From 8a1959b8e04e25a91dd7e3a129f599d6ebfbcade Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 9 Jun 2025 09:52:19 +0300 Subject: [PATCH 01/25] valint update --- docs/guides/secure-sfw-slsa/basic-examples.md | 62 +++++ .../secure-sfw-slsa/customizing-provenance.md | 220 ++++++++++-------- 2 files changed, 191 insertions(+), 91 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/basic-examples.md b/docs/guides/secure-sfw-slsa/basic-examples.md index 84acbd349..02bd9b692 100644 --- a/docs/guides/secure-sfw-slsa/basic-examples.md +++ b/docs/guides/secure-sfw-slsa/basic-examples.md @@ -115,6 +115,53 @@ valint slsa docker-archive:busybox_archive.tar ``` +
+ Generate and attach source SBOM evidence reference + +Generate an SBOM for the Git repository and attach it to the SLSA provenance as a by-product evidence reference. + +```bash +valint slsa --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0 +``` + +
+ +
+ Generate and attach target image SBOM evidence reference + +Generate an SBOM for the primary image target and attach it to the provenance. + +```bash +valint slsa alpine:latest --bom +``` + +
+ +
+ Combine source and image SBOM evidence references + +Attach SBOMs for both the source repository and the image in a single provenance document. + +```bash +valint slsa alpine:latest \ + --bom \ + --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0 +``` + +
+ +
+ Attach third-party scan evidence with --input + +Include external scan results (e.g., a Trivy JSON report) as an additional by-product evidence reference. + +```bash +valint slsa alpine:latest --input trivy:scan_result.json +``` + +
+ +
Directory target @@ -186,6 +233,8 @@ valint verify busybox:latest -i attest-slsa ```
+ +
Attest and verify Git repository target @@ -259,3 +308,16 @@ valint verify [target] -i [attest-slsa, statement-slsa] -f \
+ + + + + + + + + + + + + diff --git a/docs/guides/secure-sfw-slsa/customizing-provenance.md b/docs/guides/secure-sfw-slsa/customizing-provenance.md index f13678b4f..e5162c2c4 100644 --- a/docs/guides/secure-sfw-slsa/customizing-provenance.md +++ b/docs/guides/secure-sfw-slsa/customizing-provenance.md @@ -1,109 +1,147 @@ --- -sidebar_label: "Customizing Provenance" + +sidebar\_label: "Customizing Provenance" title: "Customizing the Provenance Document" -sidebar_position: 5 -toc_min_heading_level: 2 -toc_max_heading_level: 5 ---- +sidebar\_position: 5 +toc\_min\_heading\_level: 2 +toc\_max\_heading\_level: 5 +--------------------------- + +Use the following flags to tailor the provenance document to your needs. + +## Include external by-products + +| Flag | Purpose | Example | +| --------------------- | -------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | +| `--by-product ` | Attach the contents of a file (e.g., log, SBOM) as a by-product | `valint slsa busybox:latest --by-product /path/to/file.txt` | +| `--components ` | When the by-product is an SBOM, include finer-grained components such as `layers`, `packages`, or `files` (comma‑separated list) | `valint slsa busybox:latest --components layers,packages,files` | + +## Override key provenance fields + +| Flag | Field | Example | +| --------------- | ---------------------------- | ------------------------------------ | +| `--invocation` | Invocation ID | `--invocation my_invocation` | +| `--build-type` | Build type | `--build-type docker` | +| `--builder-id` | Builder ID | `--builder-id 12345` | +| `--started-on` | Build start time (RFC 3339) | `--started-on 2023-07-25T15:30:00Z` | +| `--finished-on` | Build finish time (RFC 3339) | `--finished-on 2023-07-25T16:00:00Z` | -You can customize the provenance object by using the following flags: -* `--by-product` includes the contents of an external file, such as a log file or an SBOM. -For example, -```valint slsa busybox:latest --by-product /path/to/my_file.txt``` -* `--components` extend `byproduct` when it is an SBOM with detailed target components such as layers packages, and files. -For example, -```valint slsa busybox:latest --components layers,packages,files``` -* Set specific provenance fields such as: - * `--invocation`: invocation ID - * `--build-type`: build type - * `--builder-id`: builder ID - * `--started-on`: build start time - * `--finished-on`: build finish time -For Example, +**Full example** + +```bash +valint slsa busybox:latest \ + --source git:https://github.com/my_org/my_repo.git \ + --git-tag v1.0.0 \ + --invocation my_invocation \ + --build-type docker \ + --builder-id 12345 \ + --started-on 2023-07-25T15:30:00Z \ + --finished-on 2023-07-25T16:00:00Z ``` -valint slsa busybox:latest --invocation my_invocation --build-type docker --builder-id 12345 --started-on 2023-07-25T15:30:00Z --finished-on 2023-07-25T16:00:00Z + +## Add extra evidence (by-product references) + +| Flag | Purpose | +| -------------------- | ----------------------------------------------------------------------------------------------- | +| `--source ` | Generate an SBOM for the specified Git repository | +| `--bom` | Generate an SBOM for the primary container‑image target | +| `--input ` | Generate evidence for any additional target (extra Git repo, image, or third‑party tool output) | + +```bash +valint bom \ + --source https://github.com/your-org/your-repo.git \ + --bom \ + --input ghcr.io/your-org/extra-image:latest ``` -* `-env` or `--all-env` adds environment variables to the `internaParameters`. -For example, -```yaml -#Attach all environment variables + +## Add environment variables + +* `--all-env` – Attach **all** environment variables to `internalParameters`. +* `--env ` – Attach a **specific** variable. + +```bash +# Attach all environment variables valint slsa busybox:latest --all-env -# Attach a specific environment variable + +# Attach a single variable valint slsa busybox:latest --env MY_ENV ``` -* `--external` adds parameters to the `externalParameters` in the form of key=value pairs. -For example, -```valint slsa busybox:latest --external my_custom_param=my_custom_value``` -* `--predicate` adds a full or partial SLSA provenance predicate. -For example, -```valint slsa busybox:latest --predicate custom.predicate.json``` -Where `custom.predicate.json` specifies custom `externalParameters`, `builderDependencies`, and metadata. + +## Extend external parameters + +* `--external ` – Add key–value pairs to `externalParameters`. + +```bash +valint slsa busybox:latest --external my_custom_param=my_custom_value +``` + +## Supply a custom predicate or statement + +| Flag | Purpose | Example | +| -------------------- | ------------------------------------------ | -------------------------------------------------------------- | +| `--predicate ` | Merge a full or partial SLSA **predicate** | `valint slsa busybox:latest --predicate custom.predicate.json` | +| `--statement ` | Merge a full or partial SLSA **statement** | `valint slsa busybox:latest --statement custom.statement.json` | + +### Predicate template (`custom.predicate.json`) + ```json { - "buildDefinition": { - "externalParameters": { - "custom_external": { - "digest": { - "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" - }, - "name": "build-environment", - "value": "production", - "uri": "https://company.com/my_repo/event" - } - } - }, - "runDetails": { - "builder": { - "builderDependencies": [ - { - "uri": "https://github.com/.github/reusable_build.yaml", - "name": "my_tool", - "annotations": { - "vendor": "My company Inc", - "version": "1.0" - } - } - ] - }, - "metadata": { - "invocationID": "https://company.com/my_repo/build.sh", - "startedOn": "2023-07-25T15:30:00Z", - "finishedOn": "2023-07-25T16:00:00Z" - } - } + "buildDefinition": { + "externalParameters": { + "custom_external": { + "name": "build-environment", + "value": "production", + "uri": "https://company.com/my_repo/event", + "digest": { "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" } + } + } + }, + "runDetails": { + "builder": { + "builderDependencies": [ + { + "uri": "https://github.com/.github/reusable_build.yaml", + "name": "my_tool", + "annotations": { "vendor": "My company Inc", "version": "1.0" } + } + ] + }, + "metadata": { + "invocationID": "https://company.com/my_repo/build.sh", + "startedOn": "2023-07-25T15:30:00Z", + "finishedOn": "2023-07-25T16:00:00Z" + } + } } -``` -* `--statement` adds a full or partial SLSA provenance statement. -For example, -```valint slsa busybox:latest --statement custom.statement.json``` -The following `custom.predicate.json` includes custom subject and byproducts. +``` + +### Statement template (`custom.statement.json`) + ```json { - "_type": "https://in-toto.io/Statement/v0.1", - "predicateType": "https://slsa.dev/provenance/v1", - "subject": [ - { - "name": "index.docker.io/my_image", - "digest": { - "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8" - } - } - ], - "predicate": { - "runDetails": { - "byproducts": [ - { + "_type": "https://in-toto.io/Statement/v0.1", + "predicateType": "https://slsa.dev/provenance/v1", + "subject": [ + { + "name": "index.docker.io/my_image", + "digest": { + "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8" + } + } + ], + "predicate": { + "runDetails": { + "byproducts": [ + { "uri": "pkg:docker/index.docker.io/my_image:latest@sha256:7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18?index=0", "digest": { - "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18" + "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18" }, "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", - "annotations": { - "tag": "v0.0.1" - } - } - ] - } - } + "annotations": { "tag": "v0.0.1" } + } + ] + } + } } -``` \ No newline at end of file +``` From 9660677d1b8dcbc1e463d1658d409c6b6bd0bec5 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Jun 2025 09:30:36 +0300 Subject: [PATCH 02/25] update generated configuration docs --- docs/configuration/initiatives/index.md | 6 +- .../initiatives/rules/generic/3rd-pty.md | 79 +++++ .../repository/approvals-policy-check.md | 59 ++++ .../rules/multievidence/_category_.json | 4 - .../rules/multievidence/files_integrity.md | 43 --- docs/configuration/initiatives/sspb-gh.md | 280 ++++++++++++++++++ .../initiatives/{sspb.md => sspb-gl.md} | 32 +- 7 files changed, 452 insertions(+), 51 deletions(-) create mode 100644 docs/configuration/initiatives/rules/generic/3rd-pty.md create mode 100644 docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md delete mode 100644 docs/configuration/initiatives/rules/multievidence/_category_.json delete mode 100644 docs/configuration/initiatives/rules/multievidence/files_integrity.md create mode 100644 docs/configuration/initiatives/sspb-gh.md rename docs/configuration/initiatives/{sspb.md => sspb-gl.md} (85%) diff --git a/docs/configuration/initiatives/index.md b/docs/configuration/initiatives/index.md index 3981263ec..30035d07a 100644 --- a/docs/configuration/initiatives/index.md +++ b/docs/configuration/initiatives/index.md @@ -10,7 +10,8 @@ | [SLSA L1 Framework](/docs/configuration/initiatives/slsa.l1.md) | Evaluate SLSA Level 1 | | [SLSA L2 Framework](/docs/configuration/initiatives/slsa.l2.md) | Evaluate SLSA Level 2 | | [SSDF Client Initiative](/docs/configuration/initiatives/ssdf.md) | Evaluate PS rules from the SSDF initiative | -| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb.md) | Blueprint for secure pipelines - Gitlab | +| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gl.md) | Blueprint for secure pipelines - Gitlab | +| [Secure Software Pipeline Blueprint](/docs/configuration/initiatives/sspb-gh.md) | Blueprint for secure pipelines - GitHub | ## Rules @@ -32,7 +33,6 @@ | Rule Name | Description | |-----------|-------------| -| [Verify File Integrity](/docs/configuration/initiatives/rules/multievidence/files_integrity.md) | Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. | | [Verify Image Labels](/docs/configuration/initiatives/rules/images/verify-labels.md) | Verify specified labels key-value pairs exist in the image. | | [Forbid Large Images](/docs/configuration/initiatives/rules/images/forbid-large-images.md) | Verify the image size is below the specified threshold. | | [Disallow Container Shell Entrypoint](/docs/configuration/initiatives/rules/images/restrict-shell-entrypoint.md) | Verify the container image disallows shell entrypoint. | @@ -92,6 +92,7 @@ | Rule Name | Description | |-----------|-------------| +| [3rd Party Scanner Violations](/docs/configuration/initiatives/rules/generic/3rd-pty.md) | Limit allowed violations in 3rd party scanner reports | | [Required Trivy Evidence Exists](/docs/configuration/initiatives/rules/generic/trivy-exists.md) | Verify required Trivy evidence exists | | [Required Generic Evidence Exists](/docs/configuration/initiatives/rules/generic/evidence-exists.md) | Verify required evidence exists. | | [Generic Artifact Signed](/docs/configuration/initiatives/rules/generic/artifact-signed.md) | Verify required evidence is signed. | @@ -128,6 +129,7 @@ | Rule Name | Description | |-----------|-------------| +| [Pull request approval policy check for GitHub repository](/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy | | [Verify secret scanning.](/docs/configuration/initiatives/rules/github/repository/validity-checks.md) | Verify both `secret_scanning_validity_checks` and `security_and_analysis` are set in GitHub organization and all the repositories. | | [Verify Dependabot security updates setting](/docs/configuration/initiatives/rules/github/repository/dependabot.md) | Verify Dependabot security updates are configured in the GitHub repository. | | [Verify Repository Is Private](/docs/configuration/initiatives/rules/github/repository/repo-private.md) | Verify the GitHub repository is private. | diff --git a/docs/configuration/initiatives/rules/generic/3rd-pty.md b/docs/configuration/initiatives/rules/generic/3rd-pty.md new file mode 100644 index 000000000..abd484628 --- /dev/null +++ b/docs/configuration/initiatives/rules/generic/3rd-pty.md @@ -0,0 +1,79 @@ +--- +sidebar_label: 3rd Party Scanner Violations +title: 3rd Party Scanner Violations +--- +# 3rd Party Scanner Violations +**Type:** Rule +**ID:** `3rd-pty` +**Source:** [v2/rules/generic/3rd-pty.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.yaml) +**Rego Source:** [3rd-pty.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/generic/3rd-pty.rego) +**Labels:** 3rd-pty, SCA + +Limit allowed violations in 3rd party scanner reports + +:::note +This rule requires Generic Statement. See [here](/docs/valint/generic) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: generic/3rd-pty@v2 +with: + severities: + - Critical + - High + titles: + - "CVE-2023-1234" + - "CVE-2023-5678" + - "CVE-2025" + cwes: + - "CWE-123" + - "CWE-456" + descriptions: + - "Vulnerability in component X" + - "Misconfiguration in component Y" + descriptions_to_ignore: + - "False positive in component Z" + - "Known issue in component A" + component_names: + - library-x + - library-y +``` + +## Mitigation +Restricts the number and type of violations from third-party scanner reports, helping to enforce organizational security and compliance policies. + + +## Description +This rule verifies that the number and type of violations reported by third-party scanners are within allowed thresholds. +It checks the evidence for findings matching the specified severities, titles, CWEs, descriptions, and component names. +Violations are recorded if any findings exceed the configured limits or match blocklisted criteria. + +### **Evidence Requirements** +- Evidence must be provided by a supported third-party scanner and formatted as generic findings (see the `--parser` flag in `valint`). + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/finding/v0.1 | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| severities | array | False | List of severities to filter by. | +| titles | array | False | List of titles to filter by. | +| cwes | array | False | List of CWE identifiers to filter by. | +| descriptions | array | False | List of descriptions to filter by. | +| descriptions_to_ignore | array | False | List of descriptions to ignore from findings. | +| component_names | array | False | List of component names to filter by. | + diff --git a/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md b/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md new file mode 100644 index 000000000..21ebba0c3 --- /dev/null +++ b/docs/configuration/initiatives/rules/github/repository/approvals-policy-check.md @@ -0,0 +1,59 @@ +--- +sidebar_label: Pull request approval policy check for GitHub repository +title: Pull request approval policy check for GitHub repository +--- +# Pull request approval policy check for GitHub repository +**Type:** Rule +**ID:** `github-repo-pr-approval` +**Source:** [v2/rules/github/repository/approvals-policy-check.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.yaml) +**Rego Source:** [approvals-policy-check.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/github/repository/approvals-policy-check.rego) +**Labels:** Blueprint, GitHub, Repository + +Verify the repository's pull request approval policy + +:::note +This rule requires Github Repository Discovery Evidence. See [here](/docs/platforms/discover#github-discovery) for more details. +::: +:::tip +Signed Evidence for this rule **IS NOT** required by default but is recommended. +::: +:::warning +Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. +::: + +## Usage example + +```yaml +uses: github/repository/approvals-policy-check@v2 +with: + approvals_required_min: 1 +``` + +## Mitigation +Ensure that the repository's PR approval policy complies with requirements to prevent unauthorized merges. + + +## Description +This rule ensures that the repository's PR approval policy complies with requirements. +It performs the following steps: + +1. Checks the settings of the GitHub repository. +2. Verifies that the repository's PR approval policy requires a minimum number of approvals as specified in the 'approvals_required_min' field. + +**Evidence Requirements:** +- Evidence must be provided by the Scribe Platform's CLI tool through scanning GitHub repository resources. + +## Evidence Requirements +| Field | Value | +|-------|-------| +| signed | False | +| content_body_type | generic | +| target_type | data | +| predicate_type | http://scribesecurity.com/evidence/discovery/v0.1 | +| labels | - platform=github
