Multievidence",
- "position": 1
-}
\ No newline at end of file
diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md
deleted file mode 100644
index 6ad76cd05..000000000
--- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-sidebar_label: Verify File Integrity
-title: Verify File Integrity
----
-# Verify File Integrity
-**Type:** Rule
-**ID:** `file-integrity`
-**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml)
-**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego)
-**Labels:** SBOM
-
-Verify the checksum of each file in one SBOM matches the checksum in a second SBOM.
-
-:::note
-This rule requires Signed Image SBOM. See [here](/docs/valint/sbom) for more details.
-:::
-:::tip
-Signed Evidence for this rule **IS** required by default.
-:::
-:::warning
-Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided.
-:::
-
-## Usage example
-
-```yaml
-uses: multievidence/files_integrity@v2
-```
-
-## Evidence Requirements
-| Field | Value |
-|-------|-------|
-| signed | True |
-| content_body_type | cyclonedx-json |
-| target_type | container |
-| labels | - new_evidence |
-
-## Rule Parameters (`with`)
-| Parameter | Default |
-|-----------|---------|
-| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` |
-| path_prefix | pkg:file/ |
-
diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md
new file mode 100644
index 000000000..90d5a22ae
--- /dev/null
+++ b/docs/configuration/initiatives/sspb-gh.md
@@ -0,0 +1,365 @@
+---
+sidebar_label: Secure Software Pipeline Blueprint for GitHub
+title: Secure Software Pipeline Blueprint
+---
+# Secure Software Pipeline Blueprint
+**Type:** Initiative
+**ID:** `SSPB-GH`
+**Version:** `1.0.0`
+**Bundle-Version:** `v2`
+**Source:** [v2/initiatives/sspb-gh.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb-gh.yaml)
+**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline
+
+Blueprint for secure pipelines - GitHub
+
+## **Description**
+
+This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture.
+
+## Controls Overview
+
+| Control Name | Control Description | Mitigation |
+|--------------|---------------------|------------|
+| [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. |
+| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by GitHub | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. |
+| [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. |
+| [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. |
+| [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. |
+| [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. |
+| [[CTL-7] Artifacts are stored in a repository in development, stage and production](#ctl-7-artifacts-are-stored-in-a-repository-in-development-stage-and-production) | Artifacts are stored in a repository in development, stage and production | Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. |
+| [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. |
+| [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. |
+| [[CTL-10] Artifacts in higher repositories are signed](#ctl-10-artifacts-in-higher-repositories-are-signed) | Artifacts in higher repositories are signed | Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. |
+| [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. |
+| [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. |
+| [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. |
+| [[CTL-14] Validate Kubernetes resource manifests](#ctl-14-validate-kubernetes-resource-manifests) | Validate Kubernetes resource manifests | Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. |
+| [[CTL-15] Ensure build environments are ephemeral and immutable](#ctl-15-ensure-build-environments-are-ephemeral-and-immutable) | Ensure build environments are ephemeral and immutable | Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build |
+
+## Evidence Defaults
+
+| Field | Value |
+|-------|-------|
+| signed | True |
+
+---
+
+# Detailed Controls
+
+## [CTL-1] Restrict administrative access to CI/CD tools
+
+Restrict administrative access to CI/CD tools
+
+
+### Mitigation
+Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes.
+
+### **Description**
+
+It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls.
+
+Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication.
+
+> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [max-admins](rules/github/org/max-admins.md) | [max-admins](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. |
+| [allowed-admins](rules/github/org/allow-admins.md) | [allowed-admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. |
+
+## [CTL-2] Only accept commits signed with a developer GPG key
+
+The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by GitHub
+
+
+### Mitigation
+Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications.
+
+### **Description**
+
+Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers.
+
+> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [disallow-committing-unsigned](rules/github/repository/signed-commits.md) | [disallow-committing-unsigned](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. |
+| [all-commits-verified](rules/github/repository/check-signed-commits.md) | [all-commits-verified](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. |
+| [web-commit-signoff-required](rules/github/repository/web-commit-signoff.md) | [web-commit-signoff-required](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. |
+
+## [CTL-3] Automation access keys expire automatically
+
+Automation access keys expire automatically
+
+
+### Mitigation
+Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited.
+
+### **Description**
+
+Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised.
+
+> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage.
+
+:::warning
+This control not currently supported on this platform.
+:::
+
+## [CTL-4] Reduce automation access to read-only
+
+Reduce automation access to read-only
+
+
+### Mitigation
+Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage.
+
+### **Description**
+
+CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts.
+
+> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk.
+
+:::warning
+This control not currently supported on this platform.
+:::
+
+## [CTL-5] Only dependencies from trusted registries can be used
+
+Only dependencies from trusted registries can be used
+
+
+### Mitigation
+Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages.
+
+### **Description**
+
+Modern software dependency managers, including `npm`, `maven`, `Nuget`, `pip`, and others, rely on declaring the dependencies required for the application and then fetching them at build time. By configuring the dependency manager to only allow connections to an authorized list of registries, these attacks can be blunted by keeping malicious packages in the public registries from entering the pipeline.
+
+The trusted repository can also ensure that security policies are enforced on dependencies. For example, trusted repositories could ensure that only dependencies that are free of critical or high vulnerabilities are used. Implementing a control at the repository that returns an error when a component with known vulnerabilities is requested helps to reduce the chances of an attack against a known vulnerability downstream.
+
+Teams should be aware of implicit runtime dependencies as well as explicit buildtime dependencies (see Control 14).
+
+> :skull:
+> Attackers can quickly spread malicious code through dependencies. Attackers might insert malicious code that is then incorporated into the application’s manifest by stealing credentials en masse for sophisticated, targeted thefts.
+> Hackers can also target mistakes and oversights through _typo-squatting_ and _dependency confusion_. Adversaries go to great ends to publish packages under a trusted name or even with common typos so that they are included in builds.
+> All of the stakes are raised exponentially when public repositories are used.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [allowed-base-image](rules/images/allowed-base-image.md) | [Ensure that base images are from an approved source](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. |
+
+## [CTL-6] Any critical or high severity vulnerability breaks the build
+
+Any critical or high severity vulnerability breaks the build
+
+
+### Mitigation
+Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation.
+
+### **Description**
+
+Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged.
+
+> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored.
+
+Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process.
+
+> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-7] Artifacts are stored in a repository in development, stage and production
+
+Artifacts are stored in a repository in development, stage and production
+
+
+### Mitigation
+Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability.
+
+### **Description**
+
+All artifacts should be stored in a repository at each stage of the build pipeline so that there is clear traceability between the test results and the actual artifact that was tested. This control also helps to enforce the immutability of the artifacts, such that we can compare artifacts in the development, staging and production repositories and ensure that we maintain a chain of control.
+
+Repositories for dev, stage and production should be segregated so that role-based access control can ensure least privilege at each stage, and so that more stringent policies (such as artifact signing) can be enforced in higher environments.
+
+Artifacts should be promoted from repository to repository in accordance with the principle of immutability.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+
+## [CTL-8] Validate artifact digest
+
+Validate artifact digest
+
+
+### Mitigation
+Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity.
+
+### **Description**
+
+Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised.
+
+> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [require-sbom](rules/sbom/evidence-exists.md) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. |
+
+## [CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged
+
+
+### Mitigation
+Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged.
+
+### **Description**
+
+Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight.
+
+> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [merge-approval](rules/github/repository/approvals-policy-check.md) | [merge-approval](rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy |
+
+## [CTL-10] Artifacts in higher repositories are signed
+
+Artifacts in higher repositories are signed
+
+
+### Mitigation
+Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering.
+
+### **Description**
+
+Requiring artifacts to be signed in a repository throughout the process ensures visibility and traceability for whatever is deployed to production. Requiring signed artifacts helps to ensure that untrusted binaries are not deployed to customer environments and allows validating the source of the binaries.
+
+> :skull:
+> Through credential theft, vulnerability exploit, targeted attacks or more, attackers succeed in inserting their malicious code into pipelines and repositories. Code should be considered suspect and malicious.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+
+## [CTL-11] Available container images don’t have any high or critical vulnerabilities
+
+Available container images don’t have any high or critical vulnerabilities
+
+
+### Mitigation
+Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed.
+
+### **Description**
+
+Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities.
+
+> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-12] Validate artifact signatures and digests
+
+Validate artifact signatures and digests
+
+
+### Mitigation
+Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering.
+
+### **Description**
+
+Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment.
+
+> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+
+## [CTL-13] Scan deployed images in production
+
+Scan deployed images in production
+
+
+### Mitigation
+Continuously monitor and scan production images to ensure ongoing compliance with security standards.
+
+### **Description**
+
+Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production.
+
+> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
+| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-14] Validate Kubernetes resource manifests
+
+Validate Kubernetes resource manifests
+
+
+### Mitigation
+Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities.
+
+### **Description**
+
+The last line of defense is the _container orchestration layer_. Kubernetes is responsible for deploying the containers of the application into production, and if the resource manifests are tampered with, it could be tricked into deploying a container of the attacker’s choice. It is important to ensure that the Kubernetes resource manifests are controlled and validated just as the actual images are.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [k8s-manifests-integrity-validated](rules/generic/evidence-exists.md) | [Validate Kubernetes resource manifests integrity](rules/generic/evidence-exists.md) | Verify required evidence exists. |
+
+## [CTL-15] Ensure build environments are ephemeral and immutable
+
+Ensure build environments are ephemeral and immutable
+
+
+### Mitigation
+Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build
+
+### **Description**
+
+Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build. Build hosts should not be accessible using interactive logins.
+
+> :skull:
+> Attackers who gain access to build environments are able to bypass controls implemented earlier in the build pipeline. Ensuring build environments are themselves defined as code and live only for the duration of a build prevents attackers from persisting in build infrastructures.
+
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [ensure-ephemeral-runners](rules/github/repository/ephemeral-runners-only.md) | [ensure-ephemeral-runners](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. |
diff --git a/docs/configuration/initiatives/sspb.md b/docs/configuration/initiatives/sspb-gl.md
similarity index 58%
rename from docs/configuration/initiatives/sspb.md
rename to docs/configuration/initiatives/sspb-gl.md
index 5a0380551..44e5e0faa 100644
--- a/docs/configuration/initiatives/sspb.md
+++ b/docs/configuration/initiatives/sspb-gl.md
@@ -1,13 +1,13 @@
---
-sidebar_label: Secure Software Pipeline Blueprint
+sidebar_label: Secure Software Pipeline Blueprint for Gitlab
title: Secure Software Pipeline Blueprint
---
# Secure Software Pipeline Blueprint
**Type:** Initiative
-**ID:** `SSPB`
+**ID:** `SSPB-GL`
**Version:** `1.0.0`
**Bundle-Version:** `v2`
-**Source:** [v2/initiatives/sspb.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb.yaml)
+**Source:** [v2/initiatives/sspb-gl.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb-gl.yaml)
**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline
Blueprint for secure pipelines - Gitlab
@@ -21,15 +21,20 @@ This initiative defines a set of best practices and technical guidelines designe
| Control Name | Control Description | Mitigation |
|--------------|---------------------|------------|
| [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. |
-| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. |
+| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. |
| [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. |
| [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. |
+| [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. |
| [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. |
+| [[CTL-7] Artifacts are stored in a repository in development, stage and production](#ctl-7-artifacts-are-stored-in-a-repository-in-development-stage-and-production) | Artifacts are stored in a repository in development, stage and production | Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. |
| [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. |
| [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. |
+| [[CTL-10] Artifacts in higher repositories are signed](#ctl-10-artifacts-in-higher-repositories-are-signed) | Artifacts in higher repositories are signed | Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. |
| [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. |
| [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. |
| [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. |
+| [[CTL-14] Validate Kubernetes resource manifests](#ctl-14-validate-kubernetes-resource-manifests) | Validate Kubernetes resource manifests | Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. |
+| [[CTL-15] Ensure build environments are ephemeral and immutable](#ctl-15-ensure-build-environments-are-ephemeral-and-immutable) | Ensure build environments are ephemeral and immutable | Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build |
## Evidence Defaults
@@ -62,10 +67,11 @@ Both host and application-layer access to CI/CD tools should be protected with m
| Rule ID | Rule Name | Rule Description |
|---------|-----------|------------------|
| [max-admins](rules/gitlab/org/max-admins.md) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. |
+| [allowed-admins](rules/gitlab/org/allow-admins.md) | [allowed-admins](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. |
## [CTL-2] Only accept commits signed with a developer GPG key
-The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab
+The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab
### Mitigation
@@ -124,6 +130,33 @@ CI systems should have read access only to source code repositories to limit the
|---------|-----------|------------------|
| [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. |
+## [CTL-5] Only dependencies from trusted registries can be used
+
+Only dependencies from trusted registries can be used
+
+
+### Mitigation
+Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages.
+
+### **Description**
+
+Modern software dependency managers, including `npm`, `maven`, `Nuget`, `pip`, and others, rely on declaring the dependencies required for the application and then fetching them at build time. By configuring the dependency manager to only allow connections to an authorized list of registries, these attacks can be blunted by keeping malicious packages in the public registries from entering the pipeline.
+
+The trusted repository can also ensure that security policies are enforced on dependencies. For example, trusted repositories could ensure that only dependencies that are free of critical or high vulnerabilities are used. Implementing a control at the repository that returns an error when a component with known vulnerabilities is requested helps to reduce the chances of an attack against a known vulnerability downstream.
+
+Teams should be aware of implicit runtime dependencies as well as explicit buildtime dependencies (see Control 14).
+
+> :skull:
+> Attackers can quickly spread malicious code through dependencies. Attackers might insert malicious code that is then incorporated into the application’s manifest by stealing credentials en masse for sophisticated, targeted thefts.
+> Hackers can also target mistakes and oversights through _typo-squatting_ and _dependency confusion_. Adversaries go to great ends to publish packages under a trusted name or even with common typos so that they are included in builds.
+> All of the stakes are raised exponentially when public repositories are used.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [allowed-base-image](rules/images/allowed-base-image.md) | [Ensure that base images are from an approved source](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. |
+
## [CTL-6] Any critical or high severity vulnerability breaks the build
Any critical or high severity vulnerability breaks the build
@@ -148,6 +181,28 @@ Early detection reduces remediation costs, but also requires a well-defined vuln
|---------|-----------|------------------|
| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+## [CTL-7] Artifacts are stored in a repository in development, stage and production
+
+Artifacts are stored in a repository in development, stage and production
+
+
+### Mitigation
+Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability.
+
+### **Description**
+
+All artifacts should be stored in a repository at each stage of the build pipeline so that there is clear traceability between the test results and the actual artifact that was tested. This control also helps to enforce the immutability of the artifacts, such that we can compare artifacts in the development, staging and production repositories and ensure that we maintain a chain of control.
+
+Repositories for dev, stage and production should be segregated so that role-based access control can ensure least privilege at each stage, and so that more stringent policies (such as artifact signing) can be enforced in higher environments.
+
+Artifacts should be promoted from repository to repository in accordance with the principle of immutability.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+
## [CTL-8] Validate artifact digest
Validate artifact digest
@@ -188,6 +243,28 @@ Requiring multiple code reviews and successful tests helps ensure that no change
|---------|-----------|------------------|
| [merge-approval](rules/gitlab/project/approvals-policy-check.md) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. |
+## [CTL-10] Artifacts in higher repositories are signed
+
+Artifacts in higher repositories are signed
+
+
+### Mitigation
+Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering.
+
+### **Description**
+
+Requiring artifacts to be signed in a repository throughout the process ensures visibility and traceability for whatever is deployed to production. Requiring signed artifacts helps to ensure that untrusted binaries are not deployed to customer environments and allows validating the source of the binaries.
+
+> :skull:
+> Through credential theft, vulnerability exploit, targeted attacks or more, attackers succeed in inserting their malicious code into pipelines and repositories. Code should be considered suspect and malicious.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
+| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. |
+
## [CTL-11] Available container images don’t have any high or critical vulnerabilities
Available container images don’t have any high or critical vulnerabilities
@@ -249,3 +326,41 @@ Production images should be validated to ensure that controls enforced during ea
| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. |
| [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. |
| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). |
+
+## [CTL-14] Validate Kubernetes resource manifests
+
+Validate Kubernetes resource manifests
+
+
+### Mitigation
+Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities.
+
+### **Description**
+
+The last line of defense is the _container orchestration layer_. Kubernetes is responsible for deploying the containers of the application into production, and if the resource manifests are tampered with, it could be tricked into deploying a container of the attacker’s choice. It is important to ensure that the Kubernetes resource manifests are controlled and validated just as the actual images are.
+
+### Rules
+
+| Rule ID | Rule Name | Rule Description |
+|---------|-----------|------------------|
+| [k8s-manifests-integrity-validated](rules/generic/evidence-exists.md) | [Validate Kubernetes resource manifests integrity](rules/generic/evidence-exists.md) | Verify required evidence exists. |
+
+## [CTL-15] Ensure build environments are ephemeral and immutable
+
+Ensure build environments are ephemeral and immutable
+
+
+### Mitigation
+Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build
+
+### **Description**
+
+Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build. Build hosts should not be accessible using interactive logins.
+
+> :skull:
+> Attackers who gain access to build environments are able to bypass controls implemented earlier in the build pipeline. Ensuring build environments are themselves defined as code and live only for the duration of a build prevents attackers from persisting in build infrastructures.
+
+
+:::warning
+This control not currently supported on this platform.
+:::
diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md
index 8cf685f19..072f5811b 100644
--- a/docs/guides/enforcing-sdlc-initiative.md
+++ b/docs/guides/enforcing-sdlc-initiative.md
@@ -330,11 +330,11 @@ In this case, no rule was disabled, and all of them were verified.
### Migration from an older version
-Before initiatives were introduced in `valint v2.0.0`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format.
+Before initiatives were introduced in `valint v2.0.2`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format.
#### Rule configs migration
-In general, older rule configs can be used in `valint v2.0.0` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config:
+In general, older rule configs can be used in `valint v2.0.2` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config:
```yaml
config-type: rule
@@ -344,7 +344,7 @@ After that, you can pass the rule config to `valint` using the same `--rule` fla
#### Policy configs migration
-Policy configs were deprecated in `valint v2.0.0`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward.
+Policy configs were deprecated in `valint v2.0.2`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward.
If you use a single policy config, you can copy it entirely under the `controls` key in the new initiative config. For example, if you have a policy config like this:
@@ -403,12 +403,12 @@ including smart filtering as shown in the [Rule Filtering](../valint/initiatives
:::
:::note
-Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details.
+Starting with `valint v2.0.2`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details.
:::
#### Example
-Let's take SLSA L2 as an example. Prior to `valint v2.0.0`, one could verify a single SLSA L2 rule using the following command:
+Let's take SLSA L2 as an example. Prior to `valint v2.0.2`, one could verify a single SLSA L2 rule using the following command:
```bash
valint verify alpine:latest --rule slsa/l2-provenance-authenticated@v1 --product-key --product-version
diff --git a/docs/guides/secure-sfw-slsa/basic-examples.md b/docs/guides/secure-sfw-slsa/basic-examples.md
index 84acbd349..02bd9b692 100644
--- a/docs/guides/secure-sfw-slsa/basic-examples.md
+++ b/docs/guides/secure-sfw-slsa/basic-examples.md
@@ -115,6 +115,53 @@ valint slsa docker-archive:busybox_archive.tar
```
+
+ Generate and attach source SBOM evidence reference
+
+Generate an SBOM for the Git repository and attach it to the SLSA provenance as a by-product evidence reference.
+
+```bash
+valint slsa --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0
+```
+
+
+
+
+ Generate and attach target image SBOM evidence reference
+
+Generate an SBOM for the primary image target and attach it to the provenance.
+
+```bash
+valint slsa alpine:latest --bom
+```
+
+
+
+
+ Combine source and image SBOM evidence references
+
+Attach SBOMs for both the source repository and the image in a single provenance document.
+
+```bash
+valint slsa alpine:latest \
+ --bom \
+ --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0
+```
+
+
+
+
+ Attach third-party scan evidence with --input
+
+Include external scan results (e.g., a Trivy JSON report) as an additional by-product evidence reference.
+
+```bash
+valint slsa alpine:latest --input trivy:scan_result.json
+```
+
+
+
+
Directory target
@@ -186,6 +233,8 @@ valint verify busybox:latest -i attest-slsa
```
+
+
Attest and verify Git repository target
@@ -259,3 +308,16 @@ valint verify [target] -i [attest-slsa, statement-slsa] -f \
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/guides/secure-sfw-slsa/customizing-provenance.md b/docs/guides/secure-sfw-slsa/customizing-provenance.md
index f13678b4f..e5162c2c4 100644
--- a/docs/guides/secure-sfw-slsa/customizing-provenance.md
+++ b/docs/guides/secure-sfw-slsa/customizing-provenance.md
@@ -1,109 +1,147 @@
---
-sidebar_label: "Customizing Provenance"
+
+sidebar\_label: "Customizing Provenance"
title: "Customizing the Provenance Document"
-sidebar_position: 5
-toc_min_heading_level: 2
-toc_max_heading_level: 5
----
+sidebar\_position: 5
+toc\_min\_heading\_level: 2
+toc\_max\_heading\_level: 5
+---------------------------
+
+Use the following flags to tailor the provenance document to your needs.
+
+## Include external by-products
+
+| Flag | Purpose | Example |
+| --------------------- | -------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
+| `--by-product ` | Attach the contents of a file (e.g., log, SBOM) as a by-product | `valint slsa busybox:latest --by-product /path/to/file.txt` |
+| `--components ` | When the by-product is an SBOM, include finer-grained components such as `layers`, `packages`, or `files` (comma‑separated list) | `valint slsa busybox:latest --components layers,packages,files` |
+
+## Override key provenance fields
+
+| Flag | Field | Example |
+| --------------- | ---------------------------- | ------------------------------------ |
+| `--invocation` | Invocation ID | `--invocation my_invocation` |
+| `--build-type` | Build type | `--build-type docker` |
+| `--builder-id` | Builder ID | `--builder-id 12345` |
+| `--started-on` | Build start time (RFC 3339) | `--started-on 2023-07-25T15:30:00Z` |
+| `--finished-on` | Build finish time (RFC 3339) | `--finished-on 2023-07-25T16:00:00Z` |
-You can customize the provenance object by using the following flags:
-* `--by-product` includes the contents of an external file, such as a log file or an SBOM.
-For example,
-```valint slsa busybox:latest --by-product /path/to/my_file.txt```
-* `--components` extend `byproduct` when it is an SBOM with detailed target components such as layers packages, and files.
-For example,
-```valint slsa busybox:latest --components layers,packages,files```
-* Set specific provenance fields such as:
- * `--invocation`: invocation ID
- * `--build-type`: build type
- * `--builder-id`: builder ID
- * `--started-on`: build start time
- * `--finished-on`: build finish time
-For Example,
+**Full example**
+
+```bash
+valint slsa busybox:latest \
+ --source git:https://github.com/my_org/my_repo.git \
+ --git-tag v1.0.0 \
+ --invocation my_invocation \
+ --build-type docker \
+ --builder-id 12345 \
+ --started-on 2023-07-25T15:30:00Z \
+ --finished-on 2023-07-25T16:00:00Z
```
-valint slsa busybox:latest --invocation my_invocation --build-type docker --builder-id 12345 --started-on 2023-07-25T15:30:00Z --finished-on 2023-07-25T16:00:00Z
+
+## Add extra evidence (by-product references)
+
+| Flag | Purpose |
+| -------------------- | ----------------------------------------------------------------------------------------------- |
+| `--source ` | Generate an SBOM for the specified Git repository |
+| `--bom` | Generate an SBOM for the primary container‑image target |
+| `--input ` | Generate evidence for any additional target (extra Git repo, image, or third‑party tool output) |
+
+```bash
+valint bom \
+ --source https://github.com/your-org/your-repo.git \
+ --bom \
+ --input ghcr.io/your-org/extra-image:latest
```
-* `-env` or `--all-env` adds environment variables to the `internaParameters`.
-For example,
-```yaml
-#Attach all environment variables
+
+## Add environment variables
+
+* `--all-env` – Attach **all** environment variables to `internalParameters`.
+* `--env ` – Attach a **specific** variable.
+
+```bash
+# Attach all environment variables
valint slsa busybox:latest --all-env
-# Attach a specific environment variable
+
+# Attach a single variable
valint slsa busybox:latest --env MY_ENV
```
-* `--external` adds parameters to the `externalParameters` in the form of key=value pairs.
-For example,
-```valint slsa busybox:latest --external my_custom_param=my_custom_value```
-* `--predicate` adds a full or partial SLSA provenance predicate.
-For example,
-```valint slsa busybox:latest --predicate custom.predicate.json```
-Where `custom.predicate.json` specifies custom `externalParameters`, `builderDependencies`, and metadata.
+
+## Extend external parameters
+
+* `--external ` – Add key–value pairs to `externalParameters`.