- asset_type=repository | + +## Input Definitions +| Parameter | Type | Required | Description | +|-----------|------|----------|-------------| +| approvals_required_min | number | True | Minimum number of approvals required for pull requests. | + diff --git a/docs/configuration/initiatives/rules/multievidence/_category_.json b/docs/configuration/initiatives/rules/multievidence/_category_.json deleted file mode 100644 index 9696ec52e..000000000 --- a/docs/configuration/initiatives/rules/multievidence/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "Multievidence", - "position": 1 -} \ No newline at end of file diff --git a/docs/configuration/initiatives/rules/multievidence/files_integrity.md b/docs/configuration/initiatives/rules/multievidence/files_integrity.md deleted file mode 100644 index 6ad76cd05..000000000 --- a/docs/configuration/initiatives/rules/multievidence/files_integrity.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -sidebar_label: Verify File Integrity -title: Verify File Integrity ---- -# Verify File Integrity -**Type:** Rule -**ID:** `file-integrity` -**Source:** [v2/rules/multievidence/files_integrity.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.yaml) -**Rego Source:** [files_integrity.rego](https://github.com/scribe-public/sample-policies/blob/main/v2/rules/multievidence/files_integrity.rego) -**Labels:** SBOM - -Verify the checksum of each file in one SBOM matches the checksum in a second SBOM. - -:::note -This rule requires Signed Image SBOM. See [here](/docs/valint/sbom) for more details. -::: -:::tip -Signed Evidence for this rule **IS** required by default. -::: -:::warning -Rule requires evaluation with a target. Without one, it will be **disabled** unless the `--all-evidence` flag is provided. -::: - -## Usage example - -```yaml -uses: multievidence/files_integrity@v2 -``` - -## Evidence Requirements -| Field | Value | -|-------|-------| -| signed | True | -| content_body_type | cyclonedx-json | -| target_type | container | -| labels | - new_evidence | - -## Rule Parameters (`with`) -| Parameter | Default | -|-----------|---------| -| ref_sbom | `{{ .Env.REF_SBOM_DATA }}` | -| path_prefix | pkg:file/ | - diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md new file mode 100644 index 000000000..de91de6ad --- /dev/null +++ b/docs/configuration/initiatives/sspb-gh.md @@ -0,0 +1,280 @@ +--- +sidebar_label: Secure Software Pipeline Blueprint +title: Secure Software Pipeline Blueprint +--- +# Secure Software Pipeline Blueprint +**Type:** Initiative +**ID:** `SSPB-GH` +**Version:** `1.0.0` +**Bundle-Version:** `v2` +**Source:** [v2/initiatives/sspb-gh.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb-gh.yaml) +**Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline + +Blueprint for secure pipelines - GitHub + +## **Description** + +This initiative defines a set of best practices and technical guidelines designed to safeguard every stage of the software delivery process—from code development and build, to testing and production deployment. It emphasizes the importance of ensuring code integrity, authenticating build artifacts, and continuously monitoring system changes to mitigate the risk of supply chain attacks. The framework is adaptable to various environments and aligned with industry standards, providing organizations with actionable steps to enhance their overall security posture. + +## Controls Overview + +| Control Name | Control Description | Mitigation | +|--------------|---------------------|------------| +| [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | +| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by GitHub | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | +| [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. | +| [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | +| [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | +| [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | +| [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | + +## Evidence Defaults + +| Field | Value | +|-------|-------| +| signed | True | + +--- + +# Detailed Controls + +## [CTL-1] Restrict administrative access to CI/CD tools + +Restrict administrative access to CI/CD tools + + +### Mitigation +Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. + +### **Description** + +It's important to ensure that only authorized persons can make administrative changes to the CI/CD system. If an unauthorized person gains access, they could modify pipeline definitions and subvert other controls. + +Both host and application-layer access to CI/CD tools should be protected with multi-factor authentication. + +> :skull: Instead of manipulating code, attackers may target the CI/CD pipeline itself, leading to undetected breaches and long-term damage. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [max-admins](rules/github/org/max-admins.md) | [max-admins](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | + +## [CTL-2] Only accept commits signed with a developer GPG key + +The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by GitHub + + +### Mitigation +Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. + +### **Description** + +Unsigned code commits are difficult to trace and pose a risk to the integrity of the codebase. Requiring commits to be signed with a developer GPG key ensures nonrepudiation and increases the burden on attackers. + +> :skull: Attackers may exploit unsigned commits by stealing credentials or infecting developer machines, allowing them to inject malicious code. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [disallow-committing-unsigned](rules/github/repository/signed-commits.md) | [disallow-committing-unsigned](rules/github/repository/signed-commits.md) | Verify all commits are signed in a repository attestation. | +| [all-commits-verified](rules/github/repository/check-signed-commits.md) | [all-commits-verified](rules/github/repository/check-signed-commits.md) | Verify all commits in the GitHub repository are signed. | +| [web-commit-signoff-required](rules/github/repository/web-commit-signoff.md) | [web-commit-signoff-required](rules/github/repository/web-commit-signoff.md) | Verify contributors sign off on commits to the GitHub repository through the GitHub web interface. | + +## [CTL-3] Automation access keys expire automatically + +Automation access keys expire automatically + + +### Mitigation +Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. + +### **Description** + +Ensuring that access keys used by automation expire periodically reduces the risk when keys are compromised. + +> :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| demodata/data@experimental | demodata/data@experimental | | + +## [CTL-4] Reduce automation access to read-only + +Reduce automation access to read-only + + +### Mitigation +Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. + +### **Description** + +CI systems should have read access only to source code repositories to limit the risk from compromised automation accounts. + +> :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| demodata/data@experimental | demodata/data@experimental | | + +## [CTL-5] Only dependencies from trusted registries can be used + +Only dependencies from trusted registries can be used + + +### Mitigation +Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. + +### **Description** + +Modern software dependency managers, including `npm`, `maven`, `Nuget`, `pip`, and others, rely on declaring the dependencies required for the application and then fetching them at build time. By configuring the dependency manager to only allow connections to an authorized list of registries, these attacks can be blunted by keeping malicious packages in the public registries from entering the pipeline. + +The trusted repository can also ensure that security policies are enforced on dependencies. For example, trusted repositories could ensure that only dependencies that are free of critical or high vulnerabilities are used. Implementing a control at the repository that returns an error when a component with known vulnerabilities is requested helps to reduce the chances of an attack against a known vulnerability downstream. + +Teams should be aware of implicit runtime dependencies as well as explicit buildtime dependencies (see Control 14). + +> :skull: +> Attackers can quickly spread malicious code through dependencies. Attackers might insert malicious code that is then incorporated into the application’s manifest by stealing credentials en masse for sophisticated, targeted thefts. +> Hackers can also target mistakes and oversights through _typo-squatting_ and _dependency confusion_. Adversaries go to great ends to publish packages under a trusted name or even with common typos so that they are included in builds. +> All of the stakes are raised exponentially when public repositories are used. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| demodata/data@experimental | demodata/data@experimental | | + +## [CTL-6] Any critical or high severity vulnerability breaks the build + +Any critical or high severity vulnerability breaks the build + + +### Mitigation +Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. + +### **Description** + +Supply chain attacks may introduce code vulnerabilities. Using SAST and SCA to identify serious security issues and failing the build prevents insecure code from being merged. + +> NOTE: This control complements Control-4 by ensuring no critical vulnerabilities are ignored. + +Early detection reduces remediation costs, but also requires a well-defined vulnerability exception process. + +> :skull: Vulnerabilities, if undetected, can proliferate quickly and cause widespread damage. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CTL-8] Validate artifact digest + +Validate artifact digest + + +### Mitigation +Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. + +### **Description** + +Before deployment, an artifact’s digest is checked against the expected value to confirm it has not been compromised. + +> :skull: Attackers often attempt to alter artifacts; validating the digest helps ensure integrity. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [require-sbom](rules/sbom/evidence-exists.md) | [Require SBOM Existence](rules/sbom/evidence-exists.md) | Verify the SBOM exists as evidence. | + +## [CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + +Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged + + +### Mitigation +Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. + +### **Description** + +Requiring multiple code reviews and successful tests helps ensure that no changes are merged without proper oversight. + +> :skull: Without proper reviews, attackers can insert malicious changes; this control mitigates that risk. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [merge-approval](rules/github/repository/approvals-policy-check.md) | [merge-approval](rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy | + +## [CTL-11] Available container images don’t have any high or critical vulnerabilities + +Available container images don’t have any high or critical vulnerabilities + + +### Mitigation +Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. + +### **Description** + +Container images must be scanned before deployment to prevent the inclusion of images with serious vulnerabilities. + +> :skull: Vulnerable containers can be a major attack vector; this control helps prevent their use. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CTL-12] Validate artifact signatures and digests + +Validate artifact signatures and digests + + +### Mitigation +Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. + +### **Description** + +Validating the signature and digest of an artifact ensures that it has not been altered between testing and deployment. + +> :skull: This control helps prevent the deployment of artifacts that may have been modified by attackers. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | + +## [CTL-13] Scan deployed images in production + +Scan deployed images in production + + +### Mitigation +Continuously monitor and scan production images to ensure ongoing compliance with security standards. + +### **Description** + +Production images should be validated to ensure that controls enforced during earlier stages continue to be effective in production. + +> :skull: Ongoing monitoring helps detect any security issues that may emerge post-deployment. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | +| [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | diff --git a/docs/configuration/initiatives/sspb.md b/docs/configuration/initiatives/sspb-gl.md similarity index 85% rename from docs/configuration/initiatives/sspb.md rename to docs/configuration/initiatives/sspb-gl.md index 5a0380551..e9026adfe 100644 --- a/docs/configuration/initiatives/sspb.md +++ b/docs/configuration/initiatives/sspb-gl.md @@ -4,10 +4,10 @@ title: Secure Software Pipeline Blueprint --- # Secure Software Pipeline Blueprint **Type:** Initiative -**ID:** `SSPB` +**ID:** `SSPB-GL` **Version:** `1.0.0` **Bundle-Version:** `v2` -**Source:** [v2/initiatives/sspb.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb.yaml) +**Source:** [v2/initiatives/sspb-gl.yaml](https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/sspb-gl.yaml) **Help:** https://github.com/Venafi/blueprint-securesoftwarepipeline Blueprint for secure pipelines - Gitlab @@ -24,6 +24,7 @@ This initiative defines a set of best practices and technical guidelines designe | [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | | [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | | [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | +| [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. | | [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | | [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | | [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | @@ -124,6 +125,33 @@ CI systems should have read access only to source code repositories to limit the |---------|-----------|------------------| | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | [disallowed-token-scope](rules/gitlab/org/forbid-token-scopes.md) | Verify no GitLab organization tokens have disallowed scopes. | +## [CTL-5] Only dependencies from trusted registries can be used + +Only dependencies from trusted registries can be used + + +### Mitigation +Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. + +### **Description** + +Modern software dependency managers, including `npm`, `maven`, `Nuget`, `pip`, and others, rely on declaring the dependencies required for the application and then fetching them at build time. By configuring the dependency manager to only allow connections to an authorized list of registries, these attacks can be blunted by keeping malicious packages in the public registries from entering the pipeline. + +The trusted repository can also ensure that security policies are enforced on dependencies. For example, trusted repositories could ensure that only dependencies that are free of critical or high vulnerabilities are used. Implementing a control at the repository that returns an error when a component with known vulnerabilities is requested helps to reduce the chances of an attack against a known vulnerability downstream. + +Teams should be aware of implicit runtime dependencies as well as explicit buildtime dependencies (see Control 14). + +> :skull: +> Attackers can quickly spread malicious code through dependencies. Attackers might insert malicious code that is then incorporated into the application’s manifest by stealing credentials en masse for sophisticated, targeted thefts. +> Hackers can also target mistakes and oversights through _typo-squatting_ and _dependency confusion_. Adversaries go to great ends to publish packages under a trusted name or even with common typos so that they are included in builds. +> All of the stakes are raised exponentially when public repositories are used. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| demodata/data@experimental | demodata/data@experimental | | + ## [CTL-6] Any critical or high severity vulnerability breaks the build Any critical or high severity vulnerability breaks the build From c904f2af89f72a77017de7252c3e2d1b66283880 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 12 Jun 2025 12:49:19 +0300 Subject: [PATCH 03/25] buildah --- docusaurus.config.js | 1 + 1 file changed, 1 insertion(+) diff --git a/docusaurus.config.js b/docusaurus.config.js index 09bc040e5..b2df3ed72 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,6 +93,7 @@ const config = { "guides/secure-sfw-slsa/README.md", "guides/secure-sfw-slsa/slsa-lvl-1.md", "guides/secure-sfw-slsa/slsa-lvl-2.md", + "guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md", "guides/secure-sfw-slsa/slsa-lvl-3.md", "guides/secure-sfw-slsa/customizing-provenance.md", "guides/secure-sfw-slsa/basic-examples.md", From 62ff512bc464dd31c311ae9f24659dcb9e5b8726 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Thu, 12 Jun 2025 17:08:48 +0300 Subject: [PATCH 04/25] removed chatgpt response text --- docs/platforms/hooks.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/platforms/hooks.md b/docs/platforms/hooks.md index 2cc09321f..8e8fb7950 100644 --- a/docs/platforms/hooks.md +++ b/docs/platforms/hooks.md @@ -59,8 +59,6 @@ When running hooks, `platforms` provides useful environment variables: - `NAMESPACE`: Target asset namespace (avilable for `k8s`). - `POD`: Target asset namespace (avilable for `k8s`). -Of course! Here's a cleaner, more formal rephrasing for the Kubernetes (K8s) parts you added, while keeping the structure and meaning you intended: - #### CI and Git Context These variables represent the CI and Git environment in which platforms is executed: From b3aecb9b2e299779b94c22beb64a22a96b662d2e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Fri, 13 Jun 2025 12:42:56 +0300 Subject: [PATCH 05/25] debug --- .../secure-sfw-slsa/slsa-lvl-2-on-scale.md | 949 ++++++++++++++++++ 1 file changed, 949 insertions(+) create mode 100644 docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md diff --git a/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md new file mode 100644 index 000000000..cae1424d5 --- /dev/null +++ b/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md @@ -0,0 +1,949 @@ +--- + +sidebar\_label: "SLSA Provenance at Scale" +title: "SLSA L1 & L2 Provenance from Logs" +sidebar\_position: 5 +toc\_min\_heading\_level: 2 +toc\_max\_heading\_level: 5 +--------------------------- + +Scribe supports automatic generation of [SLSA Level 2](https://slsa.dev/provenance/v1.0) provenance for container images at scale — without modifying your pipelines. Instead of injecting provenance generators directly into your CI, this method leverages build log analysis from GitHub workflows and other supported platforms. + +This complements the existing SLSA policy engine in Scribe Hub and is ideal for organizations that want to validate image builds across multiple repositories retroactively or externally. + +## 🔍 Overview + +At the heart of this feature is the automated creation of rich, SLSA Level 2-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: + +* The source code repository and its history (via GitHub SCM APIs) +* The container image build targets (e.g., image digests, tags, IDs) +* Workflow metadata from the CI system (timestamps, runners, inputs) +* Associated SBOMs — linking both the source and built image artifacts as evidence + +By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. + +This enables producers to: + +* Analyze GitHub Actions logs across many repositories +* Discover image builds (Docker, Buildah, Podman) +* Extract critical build metadata automatically +* Generate valid in-toto SLSA provenance statements (Level 2) +* Export evidence locally or directly into the Scribe Hub +* Attach results under the correct repository or workflow run + +This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. + +## ✅ When to Use + +* You want SLSA provenance but cannot modify the CI pipelines +* You want to verify builds retroactively (e.g., last 30 days) +* You operate across 10s or 100s of repositories +* You want SLSA Level 2 as structured, independently validated evidence + +## 🧪 Example Usage L1 + +```bash +platforms discover github \ + --scope.organization scribe-security \ + --scope.repository "valint" \ + --repository.mapping *::valint_slsa::v1 \ + --commit.skip \ + --slsa-enable \ + --slsa.tags-only \ + --slsa.latest-only +``` + +## 🧪 Example Usage L2 + +This simplified command will: + +* Scan recent GitHub workflows for the `scribe-security` organization +* Match release workflows from `*valint*` repositories +* Extract image build metadata from logs +* Generate SLSA Level 2 provenance +* Include links to source and image SBOMs + +This command will: + +* Query workflows named “release” on the `main` branch of all `*valint*` repositories +* Discover image builds based on log patterns (e.g., docker/buildah/podman) +* Create an in-toto SLSA v1.0 provenance statement for each tag +* Export that evidence under the appropriate product key using the mapping + +## 📂 Key Flags + +| Flag | Description | +| ---------------------- | -------------------------------------------------------------- | +| `--slsa-enable` | Enable SLSA provenance extraction and export | +| `--slsa.tags-only` | Limit to tag-based builds only | +| `--slsa.latest-only` | Limit to only latest image for each tag | +| `--slsa.scope.