+
+```bash
+valint slsa busybox:latest --external my_custom_param=my_custom_value
+```
+
+## Supply a custom predicate or statement
+
+| Flag | Purpose | Example |
+| -------------------- | ------------------------------------------ | -------------------------------------------------------------- |
+| `--predicate ` | Merge a full or partial SLSA **predicate** | `valint slsa busybox:latest --predicate custom.predicate.json` |
+| `--statement ` | Merge a full or partial SLSA **statement** | `valint slsa busybox:latest --statement custom.statement.json` |
+
+### Predicate template (`custom.predicate.json`)
+
```json
{
- "buildDefinition": {
- "externalParameters": {
- "custom_external": {
- "digest": {
- "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8"
- },
- "name": "build-environment",
- "value": "production",
- "uri": "https://company.com/my_repo/event"
- }
- }
- },
- "runDetails": {
- "builder": {
- "builderDependencies": [
- {
- "uri": "https://github.com/.github/reusable_build.yaml",
- "name": "my_tool",
- "annotations": {
- "vendor": "My company Inc",
- "version": "1.0"
- }
- }
- ]
- },
- "metadata": {
- "invocationID": "https://company.com/my_repo/build.sh",
- "startedOn": "2023-07-25T15:30:00Z",
- "finishedOn": "2023-07-25T16:00:00Z"
- }
- }
+ "buildDefinition": {
+ "externalParameters": {
+ "custom_external": {
+ "name": "build-environment",
+ "value": "production",
+ "uri": "https://company.com/my_repo/event",
+ "digest": { "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" }
+ }
+ }
+ },
+ "runDetails": {
+ "builder": {
+ "builderDependencies": [
+ {
+ "uri": "https://github.com/.github/reusable_build.yaml",
+ "name": "my_tool",
+ "annotations": { "vendor": "My company Inc", "version": "1.0" }
+ }
+ ]
+ },
+ "metadata": {
+ "invocationID": "https://company.com/my_repo/build.sh",
+ "startedOn": "2023-07-25T15:30:00Z",
+ "finishedOn": "2023-07-25T16:00:00Z"
+ }
+ }
}
-```
-* `--statement` adds a full or partial SLSA provenance statement.
-For example,
-```valint slsa busybox:latest --statement custom.statement.json```
-The following `custom.predicate.json` includes custom subject and byproducts.
+```
+
+### Statement template (`custom.statement.json`)
+
```json
{
- "_type": "https://in-toto.io/Statement/v0.1",
- "predicateType": "https://slsa.dev/provenance/v1",
- "subject": [
- {
- "name": "index.docker.io/my_image",
- "digest": {
- "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8"
- }
- }
- ],
- "predicate": {
- "runDetails": {
- "byproducts": [
- {
+ "_type": "https://in-toto.io/Statement/v0.1",
+ "predicateType": "https://slsa.dev/provenance/v1",
+ "subject": [
+ {
+ "name": "index.docker.io/my_image",
+ "digest": {
+ "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8"
+ }
+ }
+ ],
+ "predicate": {
+ "runDetails": {
+ "byproducts": [
+ {
"uri": "pkg:docker/index.docker.io/my_image:latest@sha256:7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18?index=0",
"digest": {
- "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18"
+ "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18"
},
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
- "annotations": {
- "tag": "v0.0.1"
- }
- }
- ]
- }
- }
+ "annotations": { "tag": "v0.0.1" }
+ }
+ ]
+ }
+ }
}
-```
\ No newline at end of file
+```
diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md
new file mode 100644
index 000000000..9a7f74a7d
--- /dev/null
+++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md
@@ -0,0 +1,1061 @@
+---
+
+sidebar\_label: "SLSA Provenance at Scale"
+title: "SLSA L1 & L2 Provenance from Logs"
+sidebar\_position: 5
+toc\_min\_heading\_level: 2
+toc\_max\_heading\_level: 5
+---
+
+Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, without requiring any changes to your existing pipelines. Instead of embedding provenance generators in each CI job, Scribe combines **Scribe Platforms’ posture attestations** with **build-log analysis** from GitHub Actions and other supported systems to produce complete provenance statements automatically.
+
+## 🔍 Overview
+
+At the heart of this feature is the automated creation of rich, SLSA-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from:
+
+ * The source code repository and its history (via GitHub SCM APIs)
+ * The container image build targets (e.g., image digests, tags, IDs)
+ * CI systems and log (timestamps, runners, inputs)
+ * Associated SBOMs — linking both the source and built image artifacts as evidence
+
+## ✅ When to Use
+ * You cannot modify the CI pipelines due to authority or scale
+ * You want SLSA provenance but cannot modify the CI pipelines
+ * You want to verify builds retroactively (e.g., last 30 days)
+ * You operate across 10s or 100s of repositories
+ * You want SLSA Level 1 (unsigned) or Level 2 (signed) as structured, independently validated evidence
+
+## 🚀 SLSA Levels Explained with Scribe
+
+Scribe’s `platforms discover` command automatically creates SLSA provenance for each image build it detects. The SLSA level produced—Level 1 or Level 2—depends solely on whether the provenance is cryptographically signed.
+
+ * **SLSA Level 1 (Unsigned Provenance):** This level of provenance is generated by default when you use `platforms discover`. It captures essential information about the build process, as extracted from logs, but the provenance statement itself is not cryptographically signed. This provides a valuable, machine-readable record of the build, offering transparency and traceability.
+
+ * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing capability (like Scribe Hub's attestation signing capability). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source.
+
+
+## 🛠️ What Scribe Platforms Does Under the Hood
+
+Behind the scenes, Scribe Platforms performs several steps to turn raw workflow logs into SLSA-compliant provenance:
+
+* **Analyze GitHub Actions logs across multiple repositories**
+ Detects every image build (Docker, Buildah, Podman) without altering your pipelines.
+* **Extract critical build metadata automatically**
+ Pulls builder, tag, digest, and timestamp information straight from the logs.
+* **Generate and Link SBOM evidence**
+ Generate Associates both source-code and image SBOMs with the build for end-to-end traceability.
+* **Generate in-toto SLSA statements (L1 or L2)**
+ Produces valid provenance, optionally signing it when `--valint.sign` is enabled.
+* **Run SLSA-compliance initiatives**
+ Once each provenance file is written, Scribe automatically executes the matching policy-as-code initiative (`slsa.l1` for unsigned L1, `slsa.l2` for signed L2).
+ The initiative verifies the evidence set, emits a SARIF report, and—when applicable—signs that report before attaching it as additional evidence.
+* **Execute SLSA Compliance Initiatives**
+After provenance generation, Scribe automatically applies relevant policy-as-code initiatives (`slsa.l1` or `slsa.l2`). These initiatives validate the evidence, generate a SARIF report detailing compliance status, and (for Level 2) sign this report as additional, verifiable evidence.
+
+
+## 🧪 Example Usage L1 (Unsigned Provenance)
+
+The following command will generate SLSA Level 1 provenance. The provenance document will contain rich build metadata but will not be cryptographically signed.
+
+```bash
+platforms discover github \
+ --scope.organization scribe-security \
+ --scope.repository "valint" \
+ --repository.mapping *::valint_slsa::v1 \
+ --commit.skip \
+ --slsa-enable \
+ --slsa.tags-only
+```
+
+This command will:
+
+ * Scan recent GitHub workflows for the `scribe-security` organization.
+ * Match release workflows from `valint` repositories.
+ * Extract image build metadata from logs.
+ * Generate SLSA Level 1 provenance (unsigned).
+ * Include links to source and image SBOMs.
+ * Export the evidence under product key **`valint_slsa`** with version **`v1`**.
+
+## 🧪 Example Usage L2 (Signed Provenance)
+
+To generate SLSA Level 2 provenance, you need to sign the provenance statement. This is done by adding the `--valint.sign` flag. This typically requires integration with a signing service (e.g., Scribe Hub's attestation signing).
+
+```bash
+platforms discover --valint.sign github \
+ --scope.organization scribe-security \
+ --scope.repository "valint" \
+ --repository.mapping *::valint_slsa::v1 \
+ --commit.skip \
+ --slsa-enable \
+ --slsa.tags-only
+```
+
+This command will:
+
+ * Perform all actions of the L1 example.
+ * **Additionally, it will cryptographically sign the generated SLSA provenance statements**, elevating them to SLSA Level 2.
+
+
+## 🔁 Example GitHub Actions Workflow
+
+> ℹ️ **Tip:** It's recommended to schedule this workflow (instead of running manually) to ensure timely collection of logs before GitHub Actions deletes them (typically after 90 days).
+
+You can also run the `discover` command from within GitHub Actions using the [Scribe Security GitHub Action](https://github.com/scribe-security/action-platforms):
+
+
+Click to view GitHub Actions workflow example
+
+```yaml
+name: Discover SLSA Provenance from GitHub
+
+on:
+ schedule:
+ - cron: '0 4 * * *' # Runs daily at 04:00 UTC
+ workflow_dispatch:
+
+permissions:
+ id-token: write # Allows Sigstore signing via GitHub OIDC identity
+ contents: read
+
+jobs:
+ discover-slsa:
+ runs-on: ubuntu-latest
+ env:
+ GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }}
+ SCRIBE_TOKEN: ${{ secrets.GH_CI_DEV_SCRIBE_SECRET }}
+ steps:
+ - name: Discover GitHub Provenance
+ uses: scribe-security/action-platforms@dev
+ with:
+ command: discover
+ platform: github
+ sign: true # required for SLSA Level 2
+ slsa: true
+ args: >-
+ --slsa-enable
+ --slsa.tags-only
+ --scope.organization=scribe-security
+ --scope.repository=valint
+ --organization.mapping=scribe-security::valint_slsa::v1
+ --repository.mapping=scribe-security*valint::valint_slsa::v1
+```
+
+
+
+## 📂 Key Flags
+
+| Flag | Description |
+| ---------------------- | -------------------------------------------------------------- |
+| `--slsa-enable` | Enable SLSA provenance extraction and export |
+| `--valint.sign` | **(For SLSA L2)** Enables cryptographic signing of the generated SLSA provenance. This typically requires configuration for a signing backend (e.g., X509 Keys, Sigstore - GitHub's OIDC, or an external KMS). |
+| `--slsa.tags-only` | Limit to tag-based builds only |
+| `--slsa.all-versions` | Include SLSA Provenance evidence for all published images (all versions) rather than just the latest for each tag. By default, only the latest image provenance is included. |
+| `--slsa.scope.branch` | Restrict provenance to specific **branches** |
+| `--slsa.scope.tag` | Restrict provenance to matching **tags** |
+| `--slsa.scope.workflow` | Restrict provenance to named **workflows/jobs** |
+| `--slsa.scope.image` | Restrict provenance to particular **image names/repositories** |
+| `--repository.mapping` | Assign product key for evidence export |
+| `--skip-cache` | Force recomputation even if cached results exist |
+
+
+## 🔒 Proving SLSA Compliance with Policy-as-Code Initiatives
+
+After Scribe generates SLSA provenance for your container images, it automatically takes a critical extra step: it runs **policy-as-code initiatives** against the provenance and its associated evidence. This provides a robust, verifiable way to demonstrate SLSA compliance.
+
+### What are Scribe Initiatives?
+
+Scribe Initiatives are predefined or custom sets of policy rules that evaluate your software supply chain's compliance. For SLSA, Scribe offers specific initiatives to verify various aspects of your provenance and its linked SBOMs (Software Bill of Materials) for both source and image.
+
+These initiatives check for things like:
+
+ * The **existence and integrity** of the provenance document and its linked SBOMs.
+ * That **critical fields** in the provenance (e.g., builder identity, source repository) match expected values.
+ * For **SLSA Level 2**, that both the provenance and the resulting SARIF (Static Analysis Results Interchange Format) compliance report are **cryptographically signed**, ensuring their authenticity.
+
+The outcome of these evaluations is a **SARIF report**. This report details your compliance status, highlights any policy deviations, and links back to all relevant evidence. For SLSA Level 2, this SARIF report is also signed, adding another layer of verifiable assurance.
+
+This automated verification and reporting gives you:
+
+ * **Robust Compliance Proof:** Independently validated evidence of your SLSA adherence.
+ * **End-to-End Traceability:** Links all artifacts and reports directly to the build process.
+ * **Streamlined Auditing:** A standardized, machine-readable format for compliance reporting.
+
+### Further Reading and Resources
+
+For more details on Scribe's policy-as-code initiatives and their role in SLSA compliance, explore these resources:
+
+ * **Applying Initiatives to your SDLC:** [https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative)
+ * **SLSA L1 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml)
+ * **SLSA L2 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml)
+
+
+## 🚧 What's Collected in the Provenance Attestation
+* **`subject`**: Captures the **single output artifact** of the build—its full image reference **plus a SHA-256 digest** (the cryptographic hash that uniquely fingerprints the image).
+ This hash ties the provenance unambiguously to that exact image, even if the tag is later reused.
+ > *Note:* If a workflow emits multiple images, Scribe generates one provenance statement per image.
+
+* **`predicate.buildDefinition`**: Describes **how the artifact was built**. This includes:
+ * **Build System Details**: Information about the CI/CD platform used (e.g., GitHub Actions workflow file, specific job, and run ID).
+ * **Source Code**: The exact Git repository URL, commit SHA, and branch/tag that was built.
+ ** **Build Parameters** – External inputs such ad Docker build arguments and the names of all repository-level secrets that were available to the job **(values are never stored)**.
+ * **Resolved Dependencies**: A comprehensive list of all inputs consumed by the build, including base images (Image SBOM source), third-party actions (Log Source), and tools.
+* **`predicate.runDetails`**: Details **what happened during the build execution**. This covers:
+ * **Builder Identity**: A precise reference to the specific workflow definition or builder tool that orchestrated the build.
+ * **Execution Metadata**: Timestamps for the start and end of the build, along with a unique invocation ID.
+ * **Byproducts**: Additional artifacts produced during the build that contribute to the overall evidence. This includes references to **build logs**, intermediate container layers, and the **generated Image SBOMs**, linking them to their corresponding digests and relevant build context.
+
+**For a full example, see** [Appendix A - Provenance Example](#appendix-a---provenance-example).
+
+
+## 🛌 Compatibility
+
+**Log Sources**
+* GitHub Actions
+
+**Build Tools**
+* Docker
+* Podman
+* Buildah
+
+## 📄 Related Pages
+
+* [Platforms Documentation](https://scribe-security.netlify.app/docs/platforms/discover.md)
+* [SLSA Provenance Spec](https://slsa.dev/spec/v1.0/provenance/)
+
+---
+
+### Appendix A - Provenance Example
+
+
+ SLSA Provenance example
+
+```YAML
+{
+ "_type": "https://in-toto.io/Statement/v0.1",
+ "predicateType": "https://slsa.dev/provenance/v1",
+ "subject": [
+ {
+ "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "digest": {
+ "sha256": "f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1"
+ }
+ },
+ {
+ "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "digest": {
+ "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ }
+ },
+ {
+ "name": "scribe://target/",
+ "digest": {
+ "sha256": "7f7cb3f64eedcf3c4f90545dd611bf739b7e990584995143bc61f97aeaa7dc71"
+ }
+ }
+ ],
+ "predicate": {
+ "buildDefinition": {
+ "buildType": "https://docs.scribesecurity.com/buildtypes/github-workflow/v1",
+ "externalParameters": {
+ "context": {
+ "ADDED_BY": "platforms",
+ "event": "push",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "repository": "https://github.com/scribe-security/gatekeeper-valint",
+ "run_name": "release",
+ "source_git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git"
+ },
+ "head_commit": {
+ "author": {
+ "email": "mdstrauss91@gmail.com",
+ "name": "houdini91"
+ },
+ "committer": {
+ "email": "mdstrauss91@gmail.com",
+ "name": "houdini91"
+ },
+ "id": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "message": "upstream",
+ "timestamp": "2025-06-05T10:57:04Z",
+ "tree_id": "60391731fb5752c01eaeb94a0f6252789bb08759"
+ },
+ "pipeline": {
+ "actor": "houdini91",
+ "build_num": "49",
+ "job": "call-release ",
+ "run_id": "15465260889",
+ "type": "github",
+ "workflow": "release"
+ },
+ "source": {
+ "digest": {
+ "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ },
+ "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4"
+ }
+ },
+ "internalParameters": {
+ "build": {
+ "build_args": [
+ "BUILD_DATE=2025-06-05T10:59:13Z",
+ "BUILD_VERSION=2.0.4",
+ "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "VCS_URL=https://github.com/scribe-security/gatekeeper-valint",
+ "BUILD_VERSION=2.0.4",
+ "DESCRIPTION=\"Valint",
+ "PROJECT_NAME=gatekeeper-valint]"
+ ],
+ "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]",
+ "secret_list": [
+ "SCRIBE_DEV_M2M_CLIENT_ID",
+ "SCRIBE_DEV_M2M_CLIENT_SECRET",
+ "SCRIBE_STAGING_M2M_CLIENT_ID",
+ "SCRIBE_STAGING_M2M_CLIENT_SECRET"
+ ]
+ },
+ "context": {
+ "actor": "houdini91",
+ "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4",
+ "asset_type": "image",
+ "build_num": "49",
+ "content_body_type": "slsa",
+ "content_type": "statement-slsa",
+ "context_type": "local",
+ "created": "2025-06-05T11:01:59.058746094Z",
+ "extra_labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "format_encoding": "json",
+ "format_type": "slsa",
+ "format_version": "v1",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "input_name": "scribesecurity/gatekeeper-valint",
+ "input_scheme": "docker",
+ "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "job_name": "call-release ",
+ "labels": [
+ "platform=github",
+ "asset_type=slsa_target",
+ "parent-asset-id=scribe-security/gatekeeper-valint",
+ "parent-asset-type=repository",
+ "parent-asset-name=gatekeeper-valint",
+ "cache_key=15465260889",
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "platform": "linux/amd64",
+ "predicate_type": "https://slsa.dev/provenance/v1",
+ "product_version": "v1",
+ "repoDigest": [
+ "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1"
+ ],
+ "run_id": "15465260889",
+ "sbomcomponents": [
+ "base_image",
+ "metadata"
+ ],
+ "sbomgroup": "container",
+ "sbomhashs": [
+ "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ ],
+ "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64",
+ "sbomtype": "container",
+ "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "size": 124078632,
+ "target_type": "container",
+ "timestamp": "2025-06-12T11:48:47+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37",
+ "user": "mikey",
+ "workflow": "release"
+ }
+ },
+ "resolvedDependencies": [
+ {
+ "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4",
+ "digest": {
+ "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ },
+ "name": "refs/tags/v2.0.4",
+ "annotations": {
+ "branch": "v2.0.4",
+ "tag": ""
+ }
+ },
+ {
+ "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "SBOM_METADATA": {
+ "OS": "linux",
+ "actor": "houdini91",
+ "architecture": "amd64",
+ "build_num": "49",
+ "context_type": "local",
+ "created": "2025-06-05T11:01:59.058746094Z",
+ "entrypoint": "/home/scribe/docker/entrypoint.sh, /home/scribe/${PROJECT_NAME}",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "imageEnvironment_0": "PATH=/home/scribe/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+ "imageEnvironment_1": "PROJECT_NAME=gatekeeper-valint",
+ "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "imageUser": "65532:65532",
+ "input_name": "scribesecurity/gatekeeper-valint",
+ "input_scheme": "docker",
+ "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "job_name": "call-release ",
+ "label_io.artifacthub.package.license": "Apache-2.0",
+ "label_io.artifacthub.package.name": "gatekeeper-valint",
+ "label_io.artifacthub.package.readme-url": "https://raw.githubusercontent.com/scribe-security/gatekeeper-valint/README.md",
+ "label_io.artifacthub.package.vendor": "Scribe security, Inc.",
+ "label_org.opencontainers.image.created": "2025-06-05T10:59:13Z",
+ "label_org.opencontainers.image.description": "\"Valint gatekeeper external data provider\"",
+ "label_org.opencontainers.image.revision": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "label_org.opencontainers.image.source": "https://github.com/scribe-security/gatekeeper-valint",
+ "label_org.opencontainers.image.title": "gatekeeper-valint",
+ "label_org.opencontainers.image.vendor": "Scribe security, Inc.",
+ "label_org.opencontainers.image.version": "2.0.4",
+ "labels_0": "platform=github",
+ "labels_1": "asset_type=slsa_target",
+ "labels_2": "parent-asset-id=scribe-security/gatekeeper-valint",
+ "labels_3": "parent-asset-type=repository",
+ "labels_4": "parent-asset-name=gatekeeper-valint",
+ "labels_5": "cache_key=15465260889",
+ "manifest-digest": "sha256:94023f7bbe13163404aada47909e965ee98addd9b65edc805d293235be582596",
+ "media-type": "application/vnd.docker.distribution.manifest.v2+json",
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "product_version": "v1",
+ "registry_location": "index.docker.io",
+ "registry_scheme": "https",
+ "repoDigest_0": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "run_id": "15465260889",
+ "size": "124078632",
+ "target_type": "container",
+ "timestamp": "2025-06-12T11:48:47+03:00",
+ "user": "mikey",
+ "workflow": "release"
+ }
+ }
+ },
+ {
+ "uri": "https://github.com/actions/checkout",
+ "digest": {
+ "sha1": "942562b9c7d4b1f2557f1da21f4d3eb4eb4fd01f2ad78b2a6e187d1b193e0a0f"
+ },
+ "name": "actions/checkout@v3",
+ "annotations": {
+ "action_ref": "v3",
+ "action_ref_type": "major",
+ "env": {
+ "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io",
+ "GOPRIVATE": "github.com/scribe-security/*",
+ "GO_VERSION": "1.21"
+ },
+ "inputs": {
+ "clean": "true",
+ "fetch-depth": "0",
+ "fetch-tags": "false",
+ "lfs": "false",
+ "persist-credentials": "true",
+ "repository": "scribe-security/gatekeeper-valint",
+ "set-safe-directory": "true",
+ "sparse-checkout-cone-mode": "true",
+ "ssh-strict": "true",
+ "submodules": "false",
+ "token": "***"
+ },
+ "version": "3.6.0"
+ }
+ },
+ {
+ "uri": "https://github.com/actions/setup-go",
+ "digest": {
+ "sha1": "1b5ba729a06c8434c34b6776887b6934e562a955369e9f11807883dd5e99cd81"
+ },
+ "name": "actions/setup-go@v3",
+ "annotations": {
+ "action_ref": "v3",
+ "action_ref_type": "major",
+ "env": {
+ "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io",
+ "GOPRIVATE": "github.com/scribe-security/*",
+ "GO_VERSION": "1.21"
+ },
+ "inputs": {
+ "cache": "false",
+ "check-latest": "false",
+ "go-version": "1.21",
+ "token": "***"
+ },
+ "version": "3.6.1"
+ }
+ },
+ {
+ "uri": "https://github.com/actions/cache",
+ "digest": {
+ "sha1": "912f76fb11db1ca09ae23248a39eb86e79ea0f0f6e183d9cb96d0b778eeea4e2"
+ },
+ "name": "actions/cache@v3",
+ "annotations": {
+ "action_ref": "v3",
+ "action_ref_type": "major",
+ "env": {
+ "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io",
+ "GOPRIVATE": "github.com/scribe-security/*",
+ "GO_VERSION": "1.21"
+ },
+ "inputs": {
+ "enableCrossOsArchive": "false",
+ "fail-on-cache-miss": "false",
+ "key": "Linux-go-1.21-14fb4d3c9f15f444578334a60ca0e69141dd77054775852da7ca35a3e2e5f96e",
+ "lookup-only": "false",
+ "path": "~/go/pkg/mod",
+ "restore-keys": "Linux-go-1.21-"
+ },
+ "version": "3.4.3"
+ }
+ },
+ {
+ "uri": "https://github.com/docker/login-action",
+ "digest": {
+ "sha1": "074da69a9e77797ae469f40db0f64632c02629b61bfa229f2fa803f41a464283"
+ },
+ "name": "docker/login-action@v2",
+ "annotations": {
+ "action_ref": "v2",
+ "action_ref_type": "major",
+ "env": {
+ "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io",
+ "GOPRIVATE": "github.com/scribe-security/*",
+ "GO_VERSION": "1.21"
+ },
+ "inputs": {
+ "ecr": "auto",
+ "logout": "true",
+ "password": "***",
+ "username": "scribesecurity"
+ },
+ "version": "2.2.0"
+ }
+ },
+ {
+ "uri": "https://github.com/actions/upload-artifact",
+ "digest": {
+ "sha1": "290722aa3281d5caf23d0acdc3dbeb3424786a1a01a9cc97e72f147225e37c38"
+ },
+ "name": "actions/upload-artifact@v4",
+ "annotations": {
+ "action_ref": "v4",
+ "action_ref_type": "major",
+ "env": {
+ "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io",
+ "GOPRIVATE": "github.com/scribe-security/*",
+ "GO_VERSION": "1.21"
+ },
+ "inputs": {
+ "compression-level": "6",
+ "if-no-files-found": "warn",
+ "include-hidden-files": "false",
+ "name": "artifacts",
+ "overwrite": "false",
+ "path": "dist/**/*"
+ },
+ "version": "4.6.2"
+ }
+ }
+ ]
+ },
+ "runDetails": {
+ "builder": {
+ "id": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml",
+ "builderDependencies": [
+ {
+ "uri": "https://scribesecuriy.jfrog.io/scribe-docker-public-local/valint:2.0.0-3-SNAPSHOT-a1e7b37",
+ "name": "valint",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "vendor": "Scribe security, Inc",
+ "version": "2.0.0-3-SNAPSHOT-a1e7b37"
+ }
+ }
+ ]
+ },
+ "metadata": {
+ "invocationID": "15465260889",
+ "startedOn": "2025-06-05T10:57:25Z",
+ "finishedOn": "2025-06-05T10:57:25Z"
+ },
+ "byproducts": [
+ {
+ "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e?index=0",
+ "digest": {
+ "sha256": "7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e"
+ },
+ "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "CreatedBy": "COPY /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # buildkit",
+ "index": "0",
+ "size": "221335"
+ }
+ },
+ {
+ "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097?index=1",
+ "digest": {
+ "sha256": "73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097"
+ },
+ "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "CreatedBy": "COPY / / # buildkit",
+ "index": "1",
+ "size": "28812158"
+ }
+ },
+ {
+ "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8?index=2",
+ "digest": {
+ "sha256": "6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8"
+ },
+ "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "CreatedBy": "RUN |6 DESCRIPTION=\"Valint gatekeeper external data provider\" BUILD_DATE=2025-06-05T10:59:13Z BUILD_VERSION=2.0.4 VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e VCS_URL=https://github.com/scribe-security/gatekeeper-valint PROJECT_NAME=gatekeeper-valint /bin/sh -c /bin/mkdir -p /etc/scribe/keys /home/scribe/ # buildkit",
+ "index": "2",
+ "size": "0"
+ }
+ },
+ {
+ "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3Af48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4?index=3",
+ "digest": {
+ "sha256": "f48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4"
+ },
+ "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "CreatedBy": "COPY . /home/scribe/ # buildkit",
+ "index": "3",
+ "size": "95045139"
+ }
+ },
+ {
+ "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef?index=4",
+ "digest": {
+ "sha256": "5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
+ },
+ "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "CreatedBy": "WORKDIR /home/scribe/",
+ "index": "4",
+ "size": "0"
+ }
+ },
+ {
+ "uri": "pkg:OS/wolfi@20230201",
+ "name": "wolfi",
+ "annotations": {
+ "ADDED_BY": "valint",
+ "BugReportURL": "https://github.com/wolfi-dev/os/issues",
+ "HomeURL": "https://wolfi.dev",
+ "ID": "wolfi",
+ "Name": "Wolfi",
+ "PrettyName": "Wolfi",