*` | Narrow provenance to branches, tags, workflows, or image names | +| `--repository.mapping` | Assign product key for evidence export | +| `--skip-cache` | Force recomputation even if cached results exist | + +## 🚧 What's Collected in the Provenance Attestation +* **`subject`**: Identifies the primary **output artifact(s)** of your build, including the image reference and its cryptographic digest. This unequivocally links the attestation to the artifact it describes. +* **`predicate.buildDefinition`**: Describes **how the artifact was built**. This includes: + * **Build System Details**: Information about the CI/CD platform used (e.g., GitHub Actions workflow file, specific job, and run ID). + * **Source Code**: The exact Git repository URL, commit SHA, and branch/tag that was built. + * **Build Parameters**: Any external inputs or internal parameters that influenced the build, such as build arguments and a list of used secret names (without their values). + * **Resolved Dependencies**: A comprehensive list of all inputs consumed by the build, including base images (Image SBOM source), third-party actions (Log Source), and tools. +* **`predicate.runDetails`**: Details **what happened during the build execution**. This covers: + * **Builder Identity**: A precise reference to the specific workflow definition or builder tool that orchestrated the build. + * **Execution Metadata**: Timestamps for the start and end of the build, along with a unique invocation ID. + * **Byproducts**: Additional artifacts produced during the build that contribute to the overall evidence. This includes references to **build logs**, intermediate container layers, and the **generated Image SBOMs**, linking them to their corresponding digests and relevant build context. + +**For a full example, see** [Appendix A - Provenance Example](#appendix-a---provenance-example). + +## 🛌 Compatibility + +**Log Sources** +* GitHub Actions + +**Build Tools** +* Docker +* Podman +* Buildah + +## 📄 Related Pages + +* [Platforms Documentation](https://scribe-security.netlify.app/docs/platforms/discover.md) +* [SLSA Provenance Spec](https://slsa.dev/spec/v1.0/provenance/) + +--- + +### Appendix A - Provenance Example + +
+ SLSA Provenance example + +```YAML +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicateType": "https://slsa.dev/provenance/v1", + "subject": [ + { + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + } + }, + { + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + } + }, + { + "name": "scribe://target/", + "digest": { + "sha256": "7f7cb3f64eedcf3c4f90545dd611bf739b7e990584995143bc61f97aeaa7dc71" + } + } + ], + "predicate": { + "buildDefinition": { + "buildType": "https://docs.scribesecurity.com/buildtypes/github-workflow/v1", + "externalParameters": { + "context": { + "ADDED_BY": "platforms", + "event": "push", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "repository": "https://github.com/scribe-security/gatekeeper-valint", + "run_name": "release", + "source_git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git" + }, + "head_commit": { + "author": { + "email": "mdstrauss91@gmail.com", + "name": "houdini91" + }, + "committer": { + "email": "mdstrauss91@gmail.com", + "name": "houdini91" + }, + "id": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "message": "upstream", + "timestamp": "2025-06-05T10:57:04Z", + "tree_id": "60391731fb5752c01eaeb94a0f6252789bb08759" + }, + "pipeline": { + "actor": "houdini91", + "build_num": "49", + "job": "call-release ", + "run_id": "15465260889", + "type": "github", + "workflow": "release" + }, + "source": { + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4" + } + }, + "internalParameters": { + "build": { + "build_args": [ + "BUILD_DATE=2025-06-05T10:59:13Z", + "BUILD_VERSION=2.0.4", + "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "VCS_URL=https://github.com/scribe-security/gatekeeper-valint", + "BUILD_VERSION=2.0.4", + "DESCRIPTION=\"Valint", + "PROJECT_NAME=gatekeeper-valint]" + ], + "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]", + "secret_list": [ + "SCRIBE_DEV_M2M_CLIENT_ID", + "SCRIBE_DEV_M2M_CLIENT_SECRET", + "SCRIBE_STAGING_M2M_CLIENT_ID", + "SCRIBE_STAGING_M2M_CLIENT_SECRET" + ] + }, + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "slsa", + "content_type": "statement-slsa", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + } + }, + "resolvedDependencies": [ + { + "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "refs/tags/v2.0.4", + "annotations": { + "branch": "v2.0.4", + "tag": "" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "annotations": { + "ADDED_BY": "valint", + "SBOM_METADATA": { + "OS": "linux", + "actor": "houdini91", + "architecture": "amd64", + "build_num": "49", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "entrypoint": "/home/scribe/docker/entrypoint.sh, /home/scribe/${PROJECT_NAME}", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageEnvironment_0": "PATH=/home/scribe/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "imageEnvironment_1": "PROJECT_NAME=gatekeeper-valint", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "imageUser": "65532:65532", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "label_io.artifacthub.package.license": "Apache-2.0", + "label_io.artifacthub.package.name": "gatekeeper-valint", + "label_io.artifacthub.package.readme-url": "https://raw.githubusercontent.com/scribe-security/gatekeeper-valint/README.md", + "label_io.artifacthub.package.vendor": "Scribe security, Inc.", + "label_org.opencontainers.image.created": "2025-06-05T10:59:13Z", + "label_org.opencontainers.image.description": "\"Valint gatekeeper external data provider\"", + "label_org.opencontainers.image.revision": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "label_org.opencontainers.image.source": "https://github.com/scribe-security/gatekeeper-valint", + "label_org.opencontainers.image.title": "gatekeeper-valint", + "label_org.opencontainers.image.vendor": "Scribe security, Inc.", + "label_org.opencontainers.image.version": "2.0.4", + "labels_0": "platform=github", + "labels_1": "asset_type=slsa_target", + "labels_2": "parent-asset-id=scribe-security/gatekeeper-valint", + "labels_3": "parent-asset-type=repository", + "labels_4": "parent-asset-name=gatekeeper-valint", + "labels_5": "cache_key=15465260889", + "manifest-digest": "sha256:94023f7bbe13163404aada47909e965ee98addd9b65edc805d293235be582596", + "media-type": "application/vnd.docker.distribution.manifest.v2+json", + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "product_version": "v1", + "registry_location": "index.docker.io", + "registry_scheme": "https", + "repoDigest_0": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "run_id": "15465260889", + "size": "124078632", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "user": "mikey", + "workflow": "release" + } + } + }, + { + "uri": "https://github.com/actions/checkout", + "digest": { + "sha1": "942562b9c7d4b1f2557f1da21f4d3eb4eb4fd01f2ad78b2a6e187d1b193e0a0f" + }, + "name": "actions/checkout@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "clean": "true", + "fetch-depth": "0", + "fetch-tags": "false", + "lfs": "false", + "persist-credentials": "true", + "repository": "scribe-security/gatekeeper-valint", + "set-safe-directory": "true", + "sparse-checkout-cone-mode": "true", + "ssh-strict": "true", + "submodules": "false", + "token": "***" + }, + "version": "3.6.0" + } + }, + { + "uri": "https://github.com/actions/setup-go", + "digest": { + "sha1": "1b5ba729a06c8434c34b6776887b6934e562a955369e9f11807883dd5e99cd81" + }, + "name": "actions/setup-go@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "cache": "false", + "check-latest": "false", + "go-version": "1.21", + "token": "***" + }, + "version": "3.6.1" + } + }, + { + "uri": "https://github.com/actions/cache", + "digest": { + "sha1": "912f76fb11db1ca09ae23248a39eb86e79ea0f0f6e183d9cb96d0b778eeea4e2" + }, + "name": "actions/cache@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "enableCrossOsArchive": "false", + "fail-on-cache-miss": "false", + "key": "Linux-go-1.21-14fb4d3c9f15f444578334a60ca0e69141dd77054775852da7ca35a3e2e5f96e", + "lookup-only": "false", + "path": "~/go/pkg/mod", + "restore-keys": "Linux-go-1.21-" + }, + "version": "3.4.3" + } + }, + { + "uri": "https://github.com/docker/login-action", + "digest": { + "sha1": "074da69a9e77797ae469f40db0f64632c02629b61bfa229f2fa803f41a464283" + }, + "name": "docker/login-action@v2", + "annotations": { + "action_ref": "v2", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "ecr": "auto", + "logout": "true", + "password": "***", + "username": "scribesecurity" + }, + "version": "2.2.0" + } + }, + { + "uri": "https://github.com/actions/upload-artifact", + "digest": { + "sha1": "290722aa3281d5caf23d0acdc3dbeb3424786a1a01a9cc97e72f147225e37c38" + }, + "name": "actions/upload-artifact@v4", + "annotations": { + "action_ref": "v4", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "compression-level": "6", + "if-no-files-found": "warn", + "include-hidden-files": "false", + "name": "artifacts", + "overwrite": "false", + "path": "dist/**/*" + }, + "version": "4.6.2" + } + } + ] + }, + "runDetails": { + "builder": { + "id": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml", + "builderDependencies": [ + { + "uri": "https://scribesecuriy.jfrog.io/scribe-docker-public-local/valint:2.0.0-3-SNAPSHOT-a1e7b37", + "name": "valint", + "annotations": { + "ADDED_BY": "valint", + "vendor": "Scribe security, Inc", + "version": "2.0.0-3-SNAPSHOT-a1e7b37" + } + } + ] + }, + "metadata": { + "invocationID": "15465260889", + "startedOn": "2025-06-05T10:57:25Z", + "finishedOn": "2025-06-05T10:57:25Z" + }, + "byproducts": [ + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e?index=0", + "digest": { + "sha256": "7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # buildkit", + "index": "0", + "size": "221335" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097?index=1", + "digest": { + "sha256": "73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY / / # buildkit", + "index": "1", + "size": "28812158" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8?index=2", + "digest": { + "sha256": "6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "RUN |6 DESCRIPTION=\"Valint gatekeeper external data provider\" BUILD_DATE=2025-06-05T10:59:13Z BUILD_VERSION=2.0.4 VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e VCS_URL=https://github.com/scribe-security/gatekeeper-valint PROJECT_NAME=gatekeeper-valint /bin/sh -c /bin/mkdir -p /etc/scribe/keys /home/scribe/ # buildkit", + "index": "2", + "size": "0" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3Af48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4?index=3", + "digest": { + "sha256": "f48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY . /home/scribe/ # buildkit", + "index": "3", + "size": "95045139" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef?index=4", + "digest": { + "sha256": "5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "WORKDIR /home/scribe/", + "index": "4", + "size": "0" + } + }, + { + "uri": "pkg:OS/wolfi@20230201", + "name": "wolfi", + "annotations": { + "ADDED_BY": "valint", + "BugReportURL": "https://github.com/wolfi-dev/os/issues", + "HomeURL": "https://wolfi.dev", + "ID": "wolfi", + "Name": "Wolfi", + "PrettyName": "Wolfi", + "VersionID": "20230201" + } + }, + { + "uri": "https://api.github.com/repos/scribe-security/gatekeeper-valint/actions/runs/15465260889/logs", + "digest": { + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "name": "scribe-security/gatekeeper-valint/release/15465260889/call-release ", + "mediaType": "text/plain", + "annotations": { + "ADDED_BY": "platforms", + "build_args": [ + "BUILD_DATE=2025-06-05T10:59:13Z", + "BUILD_VERSION=2.0.4", + "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "VCS_URL=https://github.com/scribe-security/gatekeeper-valint", + "BUILD_VERSION=2.0.4", + "DESCRIPTION=\"Valint", + "PROJECT_NAME=gatekeeper-valint]" + ], + "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]", + "imageID_log": "#13 writing image sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d done", + "log_filepath": "0_call-release _ release.txt", + "workflow_file": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint:v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "scribesecurity/gatekeeper-valint:v2.0.4", + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "annotations": { + "ADDED_BY": "platforms", + "image_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + } + }, + { + "uri": "https://github.com/scribe-security/gatekeeper-valint.git", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "https://github.com/scribe-security/gatekeeper-valint.git", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4", + "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint", + "extra_labels": [ + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "input_name": "https://github.com/scribe-security/gatekeeper-valint.git", + "input_scheme": "git", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "product_version": "v1", + "ref": "113193", + "run_id": "15465260889", + "sbomcomponents": [ + "packages", + "dep", + "metadata" + ], + "sbomgroup": "git", + "sbomhashs": [ + "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e" + ], + "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git", + "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "sbomtype": "file", + "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "store": "scribe", + "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "target_git_ref": "refs/tags/v2.0.4", + "target_git_tag": "v2.0.4", + "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git", + "target_type": "git", + "timestamp": "2025-06-12T11:48:42+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "113193", + "target-type": "git" + } + }, + { + "uri": "https://github.com/scribe-security/gatekeeper-valint.git", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "https://github.com/scribe-security/gatekeeper-valint.git", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4", + "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint", + "extra_labels": [ + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "input_name": "https://github.com/scribe-security/gatekeeper-valint.git", + "input_scheme": "git", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "product_version": "v1", + "ref": "113193", + "run_id": "15465260889", + "sbomcomponents": [ + "packages", + "dep", + "metadata" + ], + "sbomgroup": "git", + "sbomhashs": [ + "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e" + ], + "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git", + "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "sbomtype": "file", + "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "store": "scribe", + "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "target_git_ref": "refs/tags/v2.0.4", + "target_git_tag": "v2.0.4", + "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git", + "target_type": "git", + "timestamp": "2025-06-12T11:48:42+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "/home/mikey/.cache/valint/sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e.bom.statement.json", + "target-type": "git" + } + }, + { + "uri": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "ref": "113194", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "store": "scribe", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "113194", + "target-type": "container" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "ref": "113194", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "store": "scribe", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "/home/mikey/.cache/valint/sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d.bom.statement.json", + "target-type": "container" + } + } + ] + } + } + } +``` + +
+ + + + + + + From f67c059ab85dfe2f9ce052671f727548bfbf369b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 15 Jun 2025 12:25:39 +0300 Subject: [PATCH 06/25] debug --- .../{slsa-lvl-2-on-scale.md => slsa-on-scale.md} | 0 docusaurus.config.js | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename docs/guides/secure-sfw-slsa/{slsa-lvl-2-on-scale.md => slsa-on-scale.md} (100%) diff --git a/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md similarity index 100% rename from docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md rename to docs/guides/secure-sfw-slsa/slsa-on-scale.md diff --git a/docusaurus.config.js b/docusaurus.config.js index b2df3ed72..fed7abbff 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,7 +93,7 @@ const config = { "guides/secure-sfw-slsa/README.md", "guides/secure-sfw-slsa/slsa-lvl-1.md", "guides/secure-sfw-slsa/slsa-lvl-2.md", - "guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md", + "guides/secure-sfw-slsa/slsa-on-scale.md", "guides/secure-sfw-slsa/slsa-lvl-3.md", "guides/secure-sfw-slsa/customizing-provenance.md", "guides/secure-sfw-slsa/basic-examples.md", From 9efbd0f505d8478ccac72502a731a83df9970c85 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 15 Jun 2025 12:43:31 +0300 Subject: [PATCH 07/25] Rephrase --- docs/guides/secure-sfw-slsa/s | 0 docs/guides/secure-sfw-slsa/s2 | 0 docs/guides/secure-sfw-slsa/slsa-on-scale.md | 91 +++++++++++++------- 3 files changed, 58 insertions(+), 33 deletions(-) create mode 100644 docs/guides/secure-sfw-slsa/s create mode 100644 docs/guides/secure-sfw-slsa/s2 diff --git a/docs/guides/secure-sfw-slsa/s b/docs/guides/secure-sfw-slsa/s new file mode 100644 index 000000000..e69de29bb diff --git a/docs/guides/secure-sfw-slsa/s2 b/docs/guides/secure-sfw-slsa/s2 new file mode 100644 index 000000000..e69de29bb diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index cae1424d5..8eb054db2 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -5,42 +5,53 @@ title: "SLSA L1 & L2 Provenance from Logs" sidebar\_position: 5 toc\_min\_heading\_level: 2 toc\_max\_heading\_level: 5 ---------------------------- +--- -Scribe supports automatic generation of [SLSA Level 2](https://slsa.dev/provenance/v1.0) provenance for container images at scale — without modifying your pipelines. Instead of injecting provenance generators directly into your CI, this method leverages build log analysis from GitHub workflows and other supported platforms. +Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, all without requiring modifications to your existing pipelines. Instead of injecting provenance generators directly into your CI, our method intelligently leverages **build log analysis** from GitHub workflows and other supported platforms. -This complements the existing SLSA policy engine in Scribe Hub and is ideal for organizations that want to validate image builds across multiple repositories retroactively or externally. +This capability significantly enhances the existing SLSA policy engine within Scribe Hub, making it an ideal solution for organizations that need to **validate image builds across multiple repositories, retroactively, or externally**. ## 🔍 Overview -At the heart of this feature is the automated creation of rich, SLSA Level 2-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: +At the heart of this feature is the automated creation of rich, SLSA-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: -* The source code repository and its history (via GitHub SCM APIs) -* The container image build targets (e.g., image digests, tags, IDs) -* Workflow metadata from the CI system (timestamps, runners, inputs) -* Associated SBOMs — linking both the source and built image artifacts as evidence + * The source code repository and its history (via GitHub SCM APIs) + * The container image build targets (e.g., image digests, tags, IDs) + * Workflow metadata from the CI system (timestamps, runners, inputs) + * Associated SBOMs — linking both the source and built image artifacts as evidence By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. This enables producers to: -* Analyze GitHub Actions logs across many repositories -* Discover image builds (Docker, Buildah, Podman) -* Extract critical build metadata automatically -* Generate valid in-toto SLSA provenance statements (Level 2) -* Export evidence locally or directly into the Scribe Hub -* Attach results under the correct repository or workflow run + * Analyze GitHub Actions logs across many repositories + * Discover image builds (Docker, Buildah, Podman) + * Extract critical build metadata automatically + * Generate valid in-toto SLSA provenance statements (Level 1 or Level 2, depending on usage) + * Export evidence locally or directly into the Scribe Hub + * Attach results under the correct repository or workflow run This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. ## ✅ When to Use -* You want SLSA provenance but cannot modify the CI pipelines -* You want to verify builds retroactively (e.g., last 30 days) -* You operate across 10s or 100s of repositories -* You want SLSA Level 2 as structured, independently validated evidence + * You want SLSA provenance but cannot modify the CI pipelines + * You want to verify builds retroactively (e.g., last 30 days) + * You operate across 10s or 100s of repositories + * You want SLSA Level 1 (unsigned) or Level 2 (signed) as structured, independently validated evidence + +## 🚀 SLSA Levels Explained with Scribe + +Scribe's `platforms discover` tool generates SLSA provenance by analyzing your build logs. The SLSA level achieved depends on whether the generated provenance is cryptographically signed. + + * **SLSA Level 1 (Unsigned Provenance):** This level of provenance is generated by default when you use `platforms discover`. It captures essential information about the build process, as extracted from logs, but the provenance statement itself is not cryptographically signed. This provides a valuable, machine-readable record of the build, offering transparency and traceability. + + * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing service (like Scribe Hub's attestation signing service). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. -## 🧪 Example Usage L1 + +## 🧪 Example Usage L1 (Unsigned Provenance) + +The following command will generate SLSA Level 1 provenance. The provenance document will contain rich build metadata but will not be cryptographically signed. ```bash platforms discover github \ @@ -50,34 +61,48 @@ platforms discover github \ --commit.skip \ --slsa-enable \ --slsa.tags-only \ - --slsa.latest-only ``` -## 🧪 Example Usage L2 +This command will: + + * Scan recent GitHub workflows for the `scribe-security` organization. + * Match release workflows from `valint` repositories. + * Extract image build metadata from logs. + * Generate SLSA Level 1 provenance (unsigned). + * Include links to source and image SBOMs. + * Export that evidence under the appropriate product key using the mapping. -This simplified command will: +## 🧪 Example Usage L2 (Signed Provenance) -* Scan recent GitHub workflows for the `scribe-security` organization -* Match release workflows from `*valint*` repositories -* Extract image build metadata from logs -* Generate SLSA Level 2 provenance -* Include links to source and image SBOMs +To generate SLSA Level 2 provenance, you need to sign the provenance statement. This is done by adding the `--valint.sign` flag. This typically requires integration with a signing service (e.g., Scribe Hub's attestation signing). + +```bash +platforms discover --valint.sign github \ + --scope.organization scribe-security \ + --scope.repository "valint" \ + --repository.mapping *::valint_slsa::v1 \ + --commit.skip \ + --slsa-enable \ + --slsa.tags-only +``` This command will: -* Query workflows named “release” on the `main` branch of all `*valint*` repositories -* Discover image builds based on log patterns (e.g., docker/buildah/podman) -* Create an in-toto SLSA v1.0 provenance statement for each tag -* Export that evidence under the appropriate product key using the mapping + * Perform all actions of the L1 example. + * **Additionally, it will cryptographically sign the generated SLSA provenance statements**, elevating them to SLSA Level 2. ## 📂 Key Flags | Flag | Description | | ---------------------- | -------------------------------------------------------------- | | `--slsa-enable` | Enable SLSA provenance extraction and export | +| `--valint.sign` | **(For SLSA L2)** Enables cryptographic signing of the generated SLSA provenance. This typically requires configuration for a signing backend (e.g., X509 Keys, Sigstore - GitHub's OIDC, or an external KMS). | | `--slsa.tags-only` | Limit to tag-based builds only | -| `--slsa.latest-only` | Limit to only latest image for each tag | -| `--slsa.scope.*` | Narrow provenance to branches, tags, workflows, or image names | +| `--slsa.all-versions` | Include SLSA Provenance evidence for all published images (all versions) rather than just the latest for each tag. By default, only the latest image provenance is included. | +| `--slsa.scope.branch` | Restrict provenance to specific **branches** | +| `--slsa.scope.tag` | Restrict provenance to matching **tags** | +| `--slsa.scope.workflow` | Restrict provenance to named **workflows/jobs** | +| `--slsa.scope.image` | Restrict provenance to particular **image names/repositories** | | `--repository.mapping` | Assign product key for evidence export | | `--skip-cache` | Force recomputation even if cached results exist | From ed552d0e6bf4c02f696592905d033bd4715abebe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:02:06 +0300 Subject: [PATCH 08/25] update --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 50 +++++++++++--------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 8eb054db2..679a437ee 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -7,9 +7,7 @@ toc\_min\_heading\_level: 2 toc\_max\_heading\_level: 5 --- -Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, all without requiring modifications to your existing pipelines. Instead of injecting provenance generators directly into your CI, our method intelligently leverages **build log analysis** from GitHub workflows and other supported platforms. - -This capability significantly enhances the existing SLSA policy engine within Scribe Hub, making it an ideal solution for organizations that need to **validate image builds across multiple repositories, retroactively, or externally**. +Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, without requiring any changes to your existing pipelines. Instead of embedding provenance generators in each CI job, Scribe combines **Scribe Platforms’ posture attestations** with **build-log analysis** from GitHub Actions and other supported systems to produce complete provenance statements automatically. ## 🔍 Overview @@ -17,24 +15,11 @@ At the heart of this feature is the automated creation of rich, SLSA-compliant p * The source code repository and its history (via GitHub SCM APIs) * The container image build targets (e.g., image digests, tags, IDs) - * Workflow metadata from the CI system (timestamps, runners, inputs) + * CI systems and log (timestamps, runners, inputs) * Associated SBOMs — linking both the source and built image artifacts as evidence -By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. - -This enables producers to: - - * Analyze GitHub Actions logs across many repositories - * Discover image builds (Docker, Buildah, Podman) - * Extract critical build metadata automatically - * Generate valid in-toto SLSA provenance statements (Level 1 or Level 2, depending on usage) - * Export evidence locally or directly into the Scribe Hub - * Attach results under the correct repository or workflow run - -This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. - ## ✅ When to Use - + * You cannot modify the CI pipelines due to authority or scale * You want SLSA provenance but cannot modify the CI pipelines * You want to verify builds retroactively (e.g., last 30 days) * You operate across 10s or 100s of repositories @@ -42,13 +27,30 @@ This allows scalable, retroactive attestation for compliance, auditing, and secu ## 🚀 SLSA Levels Explained with Scribe -Scribe's `platforms discover` tool generates SLSA provenance by analyzing your build logs. The SLSA level achieved depends on whether the generated provenance is cryptographically signed. +Scribe’s `platforms discover` command automatically creates SLSA provenance for each image build it detects. The SLSA level produced—Level 1 or Level 2—depends solely on whether the provenance is cryptographically signed. * **SLSA Level 1 (Unsigned Provenance):** This level of provenance is generated by default when you use `platforms discover`. It captures essential information about the build process, as extracted from logs, but the provenance statement itself is not cryptographically signed. This provides a valuable, machine-readable record of the build, offering transparency and traceability. - * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing service (like Scribe Hub's attestation signing service). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. + * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing capability (like Scribe Hub's attestation signing capability). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. +## 🛠️ What Scribe Platforms Does Under the Hood + +Behind the scenes, Scribe Platforms performs several steps to turn raw workflow logs into SLSA-compliant provenance: + +* **Analyze GitHub Actions logs across multiple repositories** + Detects every image build (Docker, Buildah, Podman) without altering your pipelines. +* **Extract critical build metadata automatically** + Pulls builder, tag, digest, and timestamp information straight from the logs. +* **Generate and Link SBOM evidence** + Generate Associates both source-code and image SBOMs with the build for end-to-end traceability. +* **Generate in-toto SLSA statements (L1 or L2)** + Produces valid provenance, optionally signing it when `--valint.sign` is enabled. +* **Export the evidence to Scribe Hub or local storage** + Tags each artifact with the correct repository, workflow run, and product key. + +(Users don’t need to run any extra steps—this all happens automatically when you invoke `platforms discover`.) + ## 🧪 Example Usage L1 (Unsigned Provenance) The following command will generate SLSA Level 1 provenance. The provenance document will contain rich build metadata but will not be cryptographically signed. @@ -107,11 +109,14 @@ This command will: | `--skip-cache` | Force recomputation even if cached results exist | ## 🚧 What's Collected in the Provenance Attestation -* **`subject`**: Identifies the primary **output artifact(s)** of your build, including the image reference and its cryptographic digest. This unequivocally links the attestation to the artifact it describes. +* **`subject`**: Captures the **single output artifact** of the build—its full image reference **plus a SHA-256 digest** (the cryptographic hash that uniquely fingerprints the image). + This hash ties the provenance unambiguously to that exact image, even if the tag is later reused. + > *Note:* If a workflow emits multiple images, Scribe generates one provenance statement per image. + * **`predicate.buildDefinition`**: Describes **how the artifact was built**. This includes: * **Build System Details**: Information about the CI/CD platform used (e.g., GitHub Actions workflow file, specific job, and run ID). * **Source Code**: The exact Git repository URL, commit SHA, and branch/tag that was built. - * **Build Parameters**: Any external inputs or internal parameters that influenced the build, such as build arguments and a list of used secret names (without their values). + ** **Build Parameters** – External inputs such ad Docker build arguments and the names of all repository-level secrets that were available to the job **(values are never stored)**. * **Resolved Dependencies**: A comprehensive list of all inputs consumed by the build, including base images (Image SBOM source), third-party actions (Log Source), and tools. * **`predicate.runDetails`**: Details **what happened during the build execution**. This covers: * **Builder Identity**: A precise reference to the specific workflow definition or builder tool that orchestrated the build. @@ -120,6 +125,7 @@ This command will: **For a full example, see** [Appendix A - Provenance Example](#appendix-a---provenance-example). + ## 🛌 Compatibility **Log Sources** From 78f027e2ff0e28601bbb48d5281ec03e5c2737ac Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:20:03 +0300 Subject: [PATCH 09/25] add policy results --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 40 ++++++++++++++++++-- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 679a437ee..aeeca5e16 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -46,10 +46,12 @@ Behind the scenes, Scribe Platforms performs several steps to turn raw workflow Generate Associates both source-code and image SBOMs with the build for end-to-end traceability. * **Generate in-toto SLSA statements (L1 or L2)** Produces valid provenance, optionally signing it when `--valint.sign` is enabled. -* **Export the evidence to Scribe Hub or local storage** - Tags each artifact with the correct repository, workflow run, and product key. +* **Run SLSA-compliance initiatives** + Once each provenance file is written, Scribe automatically executes the matching policy-as-code initiative (`slsa.l1` for unsigned L1, `slsa.l2` for signed L2). + The initiative verifies the evidence set, emits a SARIF report, and—when applicable—signs that report before attaching it as additional evidence. +* **Execute SLSA Compliance Initiatives** +After provenance generation, Scribe automatically applies relevant policy-as-code initiatives (`slsa.l1` or `slsa.l2`). These initiatives validate the evidence, generate a SARIF report detailing compliance status, and (for Level 2) sign this report as additional, verifiable evidence. -(Users don’t need to run any extra steps—this all happens automatically when you invoke `platforms discover`.) ## 🧪 Example Usage L1 (Unsigned Provenance) @@ -108,6 +110,38 @@ This command will: | `--repository.mapping` | Assign product key for evidence export | | `--skip-cache` | Force recomputation even if cached results exist | + +## 🔒 Proving SLSA Compliance with Policy-as-Code Initiatives + +After Scribe generates SLSA provenance for your container images, it automatically takes a critical extra step: it runs **policy-as-code initiatives** against the provenance and its associated evidence. This provides a robust, verifiable way to demonstrate SLSA compliance. + +### What are Scribe Initiatives? + +Scribe Initiatives are predefined or custom sets of policy rules that evaluate your software supply chain's compliance. For SLSA, Scribe offers specific initiatives to verify various aspects of your provenance and its linked SBOMs (Software Bill of Materials) for both source and image. + +These initiatives check for things like: + + * The **existence and integrity** of the provenance document and its linked SBOMs. + * That **critical fields** in the provenance (e.g., builder identity, source repository) match expected values. + * For **SLSA Level 2**, that both the provenance and the resulting SARIF (Static Analysis Results Interchange Format) compliance report are **cryptographically signed**, ensuring their authenticity. + +The outcome of these evaluations is a **SARIF report**. This report details your compliance status, highlights any policy deviations, and links back to all relevant evidence. For SLSA Level 2, this SARIF report is also signed, adding another layer of verifiable assurance. + +This automated verification and reporting gives you: + + * **Robust Compliance Proof:** Independently validated evidence of your SLSA adherence. + * **End-to-End Traceability:** Links all artifacts and reports directly to the build process. + * **Streamlined Auditing:** A standardized, machine-readable format for compliance reporting. + +### Further Reading and Resources + +For more details on Scribe's policy-as-code initiatives and their role in SLSA compliance, explore these resources: + + * **Applying Initiatives to your SDLC:** [https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative) + * **SLSA L1 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml) + * **SLSA L2 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml) + + ## 🚧 What's Collected in the Provenance Attestation * **`subject`**: Captures the **single output artifact** of the build—its full image reference **plus a SHA-256 digest** (the cryptographic hash that uniquely fingerprints the image). This hash ties the provenance unambiguously to that exact image, even if the tag is later reused. From 644abde096ad92b08073ebada83854174b7ef1fe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:26:30 +0300 Subject: [PATCH 10/25] fix input name --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index aeeca5e16..1e1430aa7 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -64,7 +64,7 @@ platforms discover github \ --repository.mapping *::valint_slsa::v1 \ --commit.skip \ --slsa-enable \ - --slsa.tags-only \ + --slsa.tags-only ``` This command will: From fa9557f26b6c55968b854ae32772496a0d479a49 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:54:02 +0300 Subject: [PATCH 11/25] update --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 47 ++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 1e1430aa7..dbb109b42 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -95,6 +95,53 @@ This command will: * Perform all actions of the L1 example. * **Additionally, it will cryptographically sign the generated SLSA provenance statements**, elevating them to SLSA Level 2. + +## 🔁 Example GitHub Actions Workflow + +> ℹ️ **Tip:** It's recommended to schedule this workflow (instead of running manually) to ensure timely collection of logs before GitHub Actions deletes them (typically after 90 days). + +You can also run the `discover` command from within GitHub Actions using the [Scribe Security GitHub Action](https://github.com/scribe-security/action-platforms): + +