+ "VersionID": "20230201"
+ }
+ },
+ {
+ "uri": "https://api.github.com/repos/scribe-security/gatekeeper-valint/actions/runs/15465260889/logs",
+ "digest": {
+ "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+ },
+ "name": "scribe-security/gatekeeper-valint/release/15465260889/call-release ",
+ "mediaType": "text/plain",
+ "annotations": {
+ "ADDED_BY": "platforms",
+ "build_args": [
+ "BUILD_DATE=2025-06-05T10:59:13Z",
+ "BUILD_VERSION=2.0.4",
+ "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "VCS_URL=https://github.com/scribe-security/gatekeeper-valint",
+ "BUILD_VERSION=2.0.4",
+ "DESCRIPTION=\"Valint",
+ "PROJECT_NAME=gatekeeper-valint]"
+ ],
+ "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]",
+ "imageID_log": "#13 writing image sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d done",
+ "log_filepath": "0_call-release _ release.txt",
+ "workflow_file": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml"
+ }
+ },
+ {
+ "uri": "scribesecurity/gatekeeper-valint:v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "digest": {
+ "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ },
+ "name": "scribesecurity/gatekeeper-valint:v2.0.4",
+ "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
+ "annotations": {
+ "ADDED_BY": "platforms",
+ "image_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ }
+ },
+ {
+ "uri": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "digest": {
+ "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ },
+ "name": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "mediaType": "application/vnd.in-toto+json",
+ "annotations": {
+ "context": {
+ "actor": "houdini91",
+ "build_num": "49",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "statement-cyclonedx-json",
+ "context_type": "local",
+ "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4",
+ "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint",
+ "extra_labels": [
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=metadata"
+ ],
+ "format_encoding": "json",
+ "format_type": "cyclonedx",
+ "format_version": "1.5",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "input_name": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "input_scheme": "git",
+ "job_name": "call-release ",
+ "labels": [
+ "platform=github",
+ "asset_type=slsa_target",
+ "parent-asset-id=scribe-security/gatekeeper-valint",
+ "parent-asset-type=repository",
+ "parent-asset-name=gatekeeper-valint",
+ "cache_key=15465260889",
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=metadata"
+ ],
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "predicate_type": "https://cyclonedx.org/bom/v1.5",
+ "product_version": "v1",
+ "ref": "113193",
+ "run_id": "15465260889",
+ "sbomcomponents": [
+ "packages",
+ "dep",
+ "metadata"
+ ],
+ "sbomgroup": "git",
+ "sbomhashs": [
+ "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ ],
+ "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "sbomtype": "file",
+ "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "store": "scribe",
+ "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "target_git_ref": "refs/tags/v2.0.4",
+ "target_git_tag": "v2.0.4",
+ "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "target_type": "git",
+ "timestamp": "2025-06-12T11:48:42+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37",
+ "user": "mikey",
+ "workflow": "release"
+ },
+ "ref-id": "113193",
+ "target-type": "git"
+ }
+ },
+ {
+ "uri": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "digest": {
+ "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ },
+ "name": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "mediaType": "application/vnd.in-toto+json",
+ "annotations": {
+ "context": {
+ "actor": "houdini91",
+ "build_num": "49",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "statement-cyclonedx-json",
+ "context_type": "local",
+ "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4",
+ "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint",
+ "extra_labels": [
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=metadata"
+ ],
+ "format_encoding": "json",
+ "format_type": "cyclonedx",
+ "format_version": "1.5",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "input_name": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "input_scheme": "git",
+ "job_name": "call-release ",
+ "labels": [
+ "platform=github",
+ "asset_type=slsa_target",
+ "parent-asset-id=scribe-security/gatekeeper-valint",
+ "parent-asset-type=repository",
+ "parent-asset-name=gatekeeper-valint",
+ "cache_key=15465260889",
+ "component-group=packages",
+ "component-group=dep",
+ "component-group=metadata"
+ ],
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "predicate_type": "https://cyclonedx.org/bom/v1.5",
+ "product_version": "v1",
+ "ref": "113193",
+ "run_id": "15465260889",
+ "sbomcomponents": [
+ "packages",
+ "dep",
+ "metadata"
+ ],
+ "sbomgroup": "git",
+ "sbomhashs": [
+ "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e"
+ ],
+ "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "sbomtype": "file",
+ "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "store": "scribe",
+ "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "target_git_ref": "refs/tags/v2.0.4",
+ "target_git_tag": "v2.0.4",
+ "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git",
+ "target_type": "git",
+ "timestamp": "2025-06-12T11:48:42+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37",
+ "user": "mikey",
+ "workflow": "release"
+ },
+ "ref-id": "/home/mikey/.cache/valint/sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e.bom.statement.json",
+ "target-type": "git"
+ }
+ },
+ {
+ "uri": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "digest": {
+ "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ },
+ "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "mediaType": "application/vnd.in-toto+json",
+ "annotations": {
+ "context": {
+ "actor": "houdini91",
+ "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4",
+ "asset_type": "image",
+ "build_num": "49",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "statement-cyclonedx-json",
+ "context_type": "local",
+ "created": "2025-06-05T11:01:59.058746094Z",
+ "extra_labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "format_encoding": "json",
+ "format_type": "slsa",
+ "format_version": "v1",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "input_name": "scribesecurity/gatekeeper-valint",
+ "input_scheme": "docker",
+ "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "job_name": "call-release ",
+ "labels": [
+ "platform=github",
+ "asset_type=slsa_target",
+ "parent-asset-id=scribe-security/gatekeeper-valint",
+ "parent-asset-type=repository",
+ "parent-asset-name=gatekeeper-valint",
+ "cache_key=15465260889",
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "platform": "linux/amd64",
+ "predicate_type": "https://slsa.dev/provenance/v1",
+ "product_version": "v1",
+ "ref": "113194",
+ "repoDigest": [
+ "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1"
+ ],
+ "run_id": "15465260889",
+ "sbomcomponents": [
+ "base_image",
+ "metadata"
+ ],
+ "sbomgroup": "container",
+ "sbomhashs": [
+ "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ ],
+ "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64",
+ "sbomtype": "container",
+ "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "size": 124078632,
+ "store": "scribe",
+ "target_type": "container",
+ "timestamp": "2025-06-12T11:48:47+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37",
+ "user": "mikey",
+ "workflow": "release"
+ },
+ "ref-id": "113194",
+ "target-type": "container"
+ }
+ },
+ {
+ "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "digest": {
+ "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ },
+ "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "mediaType": "application/vnd.in-toto+json",
+ "annotations": {
+ "context": {
+ "actor": "houdini91",
+ "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4",
+ "asset_type": "image",
+ "build_num": "49",
+ "content_body_type": "cyclonedx-json",
+ "content_type": "statement-cyclonedx-json",
+ "context_type": "local",
+ "created": "2025-06-05T11:01:59.058746094Z",
+ "extra_labels": [
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "format_encoding": "json",
+ "format_type": "slsa",
+ "format_version": "v1",
+ "git_branch": "v2.0.4",
+ "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e",
+ "git_ref": "refs/tags/v2.0.4",
+ "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git",
+ "hostname": "mikey-laptop",
+ "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "input_name": "scribesecurity/gatekeeper-valint",
+ "input_scheme": "docker",
+ "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "job_name": "call-release ",
+ "labels": [
+ "platform=github",
+ "asset_type=slsa_target",
+ "parent-asset-id=scribe-security/gatekeeper-valint",
+ "parent-asset-type=repository",
+ "parent-asset-name=gatekeeper-valint",
+ "cache_key=15465260889",
+ "component-group=base_image",
+ "component-group=metadata"
+ ],
+ "name": "slsa_test_jun_11",
+ "organization": "scribe-security",
+ "platform": "linux/amd64",
+ "predicate_type": "https://slsa.dev/provenance/v1",
+ "product_version": "v1",
+ "ref": "113194",
+ "repoDigest": [
+ "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1"
+ ],
+ "run_id": "15465260889",
+ "sbomcomponents": [
+ "base_image",
+ "metadata"
+ ],
+ "sbomgroup": "container",
+ "sbomhashs": [
+ "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d"
+ ],
+ "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1",
+ "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64",
+ "sbomtype": "container",
+ "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d",
+ "size": 124078632,
+ "store": "scribe",
+ "target_type": "container",
+ "timestamp": "2025-06-12T11:48:47+03:00",
+ "tool": "valint",
+ "tool_vendor": "Scribe Security",
+ "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37",
+ "user": "mikey",
+ "workflow": "release"
+ },
+ "ref-id": "/home/mikey/.cache/valint/sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d.bom.statement.json",
+ "target-type": "container"
+ }
+ }
+ ]
+ }
+ }
+ }
+```
+
+
+
+
+
+
+
+
+
diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md
index 2db76b1eb..775debb5f 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-bom.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md
@@ -14,7 +14,7 @@ Further documentation **[GitHub integration](../../../integrating-scribe/ci-inte
### Bom Action
The command allows users to generate sbom and third party evidence.
-- CycloneDX 1.4 SBOM support.
+- CycloneDX 1.5 SBOM support.
- Generates detailed SBOMs for images, directories, files and git repositories targets.
- Store and manage evidence on Scribe service.
- Attach evidence to any OCI registry.
@@ -177,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github.
Containerized action can be used on Linux runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-bom@v2.0.0
+ uses: scribe-security/action-bom@v2.0.2
with:
target: 'busybox:latest'
```
@@ -185,7 +185,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-bom-cli@v2.0.0
+ uses: scribe-security/action-bom-cli@v2.0.2
with:
target: 'hello-world:latest'
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md
index 5ec62566d..6e87398f9 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md
@@ -142,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t
Containerized action can be used on Linux runners as following
```yaml
- name: Include evidence derived from a file
- uses: scribe-security/action-evidence@v2.0.0
+ uses: scribe-security/action-evidence@v2.0.2
with:
target: some_file.json
```
@@ -150,7 +150,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Include evidence derived from a file
- uses: scribe-security/action-evidence-cli@v2.0.0
+ uses: scribe-security/action-evidence-cli@v2.0.2
with:
target: some_file.json
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md
index b5dbe3eb1..6763aa0f3 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md
@@ -161,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co
Containerized action can be used on Linux runners as following
```yaml
- name: Generate SLSA provenance
- uses: scribe-security/action-slsa@v2.0.0
+ uses: scribe-security/action-slsa@v2.0.2
with:
target: 'busybox:latest'
```
@@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-slsa-cli@v2.0.0
+ uses: scribe-security/action-slsa-cli@v2.0.2
with:
target: 'hello-world:latest'
```
diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md
index 17e97014d..ff0171c51 100644
--- a/docs/integrating-scribe/ci-integrations/github/action-verify.md
+++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md
@@ -182,7 +182,7 @@ Containerized action can be used on Linux runners as following
```yaml
- name: valint verify
id: valint_verify
- uses: scribe-security/action-verify@v2.0.0
+ uses: scribe-security/action-verify@v2.0.2
with:
target: 'busybox:latest'
```
@@ -190,7 +190,7 @@ Containerized action can be used on Linux runners as following
Composite Action can be used on Linux or Windows runners as following
```yaml
- name: Generate cyclonedx json SBOM
- uses: scribe-security/action-verify-cli@v2.0.0
+ uses: scribe-security/action-verify-cli@v2.0.2
with:
target: 'hello-world:latest'
```
diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md
index 2f14a0c98..1a0eaafa6 100644
--- a/docs/platforms/bom.md
+++ b/docs/platforms/bom.md
@@ -18,10 +18,12 @@ This command enables users to generate SBOMs on scale.
```bash
usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD]
[--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET]
- [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL]
- [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
- [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign]
- [--valint.components COMPONENTS] [--valint.label LABEL] [--unique]
+ [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD]
+ [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY]
+ [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION]
+ [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST]
+ [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT]
+ [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG]
{gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket,azure} ...
Export bom data
@@ -47,8 +49,15 @@ options:
Disable Valint local cache (default: False)
--valint.context-type CONTEXT_TYPE
Valint context type (type: str, default: )
+ --valint.assume-context ASSUME_CONTEXT
+ Valint assume context (type: str, default: )
+ --valint.payload PAYLOAD
+ Valint payload (type: str, default: )
--valint.log-level LOG_LEVEL
Valint log level (type: str, default: )
+ --valint.arch ARCH Set Image architecture (type: str, default: )
+ --valint.input [INPUT ...]
+ Valint extra input targets (default: [])
--valint.output-directory OUTPUT_DIRECTORY
Local evidence cache directory (type: str, default: )
--valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint)
@@ -58,13 +67,23 @@ options:
Evidence product version (type: str, default: )
--valint.predicate-type PREDICATE_TYPE
Evidence predicate type (type: str, default: )
+ --valint.statement STATEMENT
+ SLSA Evidence statement type (type: str, default: )
+ --valint.source SOURCE
+ SLSA Source target (type: str, default: )
--valint.attest ATTEST
Evidence attest type (type: str, default: x509-env)
--valint.sign sign evidence (default: False)
--valint.components COMPONENTS
components list (type: str, default: )
- --valint.label LABEL Set additional labels (type: at 0x7ece7edf87c0>, default: [])
+ --valint.label LABEL Set additional labels (type: at 0x71cbe8ddd120>, default: [])
--unique Allow unique assets (default: False)
+ --valint.git-commit GIT_COMMIT
+ Set Input Target Git commit (type: str, default: )
+ --valint.git-branch GIT_BRANCH
+ Set Input Target Git branch (type: str, default: )
+ --valint.git-tag GIT_TAG
+ Set Input Target Git tag (type: str, default: )
subcommands:
For more details of each subcommand, add it as an argument followed by --help.
@@ -319,7 +338,8 @@ usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANC
[--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]]
[--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]]
[--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]]
- [--image.mapping [MAPPING ...]]
+ [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip]
+ [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]]
options:
-h, --help Show this help message and exit.
@@ -347,6 +367,14 @@ options:
Jfrog tags to exclude (default: [])
--image.mapping [MAPPING ...]
Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: [])
+ --hook-config [HOOK_CONFIG ...]
+ Paths to YAML files containing custom hook definitions. (type: str, default: [])
+ --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_image. (default: [])
+ --hook.skip Skip hooks (default: False)
+ --repository.hooks [HOOKS ...]
+ Inline hook format :::::: (type: ToolHookString, default: [])
+ --image.hook [HOOK ...]
+ Inline hook format :::::: (type: ToolHookString, default: [])
```
@@ -488,9 +516,10 @@ Note that the image characterization string is a wildcarded string, some useful
```bash
usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}]
[--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]]
- [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--default_product_key_strategy {mapping}]
- [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]]
- [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]]
+ [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only]
+ [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]]
+ [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip]
+ [--repository.hooks [HOOKS ...]]
options:
-h, --help Show this help message and exit.
@@ -506,11 +535,12 @@ options:
Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace
/ project_name' (default: ['*'])
--scope.branch [BRANCH ...]
- Github branches wildcards (default: [])
- --scope.tag [TAG ...]
- Github tags wildcards (default: [])
+ Github branches wildcards (default: ['*'])
+ --scope.tag.name [NAME ...]
+ Github tags wildcards (default: ['*'])
--branch.shallow Shallow branch discovery (default: False)
--commit.skip Skip commits in discovery/evidence (default: False)
+ --tag.only Only include tags in the evidence, skip branches (default: False)
--default_product_key_strategy {mapping}
Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping)
--organization.mapping [MAPPING ...]
diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md
index 47571246b..31f4875b5 100644
--- a/docs/platforms/discover.md
+++ b/docs/platforms/discover.md
@@ -26,9 +26,11 @@ usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local
[--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS]
[--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence]
[--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE]
- [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
- [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign]
- [--valint.components COMPONENTS] [--valint.label LABEL] [--unique]
+ [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH]
+ [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
+ [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT]
+ [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL]
+ [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG]
{gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket,azure} ...
Discover assets and save data to a local store
@@ -62,8 +64,15 @@ options:
Disable Valint local cache (default: False)
--valint.context-type CONTEXT_TYPE
Valint context type (type: str, default: )
+ --valint.assume-context ASSUME_CONTEXT
+ Valint assume context (type: str, default: )
+ --valint.payload PAYLOAD
+ Valint payload (type: str, default: )
--valint.log-level LOG_LEVEL
Valint log level (type: str, default: )
+ --valint.arch ARCH Set Image architecture (type: str, default: )
+ --valint.input [INPUT ...]
+ Valint extra input targets (default: [])
--valint.output-directory OUTPUT_DIRECTORY
Local evidence cache directory (type: str, default: )
--valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint)
@@ -73,13 +82,23 @@ options:
Evidence product version (type: str, default: )
--valint.predicate-type PREDICATE_TYPE
Evidence predicate type (type: str, default: )
+ --valint.statement STATEMENT
+ SLSA Evidence statement type (type: str, default: )
+ --valint.source SOURCE
+ SLSA Source target (type: str, default: )
--valint.attest ATTEST
Evidence attest type (type: str, default: x509-env)
--valint.sign sign evidence (default: False)
--valint.components COMPONENTS
components list (type: str, default: )
- --valint.label LABEL Set additional labels (type: at 0x75bbf48f2ca0>, default: [])
+ --valint.label LABEL Set additional labels (type: at 0x7a399b53a840>, default: [])
--unique Allow unique assets (default: False)
+ --valint.git-commit GIT_COMMIT
+ Set Input Target Git commit (type: str, default: )
+ --valint.git-branch GIT_BRANCH
+ Set Input Target Git branch (type: str, default: )
+ --valint.git-tag GIT_TAG
+ Set Input Target Git tag (type: str, default: )
subcommands:
For more details of each subcommand, add it as an argument followed by --help.
@@ -245,12 +264,16 @@ usage: platforms [options] discover [options] github [-h] [--instance.instance I
[--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]]
[--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]]
[--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]]
- [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip]
+ [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only]
[--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] [--workflow.skip]
- [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.runners] [--scope.sbom]
- [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]]
- [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--skip-cache]
- [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP]
+ [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]]
+ [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]]
+ [--hook.skip] [--repository.hooks [HOOKS ...]] [--bom] [--provenance] [--bom.scope.branch [BRANCH ...]]
+ [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]]
+ [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] [--slsa.all-versions]
+ [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache]
+ [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]]
+ [--repository.mapping [MAPPING ...]] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP]
options:
-h, --help Show this help message and exit.
@@ -268,11 +291,12 @@ options:
Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace
/ project_name' (default: ['*'])
--scope.branch [BRANCH ...]
- Github branches wildcards (default: [])
- --scope.tag [TAG ...]
- Github tags wildcards (default: [])
+ Github branches wildcards (default: ['*'])
+ --scope.tag.name [NAME ...]
+ Github tags wildcards (default: ['*'])
--branch.shallow Shallow branch discovery (default: False)
--commit.skip Skip commits in discovery/evidence (default: False)
+ --tag.only Only include tags in the evidence, skip branches (default: False)
--default_product_key_strategy {mapping}
Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping)
--scope.commit.past_days PAST_DAYS
@@ -282,8 +306,10 @@ options:
Number of past days to include in the report (type: int, default: 30)
--scope.workflow.analyzed_logs
Include analyzed workflow logs (default: False)
+ --scope.workflow.name [NAME ...]
+ Scope Workflow names (default: ['*'])
--scope.runners Include repository allocated runners in evidence (default: False)
- --scope.sbom Include repositories SBOM in evidence (default: False)
+ --scope.api-sbom Include repositories SBOM in evidence (default: False)
--broad Retrieves limited information (only organizations, repositories and workflows) (default: False)
--hook-config [HOOK_CONFIG ...]
Paths to YAML files containing custom hook definitions. (type: str, default: [])
@@ -291,6 +317,28 @@ options:
--hook.skip Skip hooks (default: False)
--repository.hooks [HOOKS ...]
Inline hook format :::::: (type: ToolHookString, default: [])
+ --bom Retrieves Source SBOM from all repositories (default: False)
+ --provenance Retrieves Image provenance discovered in platform API (default: False)
+ --bom.scope.branch [BRANCH ...]
+ Scope branchs to include Repository Source SBOM evidence for (default: [])
+ --slsa.scope.branch [BRANCH ...]
+ Scope branchs to include SLSA Provenance evidence for (default: ['*'])
+ --slsa.scope.tag [TAG ...]
+ Scope tags to include SLSA Provenance evidence for (default: ['*'])
+ --slsa.scope.workflow [WORKFLOW ...]
+ Scope workflows to include SLSA Provenance evidence for (default: ['*'])
+ --slsa.scope.image [IMAGE ...]
+ Scope images to include asset SLSA Provenance evidence for (default: ['*'])
+ --slsa-enable Include SLSA Provenance evidence (default: False)
+ --slsa.tags-only Include SLSA Provenance evidence only for tags, skip branches (default: False)
+ --slsa.all-versions Include SLSA Provenance evidence for all versions of the image, not only latest (default: False)
+ --slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]
+ Extended SLSA evidence types to include in the report (default: ['all'])
+ --slsa.skip-cache Skip Scribe SLSA cache lookup (default: False)
+ --slsa.cache-ttl CACHE_TTL
+ time to live for SLSA cache (default: 20d)
+ --slsa.cache-group CACHE_GROUP
+ Scribe SLSA cache group, default to runners pipeline ID, empty to use global context (default: any)
--organization.mapping [MAPPING ...]
Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are
supported (type: AssetMappingString, default: [])
@@ -540,7 +588,8 @@ usage: platforms [options] discover [options] jfrog [-h] [--instance.instance IN
[--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT]
[--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]]
[--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single]
- [--default_product_key_strategy {mapping,mapping,mapping,mapping}]
+ [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]]
+ [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]]
options:
-h, --help Show this help message and exit.
@@ -583,6 +632,12 @@ options:
--repository.single Export all repositories in a single evidence (default: False)
--default_product_key_strategy {mapping,mapping,mapping,mapping}
Override product key with jf-repository, repository or image names (default: mapping)
+ --hook-config [HOOK_CONFIG ...]
+ Paths to YAML files containing custom hook definitions. (type: str, default: [])
+ --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_image. (default: [])
+ --hook.skip Skip hooks (default: False)
+ --repository.hooks [HOOKS ...]
+ Inline hook format :::::: (type: ToolHookString, default: [])
```
diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md
index ffbd9e9ea..5a3592ed7 100644
--- a/docs/platforms/evidence.md
+++ b/docs/platforms/evidence.md
@@ -26,9 +26,11 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s
usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS]
[--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence]
[--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE]
- [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
- [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign]
- [--valint.components COMPONENTS] [--valint.label LABEL] [--unique]
+ [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH]
+ [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
+ [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT]
+ [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL]
+ [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG]
{gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket,azure} ...
Export evidence data (Deprecated)
@@ -56,8 +58,15 @@ options:
Disable Valint local cache (default: False)
--valint.context-type CONTEXT_TYPE
Valint context type (type: str, default: )
+ --valint.assume-context ASSUME_CONTEXT
+ Valint assume context (type: str, default: )
+ --valint.payload PAYLOAD
+ Valint payload (type: str, default: )
--valint.log-level LOG_LEVEL
Valint log level (type: str, default: )
+ --valint.arch ARCH Set Image architecture (type: str, default: )
+ --valint.input [INPUT ...]
+ Valint extra input targets (default: [])
--valint.output-directory OUTPUT_DIRECTORY
Local evidence cache directory (type: str, default: )
--valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint)
@@ -67,13 +76,23 @@ options:
Evidence product version (type: str, default: )
--valint.predicate-type PREDICATE_TYPE
Evidence predicate type (type: str, default: )
+ --valint.statement STATEMENT
+ SLSA Evidence statement type (type: str, default: )
+ --valint.source SOURCE
+ SLSA Source target (type: str, default: )
--valint.attest ATTEST
Evidence attest type (type: str, default: x509-env)
--valint.sign sign evidence (default: False)
--valint.components COMPONENTS
components list (type: str, default: )
- --valint.label LABEL Set additional labels (type: at 0x7f0fc74b5800>, default: [])
+ --valint.label LABEL Set additional labels (type: at 0x749f8ea05c60>, default: [])
--unique Allow unique assets (default: False)
+ --valint.git-commit GIT_COMMIT
+ Set Input Target Git commit (type: str, default: )
+ --valint.git-branch GIT_BRANCH
+ Set Input Target Git branch (type: str, default: )
+ --valint.git-tag GIT_TAG
+ Set Input Target Git tag (type: str, default: )
subcommands:
For more details of each subcommand, add it as an argument followed by --help.