+Click to view GitHub Actions workflow example + +```yaml +name: Discover SLSA Provenance from GitHub + +on: + schedule: + - cron: '0 4 * * *' # Runs daily at 04:00 UTC + workflow_dispatch: + +permissions: + id-token: write # Allows Sigstore signing via GitHub OIDC identity + contents: read + +jobs: + discover-slsa: + runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }} + SCRIBE_TOKEN: ${{ secrets.GH_CI_DEV_SCRIBE_SECRET }} + steps: + - name: Discover GitHub Provenance + uses: scribe-security/action-platforms@dev + with: + command: discover + platform: github + sign: true # required for SLSA Level 2 + slsa: true + args: >- + --slsa-enable + --slsa.tags-only + --scope.organization=scribe-security + --scope.repository=valint + --organization.mapping=scribe-security::valint_slsa::v1 + --repository.mapping=scribe-security*valint::valint_slsa::v1 +``` + +
+ ## 📂 Key Flags | Flag | Description | From 2f12913d84c6a9a0162fa2de3800fd9178af7940 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 15:48:33 +0300 Subject: [PATCH 12/25] comment --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index dbb109b42..9a7f74a7d 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -74,8 +74,8 @@ This command will: * Extract image build metadata from logs. * Generate SLSA Level 1 provenance (unsigned). * Include links to source and image SBOMs. - * Export that evidence under the appropriate product key using the mapping. - + * Export the evidence under product key **`valint_slsa`** with version **`v1`**. + ## 🧪 Example Usage L2 (Signed Provenance) To generate SLSA Level 2 provenance, you need to sign the provenance statement. This is done by adding the `--valint.sign` flag. This typically requires integration with a signing service (e.g., Scribe Hub's attestation signing). From 999043c8862deadc536e7faac63118867b153433 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 24 Jun 2025 16:36:35 +0300 Subject: [PATCH 13/25] upstream --- docs/valint/configuration.md | 8 ++++++-- docs/valint/help/valint.md | 5 +++-- docs/valint/help/valint_bom.md | 5 +++-- docs/valint/help/valint_discard.md | 5 +++-- docs/valint/help/valint_download.md | 8 ++++++-- docs/valint/help/valint_evidence.md | 5 +++-- docs/valint/help/valint_list.md | 5 +++-- docs/valint/help/valint_slsa.md | 7 +++++-- docs/valint/help/valint_verify.md | 13 +++++++++---- 9 files changed, 41 insertions(+), 20 deletions(-) diff --git a/docs/valint/configuration.md b/docs/valint/configuration.md index 3faee57dc..bf062d083 100644 --- a/docs/valint/configuration.md +++ b/docs/valint/configuration.md @@ -60,14 +60,18 @@ attest: commit: "" depth: 0 clone-path: "" + initiative_file: "" + initiative_name: "" + initiative_id: "" + all-evidence: false policy_configs: [] rule_configs: [] label_filters: [] - initiative_filters: [] default: sigstore report: add-passed: true - cocosign: {} + cocosign: + all-evidence: false x509: {} fulcio: enable: false diff --git a/docs/valint/help/valint.md b/docs/valint/help/valint.md index 64d6962bd..8f532cc58 100644 --- a/docs/valint/help/valint.md +++ b/docs/valint/help/valint.md @@ -17,9 +17,10 @@ Flags for `valint` | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | | -h | --help | help for valint | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_bom.md b/docs/valint/help/valint_bom.md index f18c6ba72..e551f90b4 100644 --- a/docs/valint/help/valint_bom.md +++ b/docs/valint/help/valint_bom.md @@ -69,8 +69,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_discard.md b/docs/valint/help/valint_discard.md index 93fce86f9..353b68aef 100644 --- a/docs/valint/help/valint_discard.md +++ b/docs/valint/help/valint_discard.md @@ -35,8 +35,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_download.md b/docs/valint/help/valint_download.md index a6368c654..ffd0925f0 100644 --- a/docs/valint/help/valint_download.md +++ b/docs/valint/help/valint_download.md @@ -12,9 +12,12 @@ Flags for `download` subcommand | Short | Long | Description | Default | | --- | --- | --- | --- | +| | --beautify | Enhance the output using ANSI and Unicode characters | | | | --folder-path | Folder to download the evidences of the given target | | | -o | --format | Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | | | -h | --help | help for download | | +| -I | --initiative-report | Download Initiative result report | | +| | --md | Output Initiative result markdown report file | | | | --payload | path of the decoded payload | | | | --ref | Evidence store refrence | | | | --store | Select evidence store | | @@ -31,8 +34,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_evidence.md b/docs/valint/help/valint_evidence.md index b7ce82e20..878314b9b 100644 --- a/docs/valint/help/valint_evidence.md +++ b/docs/valint/help/valint_evidence.md @@ -53,8 +53,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_list.md b/docs/valint/help/valint_list.md index 65c37a5dc..36cd5f636 100644 --- a/docs/valint/help/valint_list.md +++ b/docs/valint/help/valint_list.md @@ -42,8 +42,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index 6b7797c9c..dc6feb12f 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -19,6 +19,7 @@ Flags for `slsa` subcommand | | --all-env | Attach all environment variables | | | | --attest.config | Attestation config path | | | | --attest.default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | | +| | --bom | Upload SBOM evidence and by product | | | | --build-type | Set build type | | | | --builder-id | Set builder id | | | | --by-product | Attach by product path | | @@ -49,6 +50,7 @@ Flags for `slsa` subcommand | | --predicate | Import predicate path | | | | --pubkey | Public key path | | | -y | --skip-confirmation | Skip Sigstore Confirmation | | +| | --source | Git repository source for target | | | | --started-on | Set metadata started time (YYYY-MM-DDThh:mm:ssZ) | | | | --statement | Import statement path | | @@ -64,8 +66,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index 5be7bfdbc..bb9f514ff 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -16,10 +16,12 @@ Flags for `verify` subcommand | Short | Long | Description | Default | | --- | --- | --- | --- | +| | --all-evidence | Run all evidence verification | | | | --attest.config | Attestation config path | | | | --attest.default | Attestation default config, options=[sigstore sigstore-github x509 x509-env kms pubkey] | | | -a | --attestation | Attestation for target | | | | --base-image | Base image for the target | | +| | --beautify | Enhance the output using ANSI and Unicode characters | | | | --bom | Create target SBOM evidence | | | | --bundle | Policy bundle uri/path (early-availability) | "https://github.com/scribe-public/sample-policies" | | | --bundle-auth | Bundle repository authentication info, [format: 'username:password'] | | @@ -42,16 +44,18 @@ Flags for `verify` subcommand | | --git-commit | Git commit hash in the repository | | | | --git-tag | Git tag in the repository | | | -h | --help | help for verify | | -| | --initiative | Run only rules with specified initiative | | +| | --initiative | Initiative configuration file path (early-availability) | | +| | --initiative-id | Initiative id | | +| | --initiative-name | Initiative name | | | -i | --input-format | Input Evidence format, options=[attest-cyclonedx-json attest-slsa statement-slsa statement-cyclonedx-json statement-generic attest-generic ] | | | | --key | x509 Private key path | | | | --kms | Provide KMS key reference | | +| | --md | Output Initiative result markdown report file | | | | --oci | Enable OCI store | | | -R | --oci-repo | Select OCI custom attestation repo | | | | --pass | Private key password | | | | --payload | path of the decoded payload | | | | --platform | Select target platform, examples=windows/armv6, arm64 ..) | | -| | --policy | Policy configuration file path (early-availability) | | | | --provenance | Create target SLSA Provenance evidence | | | | --pubkey | Public key path | | | | --public-key | Public key path | | @@ -75,8 +79,9 @@ Flags for all `valint` subcommands | -C | --context-type | CI context type, options=[jenkins github circleci azure gitlab travis tekton bitbucket teamcity local admission] | | | | --deliverable | Mark as deliverable, options=[true, false] | | | -e | --env | Environment keys to include in evidence | | -| -G | --gate | Policy Gate name | | -| | --input | Input Evidence target, format (\:\ or \:\:\) | | +| | --gate-name | Policy Gate name | | +| -G | --gate-type | Policy Gate type | | +| | --input | Input Evidence target, format (\:\ or \:\:\) | | | -L | --label | Add Custom labels | | | | --level | Log depth level, options=[panic fatal error warning info debug trace] | | | | --log-context | Attach context to all logs | | From 7d2acebcd895edaa69ddd16bf4aebbf8aebf6a0b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 24 Jun 2025 16:37:46 +0300 Subject: [PATCH 14/25] upstream --- docs/platforms/bom.md | 128 ++++++++++----------- docs/platforms/discover.md | 222 ++++++++++++++++++------------------- docs/platforms/evidence.md | 146 ++++++++++-------------- docs/platforms/hooks.md | 81 ++++++++++++-- docs/platforms/usage.md | 7 +- docs/platforms/verify.md | 158 +++++++++++--------------- 6 files changed, 367 insertions(+), 375 deletions(-) diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index 2f14a0c98..400a15052 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,12 +16,9 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] - [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.log-level LOG_LEVEL] - [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] +usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket,azure} ... Export bom data @@ -47,8 +44,15 @@ options: Disable Valint local cache (default: False) --valint.context-type CONTEXT_TYPE Valint context type (type: str, default: ) + --valint.assume-context ASSUME_CONTEXT + Valint assume context (type: str, default: ) + --valint.payload PAYLOAD + Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) + --valint.arch ARCH Set Image architecture (type: str, default: ) + --valint.input [INPUT ...] + Valint extra input targets (default: []) --valint.output-directory OUTPUT_DIRECTORY Local evidence cache directory (type: str, default: ) --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) @@ -58,13 +62,23 @@ options: Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE Evidence predicate type (type: str, default: ) + --valint.statement STATEMENT + SLSA Evidence statement type (type: str, default: ) + --valint.source SOURCE + SLSA Source target (type: str, default: ) --valint.attest ATTEST Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7ece7edf87c0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x77102f359080>, default: []) --unique Allow unique assets (default: False) + --valint.git-commit GIT_COMMIT + Set Input Target Git commit (type: str, default: ) + --valint.git-branch GIT_BRANCH + Set Input Target Git branch (type: str, default: ) + --valint.git-tag GIT_TAG + Set Input Target Git tag (type: str, default: ) subcommands: For more details of each subcommand, add it as an argument followed by --help. @@ -142,13 +156,9 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -227,12 +237,8 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -260,8 +266,7 @@ options: --exclude.image [IMAGE ...] Images to exclude from discovery process (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: - K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_k8s_image, trivy_iac_and_secrets. (default: []) @@ -313,13 +318,9 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] - [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] +usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -347,6 +348,14 @@ options: Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) + --hook-config [HOOK_CONFIG ...] + Paths to YAML files containing custom hook definitions. (type: str, default: []) + --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_image. (default: []) + --hook.skip Skip hooks (default: False) + --repository.hooks [HOOKS ...] + Inline hook format :::::: (type: ToolHookString, default: []) + --image.hook [HOOK ...] + Inline hook format :::::: (type: ToolHookString, default: []) ``` @@ -366,11 +375,8 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] +usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -416,11 +422,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: @@ -440,11 +443,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -457,14 +458,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) ``` @@ -486,11 +484,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] +usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -503,22 +498,20 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] - Github branches wildcards (default: []) - --scope.tag [TAG ...] - Github tags wildcards (default: []) + Github branches wildcards (default: ['*']) + --scope.tag.name [NAME ...] + Github tags wildcards (default: ['*']) --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) + --tag.only Only include tags in the evidence, skip branches (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: opengrep, trivy_iac_and_secrets, gitleaks_secrets, kics_scan. (default: []) @@ -546,10 +539,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -562,8 +553,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index 47571246b..92f2983da 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -22,13 +22,10 @@ The evidence generation process uses Scribe's `valint` tool to upload and option --> ```bash -usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] - [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] +usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] + [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] + [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket,azure} ... Discover assets and save data to a local store @@ -62,8 +59,15 @@ options: Disable Valint local cache (default: False) --valint.context-type CONTEXT_TYPE Valint context type (type: str, default: ) + --valint.assume-context ASSUME_CONTEXT + Valint assume context (type: str, default: ) + --valint.payload PAYLOAD + Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) + --valint.arch ARCH Set Image architecture (type: str, default: ) + --valint.input [INPUT ...] + Valint extra input targets (default: []) --valint.output-directory OUTPUT_DIRECTORY Local evidence cache directory (type: str, default: ) --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) @@ -73,13 +77,23 @@ options: Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE Evidence predicate type (type: str, default: ) + --valint.statement STATEMENT + SLSA Evidence statement type (type: str, default: ) + --valint.source SOURCE + SLSA Source target (type: str, default: ) --valint.attest ATTEST Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x75bbf48f2ca0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x79b17cc96de0>, default: []) --unique Allow unique assets (default: False) + --valint.git-commit GIT_COMMIT + Set Input Target Git commit (type: str, default: ) + --valint.git-branch GIT_BRANCH + Set Input Target Git branch (type: str, default: ) + --valint.git-tag GIT_TAG + Set Input Target Git tag (type: str, default: ) subcommands: For more details of each subcommand, add it as an argument followed by --help. @@ -134,15 +148,11 @@ platforms discover gitlab \ --> ```bash -usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] - [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] - [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] - [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] - [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--organization.single] [--project.