@@ -163,9 +182,9 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep
```bash
usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}]
[--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]]
- [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--default_product_key_strategy {mapping}]
- [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single]
- [--repository.single]
+ [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only]
+ [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]]
+ [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single]
options:
-h, --help Show this help message and exit.
@@ -181,11 +200,12 @@ options:
Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace
/ project_name' (default: ['*'])
--scope.branch [BRANCH ...]
- Github branches wildcards (default: [])
- --scope.tag [TAG ...]
- Github tags wildcards (default: [])
+ Github branches wildcards (default: ['*'])
+ --scope.tag.name [NAME ...]
+ Github tags wildcards (default: ['*'])
--branch.shallow Shallow branch discovery (default: False)
--commit.skip Skip commits in discovery/evidence (default: False)
+ --tag.only Only include tags in the evidence, skip branches (default: False)
--default_product_key_strategy {mapping}
Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping)
--organization.mapping [MAPPING ...]
diff --git a/docs/platforms/hooks.md b/docs/platforms/hooks.md
index 2cc09321f..434f82253 100644
--- a/docs/platforms/hooks.md
+++ b/docs/platforms/hooks.md
@@ -57,7 +57,7 @@ When running hooks, `platforms` provides useful environment variables:
- `PLATFORMS_KUBECONFIG`: Kubeconfig path with the provided `url` and `token` to platforms command (avilable for `k8s`).
- `CLUSTER_URL`: Provided `url` to platforms command (avilable for `k8s`).
- `NAMESPACE`: Target asset namespace (avilable for `k8s`).
-- `POD`: Target asset namespace (avilable for `k8s`).
+- `POD`: Target asset pod (avilable for `k8s`).
Of course! Here's a cleaner, more formal rephrasing for the Kubernetes (K8s) parts you added, while keeping the structure and meaning you intended:
@@ -120,6 +120,7 @@ These hooks are provided by the `platforms` container along with required config
| Trivy Vulnerability Scan | trivy_image | repository | dockerhub | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
| Trivy IaC and Secrets Scan | trivy_iac_and_secrets | image | dockerhub | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
| Trivy IaC and Secrets Scan | trivy_iac_and_secrets | repository | github | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
+| Trivy Vulnerability Scan | trivy_image | repository | jfrog | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
| AppArmor Profile Check | apparmor_namespace | namespace | k8s | apparmor | json | |
| Kubescape Cluster Scan | kubescape_cluster | namespace | k8s | kubescape | kubescape | [Apache-2.0](https://github.com/kubescape/kubescape/blob/master/LICENSE) |
@@ -135,6 +136,7 @@ These hooks are provided by the `platforms` container along with required config
| Gitleaks Secret Scan | gitleaks_secrets | repository | github | gitleaks | gitleaks | [MIT](https://github.com/gitleaks/gitleaks/blob/master/LICENSE) |
| KICS IaC Security Scan | kics_scan | repository | github | kics | kics | [Apache-2.0](https://github.com/Checkmarx/kics/blob/master/LICENSE) |
| Trivy IaC and Secrets Scan | trivy_iac_and_secrets | repository | github | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
+| Trivy Vulnerability Scan | trivy_image | image | jfrog | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
| Trivy Vulnerability Scan K8s | trivy_k8s_image | image | k8s | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
| Trivy IaC and Secrets Scan | trivy_iac_and_secrets | image | k8s | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
@@ -154,16 +156,19 @@ platform: github
command: discover
tool: trivy
parser: trivy
+predicate-type: auto
allow_failure: false
use-stdout-evidence: false
license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
run: |
trivy repository \
- --scanners config,secret \
+ --scanners misconfig,secret \
--exit-code 0 \
--format json \
--output $HOOK_OUTPUT_FILE \
- $REMOTE_SOURCE_URL_WITH_TOKEN
+ ${REPO_BRANCH:+--branch "$REPO_BRANCH"} \
+ ${REPO_TAG:+--tag "$REPO_TAG"} \
+ $REMOTE_SOURCE_URL
```
@@ -201,15 +206,18 @@ platform: github
command: bom
tool: trivy
parser: trivy
+predicate-type: auto
allow_failure: true
use-stdout-evidence: false
license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
run: |
trivy config \
- --scanners config,secret \
+ --scanners misconfig,secret \
--exit-code 0 \
--format json \
--output $HOOK_OUTPUT_FILE \
+ ${REPO_BRANCH:+--branch "$REPO_BRANCH"} \
+ ${REPO_TAG:+--tag "$REPO_TAG"} \
$LOCAL_SOURCE_DIR
```
@@ -299,6 +307,7 @@ platform: dockerhub
command: discover
tool: trivy
parser: trivy
+predicate-type: auto
allow_failure: false
use-stdout-evidence: false
license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
@@ -350,6 +359,7 @@ platform: dockerhub
command: bom
tool: trivy
parser: trivy
+predicate-type: auto
allow_failure: false
use-stdout-evidence: false
license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
@@ -402,10 +412,8 @@ tool: apparmor
parser: json
allow_failure: true
use-stdout-evidence: false
-run: "echo bash scripts/hooks/k8s-apparmor-profiles.sh \\\n --namespace $ASSET_NAME\
- \ \\\n --output $HOOK_OUTPUT_FILE \\\n --format json \n\necho bash scripts/hooks/k8s-apparmor-profiles.sh\
- \ \\\n --namespace $ASSET_NAME \\\n --output $HOOK_OUTPUT_FILE \\\n --format\
- \ json \n"
+run: "sh scripts/hooks/k8s-apparmor-profiles.sh \\\n --namespace $ASSET_NAME \\\n\
+ \ --output $HOOK_OUTPUT_FILE \\\n --format json \n"
```
@@ -447,10 +455,11 @@ platform: k8s
command: bom
tool: trivy
parser: trivy
+predicate-type: auto
allow_failure: false
use-stdout-evidence: false
license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
-run: |-
+run: |
trivy image \
--scanners misconfig,secret \
--exit-code 0 \
@@ -460,6 +469,58 @@ run: |-
```
+
+
+Trivy Vulnerability Scan
+
+```yaml
+name: Trivy Vulnerability Scan
+id: trivy_image
+type: repository
+platform: jfrog
+command: discover
+tool: trivy
+parser: sarif
+allow_failure: false
+use-stdout-evidence: false
+predicate-type: auto
+license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
+run: |
+ trivy image \
+ --scanners vuln \
+ --exit-code 0 \
+ --format sarif \
+ --output $HOOK_OUTPUT_FILE \
+ $REMOTE_IMAGE_REF
+```
+
+
+
+
+Trivy Vulnerability Scan
+
+```yaml
+name: Trivy Vulnerability Scan
+id: trivy_image
+type: image
+platform: jfrog
+command: bom
+tool: trivy
+parser: sarif
+allow_failure: false
+use-stdout-evidence: false
+predicate-type: auto
+license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)'
+run: |-
+ trivy image \
+ --scanners vuln \
+ --exit-code 0 \
+ --format sarif \
+ --output $HOOK_OUTPUT_FILE \
+ $REMOTE_IMAGE_REF
+```
+
+
## General hook Examples
diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md
index 82a61ef3b..091f89fbe 100644
--- a/docs/platforms/verify.md
+++ b/docs/platforms/verify.md
@@ -20,11 +20,14 @@ The recommended use of the verify command with the product-mapping capabilities;
```bash
usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE]
- [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
- [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign]
- [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH]
- [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] [--valint.bundle-tag BUNDLE_TAG] [--allow-failures]
- [--max-threads MAX_THREADS]
+ [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH]
+ [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY]
+ [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT]
+ [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL]
+ [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE]
+ [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT]
+ [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE]
+ [--valint.gate-name GATE_NAME]
{k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins,azure} ...
Verify supply chain policies
@@ -37,8 +40,15 @@ options:
Disable Valint local cache (default: False)
--valint.context-type CONTEXT_TYPE
Valint context type (type: str, default: )
+ --valint.assume-context ASSUME_CONTEXT
+ Valint assume context (type: str, default: )
+ --valint.payload PAYLOAD
+ Valint payload (type: str, default: )
--valint.log-level LOG_LEVEL
Valint log level (type: str, default: )
+ --valint.arch ARCH Set Image architecture (type: str, default: )
+ --valint.input [INPUT ...]
+ Valint extra input targets (default: [])
--valint.output-directory OUTPUT_DIRECTORY
Local evidence cache directory (type: str, default: )
--valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint)
@@ -48,13 +58,23 @@ options:
Evidence product version (type: str, default: )
--valint.predicate-type PREDICATE_TYPE
Evidence predicate type (type: str, default: )
+ --valint.statement STATEMENT
+ SLSA Evidence statement type (type: str, default: )
+ --valint.source SOURCE
+ SLSA Source target (type: str, default: )
--valint.attest ATTEST
Evidence attest type (type: str, default: x509-env)
--valint.sign sign evidence (default: False)
--valint.components COMPONENTS
components list (type: str, default: )
- --valint.label LABEL Set additional labels (type: at 0x7fd39cf92fc0>, default: [])
+ --valint.label LABEL Set additional labels (type: at 0x7381d5ad4040>, default: [])
--unique Allow unique assets (default: False)
+ --valint.git-commit GIT_COMMIT
+ Set Input Target Git commit (type: str, default: )
+ --valint.git-branch GIT_BRANCH
+ Set Input Target Git branch (type: str, default: )
+ --valint.git-tag GIT_TAG
+ Set Input Target Git tag (type: str, default: )
--valint.bundle BUNDLE
Set bundle git branch (type: str, default: )
--valint.bundle-auth BUNDLE_AUTH
@@ -68,6 +88,10 @@ options:
--allow-failures Allow failures without returning an error code (default: False)
--max-threads MAX_THREADS
Number of threads used to run valint (type: int, default: 10)
+ --valint.gate-type GATE_TYPE
+ Valint gate type (type: str, default: )
+ --valint.gate-name GATE_NAME
+ Valint gate name (type: str, default: )
subcommands:
For more details of each subcommand, add it as an argument followed by --help.
@@ -143,8 +167,7 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje
usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}]
[--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]]
[--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]]
- [--project.policy [POLICY ...]] [--organization.policy [POLICY ...]] [--org-policy-skip-aggregate]
- [--project-policy-skip-aggregate]
+ [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate]
options:
-h, --help Show this help message and exit.
@@ -168,10 +191,8 @@ options:
Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: [])
--project.mapping [MAPPING ...]
Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: [])
- --project.policy [POLICY ...]
- Set project policy file (type: str, default: ['ct-2@discovery', 'ct-9@discovery'])
- --organization.policy [POLICY ...]
- Set organization policy file (type: str, default: ['ct-1@discovery', 'ct-3@discovery', 'ct-4@discovery'])
+ --initiative INITIATIVE
+ Set the initiative file (type: str, default: sspb-gl@v2)
--org-policy-skip-aggregate
Skip Aggregate organization policy results (default: False)
--project-policy-skip-aggregate
@@ -195,8 +216,8 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos
```bash
usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}]
[--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]]
- [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--organization.mapping [MAPPING ...]]
- [--repository.mapping [MAPPING ...]] [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]]
+ [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only]
+ [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE]
[--org-policy-skip-aggregate] [--repo-policy-skip-aggregate]
options:
@@ -213,21 +234,20 @@ options:
Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace
/ project_name' (default: ['*'])
--scope.branch [BRANCH ...]
- Github branches wildcards (default: [])
- --scope.tag [TAG ...]
- Github tags wildcards (default: [])
+ Github branches wildcards (default: ['*'])
+ --scope.tag.name [NAME ...]
+ Github tags wildcards (default: ['*'])
--branch.shallow Shallow branch discovery (default: False)
--commit.skip Skip commits in discovery/evidence (default: False)
+ --tag.only Only include tags in the evidence, skip branches (default: False)
--organization.mapping [MAPPING ...]
Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are
supported (type: AssetMappingString, default: [])
--repository.mapping [MAPPING ...]
Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported
(type: AssetMappingString, default: [])
- --repository.policy [POLICY ...]
- Set repository evidence policy file (type: str, default: [])
- --organization.policy [POLICY ...]
- Set organization evidence policy file (type: str, default: ['ct-1@discovery'])
+ --initiative INITIATIVE
+ Set initiative file (type: str, default: ssdf@v2)
--org-policy-skip-aggregate
Skip Aggregate organization policy results (default: False)
--repo-policy-skip-aggregate
@@ -253,7 +273,7 @@ usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance
[--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]]
[--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]]
[--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]]
- [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]]
+ [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE]
[--policy-skip-aggregate]
options:
@@ -284,8 +304,8 @@ options:
Dockerhub namespaces (default: ['*'])
--image.mapping [MAPPING ...]
Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: [])
- --image.policy [POLICY ...]
- Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery'])
+ --initiative INITIATIVE
+ Set initiative file (type: str, default: sspb-gl@v2)
--policy-skip-aggregate
Skip Aggregate policy results (default: False)
```
@@ -329,8 +349,7 @@ usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTAN
[--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]]
[--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]]
[--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single]
- [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] [--namespace.policy [POLICY ...]]
- [--policy-skip-aggregate]
+ [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate]
options:
-h, --help Show this help message and exit.
@@ -362,10 +381,8 @@ options:
--image.mapping [MAPPING ...]
K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type:
K8sImageMappingString, default: [])
- --cluster-images.policy [POLICY ...]
- Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery'])
- --namespace.policy [POLICY ...]
- Set Kubernetes policy file (type: str, default: [])
+ --initiative INITIATIVE
+ Set the initiative file (type: str, default: sspb-gl@v2)
--policy-skip-aggregate
Skip Aggregate policy results (default: False)
```
@@ -415,7 +432,7 @@ usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INST
[--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]]
[--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]]
[--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]]
- [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] [--policy-skip-aggregate]
+ [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate]
options:
-h, --help Show this help message and exit.
@@ -445,8 +462,8 @@ options:
Jfrog tags to exclude (default: [])
--image.mapping [MAPPING ...]
Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: [])
- --image.policy [POLICY ...]
- Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery'])
+ --initiative INITIATIVE
+ Set the initiative file (type: str, default: sspb-gl@v2)
--policy-skip-aggregate
Skip Aggregate policy results (default: False)
```
@@ -472,8 +489,7 @@ usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance
[--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]]
[--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip]
[--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]]
- [--repository.policy [POLICY ...]] [--project.policy [POLICY ...]] [--workspace.policy [POLICY ...]]
- [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate]
+ [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate]
options:
-h, --help Show this help message and exit.
@@ -515,12 +531,8 @@ options:
--repository.mapping [MAPPING ...]
Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported
(type: AssetMappingString, default: [])
- --repository.policy [POLICY ...]
- Set repository evidence policy file (type: str, default: [])
- --project.policy [POLICY ...]
- Set repository evidence policy file (type: str, default: [])
- --workspace.policy [POLICY ...]
- Set workspace evidence policy file (type: str, default: [])
+ --initiative INITIATIVE
+ Set initiative file (type: str, default: )
--org-policy-skip-aggregate
Skip Aggregate workspace policy results (default: False)
--repo-policy-skip-aggregate
diff --git a/docs/valint/configuration.md b/docs/valint/configuration.md
index 3faee57dc..bf062d083 100644
--- a/docs/valint/configuration.md
+++ b/docs/valint/configuration.md
@@ -60,14 +60,18 @@ attest:
commit: ""
depth: 0
clone-path: ""
+ initiative_file: ""
+ initiative_name: ""
+ initiative_id: ""
+ all-evidence: false
policy_configs: []
rule_configs: []
label_filters: []
- initiative_filters: []
default: sigstore
report:
add-passed: true
- cocosign: {}
+ cocosign:
+ all-evidence: false
x509: {}
fulcio:
enable: false
diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md
index 64d6962bd..8f532cc58 100644
--- a/docs/valint/help/valint.md
+++ b/docs/valint/help/valint.md
@@ -17,9 +17,10 @@ Flags for `valint`
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
| -h | --help | help for valint | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md
index f18c6ba72..e551f90b4 100644
--- a/docs/valint/help/valint_bom.md
+++ b/docs/valint/help/valint_bom.md
@@ -69,8 +69,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md
index 93fce86f9..353b68aef 100644
--- a/docs/valint/help/valint_discard.md
+++ b/docs/valint/help/valint_discard.md
@@ -35,8 +35,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md
index a6368c654..ffd0925f0 100644
--- a/docs/valint/help/valint_download.md
+++ b/docs/valint/help/valint_download.md
@@ -12,9 +12,12 @@ Flags for `download` subcommand
| Short | Long | Description | Default |
| --- | --- | --- | --- |
+| | --beautify | Enhance the output using ANSI and Unicode characters | |
| | --folder-path | Folder to download the evidences of the given target | |
| -o | --format | Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | |
| -h | --help | help for download | |
+| -I | --initiative-report | Download Initiative result report | |
+| | --md | Output Initiative result markdown report file | |
| | --payload | path of the decoded payload | |
| | --ref | Evidence store refrence | |
| | --store | Select evidence store | |
@@ -31,8 +34,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md
index b7ce82e20..878314b9b 100644
--- a/docs/valint/help/valint_evidence.md
+++ b/docs/valint/help/valint_evidence.md
@@ -53,8 +53,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md
index 65c37a5dc..36cd5f636 100644
--- a/docs/valint/help/valint_list.md
+++ b/docs/valint/help/valint_list.md
@@ -42,8 +42,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md
index 6b7797c9c..9865db9df 100644
--- a/docs/valint/help/valint_slsa.md
+++ b/docs/valint/help/valint_slsa.md
@@ -19,6 +19,7 @@ Flags for `slsa` subcommand
| | --all-env | Attach all environment variables | |
| | --attest.config | Attestation config path | |
| | --attest.default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | |
+| | --bom | Upload SBOM evidence and by product | |
| | --build-type | Set build type | |
| | --builder-id | Set builder id | |
| | --by-product | Attach by product path | |
@@ -49,6 +50,10 @@ Flags for `slsa` subcommand
| | --predicate | Import predicate path | |
| | --pubkey | Public key path | |
| -y | --skip-confirmation | Skip Sigstore Confirmation | |
+| | --source | Git repository source for target | |
+| | --source-asset-id | Source asset id for Git source repo | |
+| | --source-asset-name | Source asset name for Git source repo | |
+| | --source-asset-platform | Source asset platform for Git source repo | |
| | --started-on | Set metadata started time (YYYY-MM-DDThh:mm:ssZ) | |
| | --statement | Import statement path | |
@@ -64,8 +69,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md
index 5be7bfdbc..81e2089a1 100644
--- a/docs/valint/help/valint_verify.md
+++ b/docs/valint/help/valint_verify.md
@@ -16,10 +16,12 @@ Flags for `verify` subcommand
| Short | Long | Description | Default |
| --- | --- | --- | --- |
+| | --all-evidence | Run all evidence verification | |
| | --attest.config | Attestation config path | |
| | --attest.default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | |
| -a | --attestation | Attestation for target | |
| | --base-image | Base image for the target | |
+| | --beautify | Enhance the output using ANSI and Unicode characters | |
| | --bom | Create target SBOM evidence | |
| | --bundle | Policy bundle uri/path (early-availability) | "https://github.com/scribe-public/sample-policies" |
| | --bundle-auth | Bundle repository authentication info, [format: 'username:password'] | |
@@ -42,16 +44,18 @@ Flags for `verify` subcommand
| | --git-commit | Git commit hash in the repository | |
| | --git-tag | Git tag in the repository | |
| -h | --help | help for verify | |
-| | --initiative | Run only rules with specified initiative | |
+| | --initiative | Initiative configuration file path (early-availability) | |
+| | --initiative-id | Initiative id | |
+| | --initiative-name | Initiative name | |
| -i | --input-format | Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | |
| | --key | x509 Private key path | |
| | --kms | Provide KMS key reference | |
+| | --md | Output Initiative result markdown report file | |
| | --oci | Enable OCI store | |
| -R | --oci-repo | Select OCI custom attestation repo | |
| | --pass | Private key password | |
| | --payload | path of the decoded payload | |
| | --platform | Select target platform, examples=windows/armv6, arm64 ..) | |
-| | --policy | Policy configuration file path (early-availability) | |
| | --provenance | Create target SLSA Provenance evidence | |
| | --pubkey | Public key path | |
| | --public-key | Public key path | |
@@ -61,6 +65,10 @@ Flags for `verify` subcommand
| | --skip-bundle | Skip bundle download | |
| -y | --skip-confirmation | Skip Sigstore Confirmation | |
| | --skip-report | Skip Policy report stage | |
+| | --source | SLSA Git repository source for target | |
+| | --source-asset-id | Source asset id for SLSA Git repository source | |
+| | --source-asset-name | Source asset name for SLSA Git repository source | |
+| | --source-asset-platform | Source asset platform for SLSA Git repository source | |
| | --uri | Default policy allowed uris | |
@@ -75,8 +83,9 @@ Flags for all `valint` subcommands
| -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | |
| | --deliverable | Mark as deliverable, options=[true, false] | |
| -e | --env | Environment keys to include in evidence | |
-| -G | --gate | Policy Gate name | |
-| | --input | Input Evidence target, format (\:\ or \:\:\) | |
+| | --gate-name | Policy Gate name | |
+| -G | --gate-type | Policy Gate type | |
+| | --input | Input Evidence target, format (\:\ or \:\:\) | |
| -L | --label | Add Custom labels | |
| | --level | Log depth level, options=[panic fatal error warning info debug trace] | |
| | --log-context | Attach context to all logs | |
diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md
index cfe4a3c83..9f4a7d97d 100644
--- a/docs/valint/policy-results.md
+++ b/docs/valint/policy-results.md
@@ -49,6 +49,7 @@ The results of the control verification are presented in a table format. The tab
* `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open".
* `SUMMARY`: The reason for the rule result.
* `TARGET`: The target asset of the rule verification.
+* `CONTROL RESULT`: The result of the control verification. Every rule with the "error" level must pass for the control to pass. If at least one rule fails, the control fails. If no such rule fails but at least one rule returns "open," the control is considered "open." If all rules pass, the control passes. Rules with the "warning" or "note" levels do not affect the control result.
The results of the initiative verification are also presented in a table format. The table consists of the following columns:
@@ -56,6 +57,7 @@ The results of the initiative verification are also presented in a table format.
* `CONTROL NAME`: The name of the control.
* `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`.
* `RESULT`: The result of the control verification. It can be "pass", "fail" or "open".
+* `INITIATIVE RESULT`: The result of the initiative verification. If at least one control fails, the initiative fails. If no control fails but at least one control returns "open," the initiative is considered "open." If all controls pass, the initiative passes.
## Example
diff --git a/docusaurus.config.js b/docusaurus.config.js
index 2e9fcbf6b..8a81bd0dd 100644
--- a/docusaurus.config.js
+++ b/docusaurus.config.js
@@ -90,6 +90,7 @@ const config = {
"guides/secure-sfw-slsa/README.md",
"guides/secure-sfw-slsa/slsa-lvl-1.md",
"guides/secure-sfw-slsa/slsa-lvl-2.md",
+ "guides/secure-sfw-slsa/slsa-on-scale.md",
"guides/secure-sfw-slsa/slsa-lvl-3.md",
"guides/secure-sfw-slsa/customizing-provenance.md",
"guides/secure-sfw-slsa/basic-examples.md",
diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh
index 1c3e0fbd5..6b0f9af98 100644
--- a/scripts/sync_docs.sh
+++ b/scripts/sync_docs.sh
@@ -194,6 +194,10 @@ import_action-installer() {
import_action-slsa() {
import_action "action-slsa"
}
+import_action-evidence() {
+ repo="action-evidence"
+ import_action ${repo}
+}
export_action-bom() {
repo="action-bom"
@@ -215,6 +219,12 @@ export_action-slsa() {
export_action_extra ${repo}
}
+export_action-evidence() {
+ repo="action-evidence"
+ export_action ${repo}
+ export_action_extra ${repo}
+}
+
import_valint-pipe() {
repo="valint-pipe"
repo_dir="${submodules_dir}/${repo}"
@@ -340,9 +350,26 @@ sidebar_position: 4
export_azure-tasks() {
repo="azure-tasks"
repo_dir="${submodules_dir}/${repo}"
- dst_dir="docs/integrating-scribe/ci-integrations"
-
- sed -n '/^# Azure Pipelines Task/,$p' ${dst_dir}/azure.md > ${repo_dir}/README.md
+ src="docs/integrating-scribe/ci-integrations/azure.md"
+ dst="${repo_dir}/README.md"
+
+ # 1) grab the title from front-matter
+ title=$(grep '^title:' "$src" | sed 's/^title:[[:space:]]*//')
+
+ # 2) write out a new README:
+ {
+ # H1 from title
+ echo "# $title"
+ echo
+
+ # skip until after the second '---' line, then print everything
+ awk 'c<2 {
+ if (/^---/) { c++; }
+ next
+ }
+ { print }
+ ' "$src"
+ } > "$dst"
}
import_cli() {