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] + [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] [--skip-cache] + [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -157,8 +167,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -241,16 +250,13 @@ platforms discover github \ --> ```bash -usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] - [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] - [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] - [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] [--workflow.skip] - [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.runners] [--scope.sbom] - [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--skip-cache] - [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] + [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] + [--workflow.skip] [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]] [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] [--bom] + [--provenance] [--bom.scope.branch [BRANCH ...]] [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]] [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] [--slsa.all-versions] + [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache] [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--skip-cache] [--cache-ttl CACHE_TTL] + [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -265,14 +271,14 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] - Github branches wildcards (default: []) - --scope.tag [TAG ...] - Github tags wildcards (default: []) + Github branches wildcards (default: ['*']) + --scope.tag.name [NAME ...] + Github tags wildcards (default: ['*']) --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) + --tag.only Only include tags in the evidence, skip branches (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --scope.commit.past_days PAST_DAYS @@ -282,8 +288,10 @@ options: Number of past days to include in the report (type: int, default: 30) --scope.workflow.analyzed_logs Include analyzed workflow logs (default: False) + --scope.workflow.name [NAME ...] + Scope Workflow names (default: ['*']) --scope.runners Include repository allocated runners in evidence (default: False) - --scope.sbom Include repositories SBOM in evidence (default: False) + --scope.api-sbom Include repositories SBOM in evidence (default: False) --broad Retrieves limited information (only organizations, repositories and workflows) (default: False) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) @@ -291,12 +299,32 @@ options: --hook.skip Skip hooks (default: False) --repository.hooks [HOOKS ...] Inline hook format :::::: (type: ToolHookString, default: []) + --bom Retrieves Source SBOM from all repositories (default: False) + --provenance Retrieves Image provenance discovered in platform API (default: False) + --bom.scope.branch [BRANCH ...] + Scope branchs to include Repository Source SBOM evidence for (default: []) + --slsa.scope.branch [BRANCH ...] + Scope branchs to include SLSA Provenance evidence for (default: ['*']) + --slsa.scope.tag [TAG ...] + Scope tags to include SLSA Provenance evidence for (default: ['*']) + --slsa.scope.workflow [WORKFLOW ...] + Scope workflows to include SLSA Provenance evidence for (default: ['*']) + --slsa.scope.image [IMAGE ...] + Scope images to include asset SLSA Provenance evidence for (default: ['*']) + --slsa-enable Include SLSA Provenance evidence (default: False) + --slsa.tags-only Include SLSA Provenance evidence only for tags, skip branches (default: False) + --slsa.all-versions Include SLSA Provenance evidence for all versions of the image, not only latest (default: False) + --slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...] + Extended SLSA evidence types to include in the report (default: ['all']) + --slsa.skip-cache Skip Scribe SLSA cache lookup (default: False) + --slsa.cache-ttl CACHE_TTL + time to live for SLSA cache (default: 20d) + --slsa.cache-group CACHE_GROUP + Scribe SLSA cache group, default to runners pipeline ID, empty to use global context (default: any) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --skip-cache, -f Skip Scribe Evidence cache lookup (default: False) --cache-ttl CACHE_TTL time to live for cache (default: 2d) @@ -342,16 +370,11 @@ platforms discover dockerhub \ --> ```bash -usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] - [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] - [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] - [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hook [HOOK ...]] +usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] + [--namespace.single] [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] + [--hook.skip] [--repository.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -432,15 +455,9 @@ platforms discover k8s \ --> ```bash -usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] - [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] - [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] - [--token TOKEN] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] - [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] - [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] +usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] + [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. @@ -531,16 +548,11 @@ platforms discover jfrog \ --> ```bash -usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] - [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] - [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] - [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] - [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] + [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] + [--scope.tag_limit TAG_LIMIT] [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -569,8 +581,7 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days - filter. 0 for no limit, default is 10. (type: int, default: 20) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 20) --broad Retrieves limited information (only jf-repositories and repositories) (default: False) --jf-repository.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -583,6 +594,12 @@ options: --repository.single Export all repositories in a single evidence (default: False) --default_product_key_strategy {mapping,mapping,mapping,mapping} Override product key with jf-repository, repository or image names (default: mapping) + --hook-config [HOOK_CONFIG ...] + Paths to YAML files containing custom hook definitions. (type: str, default: []) + --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_image. (default: []) + --hook.skip Skip hooks (default: False) + --repository.hooks [HOOKS ...] + Inline hook format :::::: (type: ToolHookString, default: []) ``` @@ -628,15 +645,10 @@ platforms discover ecr \ --> ```bash -usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] - [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] - [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] - [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] - [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] - [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] [--token TOKEN] [--url URL] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -665,8 +677,7 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days - filter. 0 for no limit, default is 10. (type: int, default: 10) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 10) --broad Retrieves limited information (only aws-account and repository) (default: False) --aws-account.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -725,13 +736,9 @@ platforms discover bitbucket \ ```bash usage: platforms [options] discover [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--default_product_key_strategy {mapping}] [--workspace.single] [--project.single] [--repository.single] - [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] + [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--default_product_key_strategy {mapping}] + [--workspace.single] [--project.single] [--repository.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -750,11 +757,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -766,14 +771,11 @@ options: Skip Branch protection in discovery/evidence (default: False) --broad Retrieves limited information (only workspaces, repositories) (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.single Export all workspaces in a single evidence (default: False) @@ -828,12 +830,9 @@ platforms discover jenkins \ ```bash usage: platforms [options] discover [options] jenkins [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] [--broad] - [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] - [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] - [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] - [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] - [--folder.mapping [MAPPING ...]] + [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] + [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -854,28 +853,23 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to - scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder - that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no - limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: - []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, - default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index ffbd9e9ea..aac9299d4 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -23,12 +23,10 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] +usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] + [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket,azure} ... Export evidence data (Deprecated) @@ -56,8 +54,15 @@ options: Disable Valint local cache (default: False) --valint.context-type CONTEXT_TYPE Valint context type (type: str, default: ) + --valint.assume-context ASSUME_CONTEXT + Valint assume context (type: str, default: ) + --valint.payload PAYLOAD + Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) + --valint.arch ARCH Set Image architecture (type: str, default: ) + --valint.input [INPUT ...] + Valint extra input targets (default: []) --valint.output-directory OUTPUT_DIRECTORY Local evidence cache directory (type: str, default: ) --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) @@ -67,13 +72,23 @@ options: Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE Evidence predicate type (type: str, default: ) + --valint.statement STATEMENT + SLSA Evidence statement type (type: str, default: ) + --valint.source SOURCE + SLSA Source target (type: str, default: ) --valint.attest ATTEST Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7f0fc74b5800>, default: []) + --valint.label LABEL Set additional labels (type: at 0x791559f91bc0>, default: []) --unique Allow unique assets (default: False) + --valint.git-commit GIT_COMMIT + Set Input Target Git commit (type: str, default: ) + --valint.git-branch GIT_BRANCH + Set Input Target Git branch (type: str, default: ) + --valint.git-tag GIT_TAG + Set Input Target Git tag (type: str, default: ) subcommands: For more details of each subcommand, add it as an argument followed by --help. @@ -107,11 +122,8 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] - [--project.single] +usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] options: -h, --help Show this help message and exit. @@ -124,8 +136,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -161,11 +172,8 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single] - [--repository.single] +usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] + [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -178,22 +186,20 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] - Github branches wildcards (default: []) - --scope.tag [TAG ...] - Github tags wildcards (default: []) + Github branches wildcards (default: ['*']) + --scope.tag.name [NAME ...] + Github tags wildcards (default: ['*']) --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) + --tag.only Only include tags in the evidence, skip branches (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -215,14 +221,9 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] - [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] - [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -274,11 +275,8 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] - [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -330,12 +328,8 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -386,12 +380,8 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -442,14 +432,9 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] - [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] - [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] - [--project.single] [--repository.single] +usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -468,11 +453,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -485,14 +468,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --workspace.single Export all workspaces in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -515,12 +495,9 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] - [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] - [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] [--folder.single] +usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] + [--folder.single] options: -h, --help Show this help message and exit. @@ -540,28 +517,23 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to - scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder - that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no - limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: - []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, - default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.single Export all repos in a single evidence (default: False) ``` diff --git a/docs/platforms/hooks.md b/docs/platforms/hooks.md index 8e8fb7950..434f82253 100644 --- a/docs/platforms/hooks.md +++ b/docs/platforms/hooks.md @@ -57,7 +57,9 @@ When running hooks, `platforms` provides useful environment variables: - `PLATFORMS_KUBECONFIG`: Kubeconfig path with the provided `url` and `token` to platforms command (avilable for `k8s`). - `CLUSTER_URL`: Provided `url` to platforms command (avilable for `k8s`). - `NAMESPACE`: Target asset namespace (avilable for `k8s`). -- `POD`: Target asset namespace (avilable for `k8s`). +- `POD`: Target asset pod (avilable for `k8s`). + +Of course! Here's a cleaner, more formal rephrasing for the Kubernetes (K8s) parts you added, while keeping the structure and meaning you intended: #### CI and Git Context @@ -118,6 +120,7 @@ These hooks are provided by the `platforms` container along with required config | Trivy Vulnerability Scan | trivy_image | repository | dockerhub | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | image | dockerhub | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | repository | github | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | +| Trivy Vulnerability Scan | trivy_image | repository | jfrog | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | AppArmor Profile Check | apparmor_namespace | namespace | k8s | apparmor | json | | | Kubescape Cluster Scan | kubescape_cluster | namespace | k8s | kubescape | kubescape | [Apache-2.0](https://github.com/kubescape/kubescape/blob/master/LICENSE) | @@ -133,6 +136,7 @@ These hooks are provided by the `platforms` container along with required config | Gitleaks Secret Scan | gitleaks_secrets | repository | github | gitleaks | gitleaks | [MIT](https://github.com/gitleaks/gitleaks/blob/master/LICENSE) | | KICS IaC Security Scan | kics_scan | repository | github | kics | kics | [Apache-2.0](https://github.com/Checkmarx/kics/blob/master/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | repository | github | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | +| Trivy Vulnerability Scan | trivy_image | image | jfrog | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy Vulnerability Scan K8s | trivy_k8s_image | image | k8s | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | image | k8s | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | @@ -152,16 +156,19 @@ platform: github command: discover tool: trivy parser: trivy +predicate-type: auto allow_failure: false use-stdout-evidence: false license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' run: | trivy repository \ - --scanners config,secret \ + --scanners misconfig,secret \ --exit-code 0 \ --format json \ --output $HOOK_OUTPUT_FILE \ - $REMOTE_SOURCE_URL_WITH_TOKEN + ${REPO_BRANCH:+--branch "$REPO_BRANCH"} \ + ${REPO_TAG:+--tag "$REPO_TAG"} \ + $REMOTE_SOURCE_URL ``` @@ -199,15 +206,18 @@ platform: github command: bom tool: trivy parser: trivy +predicate-type: auto allow_failure: true use-stdout-evidence: false license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' run: | trivy config \ - --scanners config,secret \ + --scanners misconfig,secret \ --exit-code 0 \ --format json \ --output $HOOK_OUTPUT_FILE \ + ${REPO_BRANCH:+--branch "$REPO_BRANCH"} \ + ${REPO_TAG:+--tag "$REPO_TAG"} \ $LOCAL_SOURCE_DIR ``` @@ -297,6 +307,7 @@ platform: dockerhub command: discover tool: trivy parser: trivy +predicate-type: auto allow_failure: false use-stdout-evidence: false license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' @@ -348,6 +359,7 @@ platform: dockerhub command: bom tool: trivy parser: trivy +predicate-type: auto allow_failure: false use-stdout-evidence: false license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' @@ -400,10 +412,8 @@ tool: apparmor parser: json allow_failure: true use-stdout-evidence: false -run: "echo bash scripts/hooks/k8s-apparmor-profiles.sh \\\n --namespace $ASSET_NAME\ - \ \\\n --output $HOOK_OUTPUT_FILE \\\n --format json \n\necho bash scripts/hooks/k8s-apparmor-profiles.sh\ - \ \\\n --namespace $ASSET_NAME \\\n --output $HOOK_OUTPUT_FILE \\\n --format\ - \ json \n" +run: "sh scripts/hooks/k8s-apparmor-profiles.sh \\\n --namespace $ASSET_NAME \\\n\ + \ --output $HOOK_OUTPUT_FILE \\\n --format json \n" ``` @@ -445,10 +455,11 @@ platform: k8s command: bom tool: trivy parser: trivy +predicate-type: auto allow_failure: false use-stdout-evidence: false license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' -run: |- +run: | trivy image \ --scanners misconfig,secret \ --exit-code 0 \ @@ -458,6 +469,58 @@ run: |- ``` +
+ +Trivy Vulnerability Scan + +```yaml +name: Trivy Vulnerability Scan +id: trivy_image +type: repository +platform: jfrog +command: discover +tool: trivy +parser: sarif +allow_failure: false +use-stdout-evidence: false +predicate-type: auto +license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' +run: | + trivy image \ + --scanners vuln \ + --exit-code 0 \ + --format sarif \ + --output $HOOK_OUTPUT_FILE \ + $REMOTE_IMAGE_REF +``` +
+ +
+ +Trivy Vulnerability Scan + +```yaml +name: Trivy Vulnerability Scan +id: trivy_image +type: image +platform: jfrog +command: bom +tool: trivy +parser: sarif +allow_failure: false +use-stdout-evidence: false +predicate-type: auto +license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' +run: |- + trivy image \ + --scanners vuln \ + --exit-code 0 \ + --format sarif \ + --output $HOOK_OUTPUT_FILE \ + $REMOTE_IMAGE_REF +``` +
+ ## General hook Examples
diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index 977741988..1c20b9b14 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -61,9 +61,7 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] - [--db.local.path PATH] - {discover,evidence,bom,verify} ... +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... CLI tool for collecting evidence and enforcing policies via CI/CD platform APIs @@ -71,8 +69,7 @@ options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords - separated by comma. The supported flags are: comments, skip_default, skip_null. + Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords separated by comma. The supported flags are: comments, skip_default, skip_null. --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 82a61ef3b..326d4f728 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,12 +19,10 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.log-level LOG_LEVEL] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] - [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] - [--max-threads MAX_THREADS] +usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] + [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] + [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] + [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE] [--valint.gate-name GATE_NAME] {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins,azure} ... Verify supply chain policies @@ -37,8 +35,15 @@ options: Disable Valint local cache (default: False) --valint.context-type CONTEXT_TYPE Valint context type (type: str, default: ) + --valint.assume-context ASSUME_CONTEXT + Valint assume context (type: str, default: ) + --valint.payload PAYLOAD + Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL Valint log level (type: str, default: ) + --valint.arch ARCH Set Image architecture (type: str, default: ) + --valint.input [INPUT ...] + Valint extra input targets (default: []) --valint.output-directory OUTPUT_DIRECTORY Local evidence cache directory (type: str, default: ) --valint.bin BIN Valint CLI binary path (type: str, default: /home/mikey/.scribe/bin/valint) @@ -48,13 +53,23 @@ options: Evidence product version (type: str, default: ) --valint.predicate-type PREDICATE_TYPE Evidence predicate type (type: str, default: ) + --valint.statement STATEMENT + SLSA Evidence statement type (type: str, default: ) + --valint.source SOURCE + SLSA Source target (type: str, default: ) --valint.attest ATTEST Evidence attest type (type: str, default: x509-env) --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7fd39cf92fc0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x70a36b1dff60>, default: []) --unique Allow unique assets (default: False) + --valint.git-commit GIT_COMMIT + Set Input Target Git commit (type: str, default: ) + --valint.git-branch GIT_BRANCH + Set Input Target Git branch (type: str, default: ) + --valint.git-tag GIT_TAG + Set Input Target Git tag (type: str, default: ) --valint.bundle BUNDLE Set bundle git branch (type: str, default: ) --valint.bundle-auth BUNDLE_AUTH @@ -68,6 +83,10 @@ options: --allow-failures Allow failures without returning an error code (default: False) --max-threads MAX_THREADS Number of threads used to run valint (type: int, default: 10) + --valint.gate-type GATE_TYPE + Valint gate type (type: str, default: ) + --valint.gate-name GATE_NAME + Valint gate name (type: str, default: ) subcommands: For more details of each subcommand, add it as an argument followed by --help. @@ -140,11 +159,8 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--project.policy [POLICY ...]] [--organization.policy [POLICY ...]] [--org-policy-skip-aggregate] - [--project-policy-skip-aggregate] +usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -157,8 +173,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -168,10 +183,8 @@ options: Organization product key mapping in the format of to organization::product_key::product_version (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] Project product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --project.policy [POLICY ...] - Set project policy file (type: str, default: ['ct-2@discovery', 'ct-9@discovery']) - --organization.policy [POLICY ...] - Set organization policy file (type: str, default: ['ct-1@discovery', 'ct-3@discovery', 'ct-4@discovery']) + --initiative INITIATIVE + Set the initiative file (type: str, default: sspb-gl@v2) --org-policy-skip-aggregate Skip Aggregate organization policy results (default: False) --project-policy-skip-aggregate @@ -193,11 +206,8 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--branch.shallow] [--commit.skip] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--repository.policy [POLICY ...]] [--organization.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] + [--tag.only] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -210,24 +220,20 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] - Github branches wildcards (default: []) - --scope.tag [TAG ...] - Github tags wildcards (default: []) + Github branches wildcards (default: ['*']) + --scope.tag.name [NAME ...] + Github tags wildcards (default: ['*']) --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) + --tag.only Only include tags in the evidence, skip branches (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) - --repository.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) - --organization.policy [POLICY ...] - Set organization evidence policy file (type: str, default: ['ct-1@discovery']) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + --initiative INITIATIVE + Set initiative file (type: str, default: ssdf@v2) --org-policy-skip-aggregate Skip Aggregate organization policy results (default: False) --repo-policy-skip-aggregate @@ -248,13 +254,9 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] - [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -284,8 +286,8 @@ options: Dockerhub namespaces (default: ['*']) --image.mapping [MAPPING ...] Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) + --initiative INITIATIVE + Set initiative file (type: str, default: sspb-gl@v2) --policy-skip-aggregate Skip Aggregate policy results (default: False) ``` @@ -324,13 +326,8 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] - [--image.mapping [MAPPING ...]] [--cluster-images.policy [POLICY ...]] [--namespace.policy [POLICY ...]] - [--policy-skip-aggregate] +usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -360,12 +357,9 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: - K8sImageMappingString, default: []) - --cluster-images.policy [POLICY ...] - Set image policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) - --namespace.policy [POLICY ...] - Set Kubernetes policy file (type: str, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) + --initiative INITIATIVE + Set the initiative file (type: str, default: sspb-gl@v2) --policy-skip-aggregate Skip Aggregate policy results (default: False) ``` @@ -409,13 +403,9 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] - [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] [--image.policy [POLICY ...]] [--policy-skip-aggregate] +usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] + [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -445,8 +435,8 @@ options: Jfrog tags to exclude (default: []) --image.mapping [MAPPING ...] Image product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) - --image.policy [POLICY ...] - Set image mapping policy file (type: str, default: ['ct-8@discovery', 'ct-11@discovery', 'ct-12@discovery', 'ct-13@discovery']) + --initiative INITIATIVE + Set the initiative file (type: str, default: sspb-gl@v2) --policy-skip-aggregate Skip Aggregate policy results (default: False) ``` @@ -466,14 +456,9 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] - [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--repository.policy [POLICY ...]] [--project.policy [POLICY ...]] [--workspace.policy [POLICY ...]] - [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -492,11 +477,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -507,20 +490,13 @@ options: --branch-protection.skip Skip Branch protection in discovery/evidence (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) - --repository.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) - --project.policy [POLICY ...] - Set repository evidence policy file (type: str, default: []) - --workspace.policy [POLICY ...] - Set workspace evidence policy file (type: str, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + --initiative INITIATIVE + Set initiative file (type: str, default: ) --org-policy-skip-aggregate Skip Aggregate workspace policy results (default: False) --repo-policy-skip-aggregate From 47231a9c44b8a82361688151193d9271f6125476 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 29 Jun 2025 10:35:17 +0300 Subject: [PATCH 15/25] 'open' result for controls & initiatives explained --- docs/valint/policy-results.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/valint/policy-results.md b/docs/valint/policy-results.md index cfe4a3c83..9f4a7d97d 100644 --- a/docs/valint/policy-results.md +++ b/docs/valint/policy-results.md @@ -49,6 +49,7 @@ The results of the control verification are presented in a table format. The tab * `RESULT`: The result of the rule verification. It can be "pass", "fail" or "open". * `SUMMARY`: The reason for the rule result. * `TARGET`: The target asset of the rule verification. +* `CONTROL RESULT`: The result of the control verification. Every rule with the "error" level must pass for the control to pass. If at least one rule fails, the control fails. If no such rule fails but at least one rule returns "open," the control is considered "open." If all rules pass, the control passes. Rules with the "warning" or "note" levels do not affect the control result. The results of the initiative verification are also presented in a table format. The table consists of the following columns: @@ -56,6 +57,7 @@ The results of the initiative verification are also presented in a table format. * `CONTROL NAME`: The name of the control. * `RULE LIST`: A list of rules that were verified for the control. Each rule is mentioned as many times as it was verified. In parentheses, the rule's result is shown with consideration of the rule level: for example, if the rule failed, but the level was set to `warning`, the result of the rule evaluation will also be `warning`. * `RESULT`: The result of the control verification. It can be "pass", "fail" or "open". +* `INITIATIVE RESULT`: The result of the initiative verification. If at least one control fails, the initiative fails. If no control fails but at least one control returns "open," the initiative is considered "open." If all controls pass, the initiative passes. ## Example From 7eb80a59241e141780c779e604df11a015e04148 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 29 Jun 2025 12:33:48 +0300 Subject: [PATCH 16/25] - updated SSPB initiative descriptions - excluded links to the demodata rule (which is out of scope for this docs) - added description for the new input for the allowed-base-image rule --- .../rules/images/allowed-base-image.md | 1 + docs/configuration/initiatives/sspb-gh.md | 103 +++++++++++++++--- docs/configuration/initiatives/sspb-gl.md | 88 ++++++++++++++- 3 files changed, 176 insertions(+), 16 deletions(-) diff --git a/docs/configuration/initiatives/rules/images/allowed-base-image.md b/docs/configuration/initiatives/rules/images/allowed-base-image.md index f8706fe13..2c4b9596b 100644 --- a/docs/configuration/initiatives/rules/images/allowed-base-image.md +++ b/docs/configuration/initiatives/rules/images/allowed-base-image.md @@ -63,4 +63,5 @@ is found, a violation is recorded indicating that the necessary base image infor | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | approved_sources | array | False | A list of approved base image pattern. | +| fail_on_no_base_image | boolean | False | Whether to fail the rule if no base image is found. | diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md index de91de6ad..5f91aa186 100644 --- a/docs/configuration/initiatives/sspb-gh.md +++ b/docs/configuration/initiatives/sspb-gh.md @@ -26,11 +26,15 @@ This initiative defines a set of best practices and technical guidelines designe | [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | | [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. | | [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CTL-7] Artifacts are stored in a repository in development, stage and production](#ctl-7-artifacts-are-stored-in-a-repository-in-development-stage-and-production) | Artifacts are stored in a repository in development, stage and production | Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. | | [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | | [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CTL-10] Artifacts in higher repositories are signed](#ctl-10-artifacts-in-higher-repositories-are-signed) | Artifacts in higher repositories are signed | Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. | | [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | | [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | | [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | +| [[CTL-14] Validate Kubernetes resource manifests](#ctl-14-validate-kubernetes-resource-manifests) | Validate Kubernetes resource manifests | Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. | +| [[CTL-15] Ensure build environments are ephemeral and immutable](#ctl-15-ensure-build-environments-are-ephemeral-and-immutable) | Ensure build environments are ephemeral and immutable | Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build | ## Evidence Defaults @@ -63,6 +67,7 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| | [max-admins](rules/github/org/max-admins.md) | [max-admins](rules/github/org/max-admins.md) | Verify the maximum number of GitHub organization admins is restricted. | +| [allowed-admins](rules/github/org/allow-admins.md) | [allowed-admins](rules/github/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitHub organization. | ## [CTL-2] Only accept commits signed with a developer GPG key @@ -100,12 +105,6 @@ Ensuring that access keys used by automation expire periodically reduces the ris > :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| demodata/data@experimental | demodata/data@experimental | | - ## [CTL-4] Reduce automation access to read-only Reduce automation access to read-only @@ -120,12 +119,6 @@ CI systems should have read access only to source code repositories to limit the > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. -### Rules - -| Rule ID | Rule Name | Rule Description | -|---------|-----------|------------------| -| demodata/data@experimental | demodata/data@experimental | | - ## [CTL-5] Only dependencies from trusted registries can be used Only dependencies from trusted registries can be used @@ -151,7 +144,7 @@ Teams should be aware of implicit runtime dependencies as well as explicit build | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| demodata/data@experimental | demodata/data@experimental | | +| [allowed-base-image](rules/images/allowed-base-image.md) | [Ensure that base images are from an approved source](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | ## [CTL-6] Any critical or high severity vulnerability breaks the build @@ -177,6 +170,28 @@ Early detection reduces remediation costs, but also requires a well-defined vuln |---------|-----------|------------------| | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +## [CTL-7] Artifacts are stored in a repository in development, stage and production + +Artifacts are stored in a repository in development, stage and production + + +### Mitigation +Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. + +### **Description** + +All artifacts should be stored in a repository at each stage of the build pipeline so that there is clear traceability between the test results and the actual artifact that was tested. This control also helps to enforce the immutability of the artifacts, such that we can compare artifacts in the development, staging and production repositories and ensure that we maintain a chain of control. + +Repositories for dev, stage and production should be segregated so that role-based access control can ensure least privilege at each stage, and so that more stringent policies (such as artifact signing) can be enforced in higher environments. + +Artifacts should be promoted from repository to repository in accordance with the principle of immutability. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | + ## [CTL-8] Validate artifact digest Validate artifact digest @@ -217,6 +232,28 @@ Requiring multiple code reviews and successful tests helps ensure that no change |---------|-----------|------------------| | [merge-approval](rules/github/repository/approvals-policy-check.md) | [merge-approval](rules/github/repository/approvals-policy-check.md) | Verify the repository's pull request approval policy | +## [CTL-10] Artifacts in higher repositories are signed + +Artifacts in higher repositories are signed + + +### Mitigation +Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. + +### **Description** + +Requiring artifacts to be signed in a repository throughout the process ensures visibility and traceability for whatever is deployed to production. Requiring signed artifacts helps to ensure that untrusted binaries are not deployed to customer environments and allows validating the source of the binaries. + +> :skull: +> Through credential theft, vulnerability exploit, targeted attacks or more, attackers succeed in inserting their malicious code into pipelines and repositories. Code should be considered suspect and malicious. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | + ## [CTL-11] Available container images don’t have any high or critical vulnerabilities Available container images don’t have any high or critical vulnerabilities @@ -278,3 +315,43 @@ Production images should be validated to ensure that controls enforced during ea | [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | | [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CTL-14] Validate Kubernetes resource manifests + +Validate Kubernetes resource manifests + + +### Mitigation +Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. + +### **Description** + +The last line of defense is the _container orchestration layer_. Kubernetes is responsible for deploying the containers of the application into production, and if the resource manifests are tampered with, it could be tricked into deploying a container of the attacker’s choice. It is important to ensure that the Kubernetes resource manifests are controlled and validated just as the actual images are. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [k8s-manifests-integrity-validated](rules/generic/evidence-exists.md) | [Validate Kubernetes resource manifests integrity](rules/generic/evidence-exists.md) | Verify required evidence exists. | + +## [CTL-15] Ensure build environments are ephemeral and immutable + +Ensure build environments are ephemeral and immutable + + +### Mitigation +Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build + +### **Description** + +Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build. Build hosts should not be accessible using interactive logins. + +> :skull: +> Attackers who gain access to build environments are able to bypass controls implemented earlier in the build pipeline. Ensuring build environments are themselves defined as code and live only for the duration of a build prevents attackers from persisting in build infrastructures. + + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [ensure-ephemeral-runners](rules/github/repository/ephemeral-runners-only.md) | [ensure-ephemeral-runners](rules/github/repository/ephemeral-runners-only.md) | Verify self-hosted runners are disallowed in the GitHub repository. | diff --git a/docs/configuration/initiatives/sspb-gl.md b/docs/configuration/initiatives/sspb-gl.md index e9026adfe..d76b73550 100644 --- a/docs/configuration/initiatives/sspb-gl.md +++ b/docs/configuration/initiatives/sspb-gl.md @@ -21,16 +21,20 @@ This initiative defines a set of best practices and technical guidelines designe | Control Name | Control Description | Mitigation | |--------------|---------------------|------------| | [[CTL-1] Restrict administrative access to CI/CD tools](#ctl-1-restrict-administrative-access-to-cicd-tools) | Restrict administrative access to CI/CD tools | Limit administrative privileges to a minimal, controlled group to reduce the risk of unauthorized pipeline changes. | -| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | +| [[CTL-2] Only accept commits signed with a developer GPG key](#ctl-2-only-accept-commits-signed-with-a-developer-gpg-key) | The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab | Require all commits to be signed to improve accountability and reduce the risk of unauthorized code modifications. | | [[CTL-3] Automation access keys expire automatically](#ctl-3-automation-access-keys-expire-automatically) | Automation access keys expire automatically | Configure automation keys to expire automatically, limiting the window in which compromised keys can be exploited. | | [[CTL-4] Reduce automation access to read-only](#ctl-4-reduce-automation-access-to-read-only) | Reduce automation access to read-only | Restrict automation accounts to read-only access, following the principle of least privilege to minimize potential damage. | | [[CTL-5] Only dependencies from trusted registries can be used](#ctl-5-only-dependencies-from-trusted-registries-can-be-used) | Only dependencies from trusted registries can be used | Restrict dependencies to trusted registries to prevent the introduction of malicious code through third-party packages. | | [[CTL-6] Any critical or high severity vulnerability breaks the build](#ctl-6-any-critical-or-high-severity-vulnerability-breaks-the-build) | Any critical or high severity vulnerability breaks the build | Immediately fail the build when critical or high-severity vulnerabilities are detected, forcing prompt investigation and remediation. | +| [[CTL-7] Artifacts are stored in a repository in development, stage and production](#ctl-7-artifacts-are-stored-in-a-repository-in-development-stage-and-production) | Artifacts are stored in a repository in development, stage and production | Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. | | [[CTL-8] Validate artifact digest](#ctl-8-validate-artifact-digest) | Validate artifact digest | Validate the artifact’s digest before deployment to ensure it has not been tampered with and maintains software integrity. | | [[CTL-9] Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged](#ctl-9-pull-requests-require-two-reviewers-including-one-default-reviewer-and-a-passing-build-to-be-merged) | Pull-requests require two reviewers (including one default reviewer) and a passing build to be merged | Enforce a review process requiring at least two reviewers and a passing build, ensuring thorough evaluation and testing before code is merged. | +| [[CTL-10] Artifacts in higher repositories are signed](#ctl-10-artifacts-in-higher-repositories-are-signed) | Artifacts in higher repositories are signed | Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. | | [[CTL-11] Available container images don’t have any high or critical vulnerabilities](#ctl-11-available-container-images-dont-have-any-high-or-critical-vulnerabilities) | Available container images don’t have any high or critical vulnerabilities | Continuously scan container images for vulnerabilities and ensure that only images without high or critical issues are deployed. | | [[CTL-12] Validate artifact signatures and digests](#ctl-12-validate-artifact-signatures-and-digests) | Validate artifact signatures and digests | Ensure that artifacts are properly signed and their digests validated, confirming authenticity and preventing tampering. | | [[CTL-13] Scan deployed images in production](#ctl-13-scan-deployed-images-in-production) | Scan deployed images in production | Continuously monitor and scan production images to ensure ongoing compliance with security standards. | +| [[CTL-14] Validate Kubernetes resource manifests](#ctl-14-validate-kubernetes-resource-manifests) | Validate Kubernetes resource manifests | Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. | +| [[CTL-15] Ensure build environments are ephemeral and immutable](#ctl-15-ensure-build-environments-are-ephemeral-and-immutable) | Ensure build environments are ephemeral and immutable | Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build | ## Evidence Defaults @@ -63,10 +67,11 @@ Both host and application-layer access to CI/CD tools should be protected with m | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| | [max-admins](rules/gitlab/org/max-admins.md) | [max-admins](rules/gitlab/org/max-admins.md) | Verify the maximum number of admins for the GitLab project is restricted. | +| [allowed-admins](rules/gitlab/org/allow-admins.md) | [allowed-admins](rules/gitlab/org/allow-admins.md) | Verify only users in the Allowed List have admin privileges in the GitLab organization. | ## [CTL-2] Only accept commits signed with a developer GPG key -The use of these two rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab +The use of these rules enables first measuring the adoption of commit signing without enforcement that could interfere with the developers work, and only when signed commits are well deployed to move to enforcement by Gitlab ### Mitigation @@ -150,7 +155,7 @@ Teams should be aware of implicit runtime dependencies as well as explicit build | Rule ID | Rule Name | Rule Description | |---------|-----------|------------------| -| demodata/data@experimental | demodata/data@experimental | | +| [allowed-base-image](rules/images/allowed-base-image.md) | [Ensure that base images are from an approved source](rules/images/allowed-base-image.md) | Verifies that every base image is from an approved source. The rule returns a summary including the component names and versions of valid base images, or lists the invalid ones. This rule requires Dockerfile context; for example, run it with: `valint my_image --base-image Dockerfile`. | ## [CTL-6] Any critical or high severity vulnerability breaks the build @@ -176,6 +181,28 @@ Early detection reduces remediation costs, but also requires a well-defined vuln |---------|-----------|------------------| | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | +## [CTL-7] Artifacts are stored in a repository in development, stage and production + +Artifacts are stored in a repository in development, stage and production + + +### Mitigation +Store all artifacts in a repository at each stage of the build pipeline to ensure traceability and maintain immutability. + +### **Description** + +All artifacts should be stored in a repository at each stage of the build pipeline so that there is clear traceability between the test results and the actual artifact that was tested. This control also helps to enforce the immutability of the artifacts, such that we can compare artifacts in the development, staging and production repositories and ensure that we maintain a chain of control. + +Repositories for dev, stage and production should be segregated so that role-based access control can ensure least privilege at each stage, and so that more stringent policies (such as artifact signing) can be enforced in higher environments. + +Artifacts should be promoted from repository to repository in accordance with the principle of immutability. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | + ## [CTL-8] Validate artifact digest Validate artifact digest @@ -216,6 +243,28 @@ Requiring multiple code reviews and successful tests helps ensure that no change |---------|-----------|------------------| | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | [merge-approval](rules/gitlab/project/approvals-policy-check.md) | Verify the project's merge approval policy complies with requirements. | +## [CTL-10] Artifacts in higher repositories are signed + +Artifacts in higher repositories are signed + + +### Mitigation +Require artifacts to be signed in higher repositories to ensure authenticity and prevent tampering. + +### **Description** + +Requiring artifacts to be signed in a repository throughout the process ensures visibility and traceability for whatever is deployed to production. Requiring signed artifacts helps to ensure that untrusted binaries are not deployed to customer environments and allows validating the source of the binaries. + +> :skull: +> Through credential theft, vulnerability exploit, targeted attacks or more, attackers succeed in inserting their malicious code into pipelines and repositories. Code should be considered suspect and malicious. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | +| [artifacts-stored-in-registries](rules/images/allowed-image-source.md) | [Artifacts are stored in a repository](rules/images/allowed-image-source.md) | Ensures the main container image referenced in the SBOM is from an approved source. | + ## [CTL-11] Available container images don’t have any high or critical vulnerabilities Available container images don’t have any high or critical vulnerabilities @@ -277,3 +326,36 @@ Production images should be validated to ensure that controls enforced during ea | [sbom-is-signed](rules/sbom/artifact-signed.md) | [sbom-is-signed](rules/sbom/artifact-signed.md) | Verify the SBOM is signed. | | [disallow-dependencies](rules/sbom/blocklist-packages.md) | [disallow-dependencies](rules/sbom/blocklist-packages.md) | Verify the number of disallowed dependencies remains below the specified threshold. | | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | [stop-critical-or-high-vuln](rules/api/scribe-api-cve.md) | Verify via Scribe API that there are no critical or high severity vulnerabilities in the target artifact (container image, folder, etc.). | + +## [CTL-14] Validate Kubernetes resource manifests + +Validate Kubernetes resource manifests + + +### Mitigation +Ensure that Kubernetes manifests are validated to prevent misconfigurations and security vulnerabilities. + +### **Description** + +The last line of defense is the _container orchestration layer_. Kubernetes is responsible for deploying the containers of the application into production, and if the resource manifests are tampered with, it could be tricked into deploying a container of the attacker’s choice. It is important to ensure that the Kubernetes resource manifests are controlled and validated just as the actual images are. + +### Rules + +| Rule ID | Rule Name | Rule Description | +|---------|-----------|------------------| +| [k8s-manifests-integrity-validated](rules/generic/evidence-exists.md) | [Validate Kubernetes resource manifests integrity](rules/generic/evidence-exists.md) | Verify required evidence exists. | + +## [CTL-15] Ensure build environments are ephemeral and immutable + +Ensure build environments are ephemeral and immutable + + +### Mitigation +Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build + +### **Description** + +Build environments should be defined in code with automated creation and teardown, and that a fresh environment is created for every build. Build hosts should not be accessible using interactive logins. + +> :skull: +> Attackers who gain access to build environments are able to bypass controls implemented earlier in the build pipeline. Ensuring build environments are themselves defined as code and live only for the duration of a build prevents attackers from persisting in build infrastructures. From 3897c383dd94d9dcedca2e112d31cc0ecf76ceb0 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Sun, 29 Jun 2025 12:51:26 +0300 Subject: [PATCH 17/25] updated sidebar names to tell between SSPB implementations --- docs/configuration/initiatives/sspb-gh.md | 2 +- docs/configuration/initiatives/sspb-gl.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md index 5f91aa186..ea58c96e3 100644 --- a/docs/configuration/initiatives/sspb-gh.md +++ b/docs/configuration/initiatives/sspb-gh.md @@ -1,5 +1,5 @@ --- -sidebar_label: Secure Software Pipeline Blueprint +sidebar_label: Secure Software Pipeline Blueprint for GitHub title: Secure Software Pipeline Blueprint --- # Secure Software Pipeline Blueprint diff --git a/docs/configuration/initiatives/sspb-gl.md b/docs/configuration/initiatives/sspb-gl.md index d76b73550..9070d2bc6 100644 --- a/docs/configuration/initiatives/sspb-gl.md +++ b/docs/configuration/initiatives/sspb-gl.md @@ -1,5 +1,5 @@ --- -sidebar_label: Secure Software Pipeline Blueprint +sidebar_label: Secure Software Pipeline Blueprint for Gitlab title: Secure Software Pipeline Blueprint --- # Secure Software Pipeline Blueprint From 08348a29c924340c02a0a9dc5e262907e9eaffa0 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 30 Jun 2025 10:52:34 +0300 Subject: [PATCH 18/25] added 'control not implemented yet' warnings --- docs/configuration/initiatives/sspb-gh.md | 8 ++++++++ docs/configuration/initiatives/sspb-gl.md | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md index ea58c96e3..ff9a6f295 100644 --- a/docs/configuration/initiatives/sspb-gh.md +++ b/docs/configuration/initiatives/sspb-gh.md @@ -105,6 +105,10 @@ Ensuring that access keys used by automation expire periodically reduces the ris > :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. +:::warning +This control is not supported yet. +::: + ## [CTL-4] Reduce automation access to read-only Reduce automation access to read-only @@ -119,6 +123,10 @@ CI systems should have read access only to source code repositories to limit the > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. +:::warning +This control is not supported yet. +::: + ## [CTL-5] Only dependencies from trusted registries can be used Only dependencies from trusted registries can be used diff --git a/docs/configuration/initiatives/sspb-gl.md b/docs/configuration/initiatives/sspb-gl.md index 9070d2bc6..2bf423b9b 100644 --- a/docs/configuration/initiatives/sspb-gl.md +++ b/docs/configuration/initiatives/sspb-gl.md @@ -359,3 +359,8 @@ Build environments should be defined in code with automated creation and teardow > :skull: > Attackers who gain access to build environments are able to bypass controls implemented earlier in the build pipeline. Ensuring build environments are themselves defined as code and live only for the duration of a build prevents attackers from persisting in build infrastructures. + + +:::warning +This control is not supported yet. +::: From b71e7395a0b48d7a5caa965cf07bf472e79c6246 Mon Sep 17 00:00:00 2001 From: Viktor Kartashov Date: Mon, 30 Jun 2025 11:30:06 +0300 Subject: [PATCH 19/25] updated 'control not supported' warning text --- docs/configuration/initiatives/sspb-gh.md | 4 ++-- docs/configuration/initiatives/sspb-gl.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/configuration/initiatives/sspb-gh.md b/docs/configuration/initiatives/sspb-gh.md index ff9a6f295..90d5a22ae 100644 --- a/docs/configuration/initiatives/sspb-gh.md +++ b/docs/configuration/initiatives/sspb-gh.md @@ -106,7 +106,7 @@ Ensuring that access keys used by automation expire periodically reduces the ris > :skull: Automated systems run continuously and are attractive targets; compromised keys with a short lifespan minimize potential damage. :::warning -This control is not supported yet. +This control not currently supported on this platform. ::: ## [CTL-4] Reduce automation access to read-only @@ -124,7 +124,7 @@ CI systems should have read access only to source code repositories to limit the > :skull: Attackers who gain write access via automation credentials can bypass review processes; restricting access reduces this risk. :::warning -This control is not supported yet. +This control not currently supported on this platform. ::: ## [CTL-5] Only dependencies from trusted registries can be used diff --git a/docs/configuration/initiatives/sspb-gl.md b/docs/configuration/initiatives/sspb-gl.md index 2bf423b9b..44e5e0faa 100644 --- a/docs/configuration/initiatives/sspb-gl.md +++ b/docs/configuration/initiatives/sspb-gl.md @@ -362,5 +362,5 @@ Build environments should be defined in code with automated creation and teardow :::warning -This control is not supported yet. +This control not currently supported on this platform. ::: From 1202f3a7521ece600ac5951f592ff05b051ac2df Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 11:06:53 +0300 Subject: [PATCH 20/25] upstream version --- docs/guides/enforcing-sdlc-initiative.md | 10 +- .../ci-integrations/github/action-bom.md | 6 +- .../ci-integrations/github/action-evidence.md | 4 +- .../ci-integrations/github/action-slsa.md | 4 +- .../ci-integrations/github/action-verify.md | 4 +- docs/platforms/bom.md | 100 +++++++--- docs/platforms/discover.md | 173 ++++++++++++------ docs/platforms/evidence.md | 124 +++++++++---- docs/platforms/usage.md | 7 +- docs/platforms/verify.md | 94 +++++++--- docs/valint/help/valint_slsa.md | 3 + docs/valint/help/valint_verify.md | 4 + 12 files changed, 364 insertions(+), 169 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index 8cf685f19..f4e83ec78 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -330,11 +330,11 @@ In this case, no rule was disabled, and all of them were verified. ### Migration from an older version -Before initiatives were introduced in `valint v2.0.0`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format. +Before initiatives were introduced in `valint v2.0.1`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format. #### Rule configs migration -In general, older rule configs can be used in `valint v2.0.0` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config: +In general, older rule configs can be used in `valint v2.0.1` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config: ```yaml config-type: rule @@ -344,7 +344,7 @@ After that, you can pass the rule config to `valint` using the same `--rule` fla #### Policy configs migration -Policy configs were deprecated in `valint v2.0.0`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward. +Policy configs were deprecated in `valint v2.0.1`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward. If you use a single policy config, you can copy it entirely under the `controls` key in the new initiative config. For example, if you have a policy config like this: @@ -403,12 +403,12 @@ including smart filtering as shown in the [Rule Filtering](../valint/initiatives ::: :::note -Starting with `valint v2.0.0`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details. +Starting with `valint v2.0.1`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details. ::: #### Example -Let's take SLSA L2 as an example. Prior to `valint v2.0.0`, one could verify a single SLSA L2 rule using the following command: +Let's take SLSA L2 as an example. Prior to `valint v2.0.1`, one could verify a single SLSA L2 rule using the following command: ```bash valint verify alpine:latest --rule slsa/l2-provenance-authenticated@v1 --product-key --product-version diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 2db76b1eb..0bc1583d0 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -14,7 +14,7 @@ Further documentation **[GitHub integration](../../../integrating-scribe/ci-inte ### Bom Action The command allows users to generate sbom and third party evidence. -- CycloneDX 1.4 SBOM support. +- CycloneDX 1.5 SBOM support. - Generates detailed SBOMs for images, directories, files and git repositories targets. - Store and manage evidence on Scribe service. - Attach evidence to any OCI registry. @@ -177,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v2.0.0 + uses: scribe-security/action-bom@v2.0.1 with: target: 'busybox:latest' ``` @@ -185,7 +185,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v2.0.0 + uses: scribe-security/action-bom-cli@v2.0.1 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 5ec62566d..0bff62abc 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -142,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v2.0.0 + uses: scribe-security/action-evidence@v2.0.1 with: target: some_file.json ``` @@ -150,7 +150,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v2.0.0 + uses: scribe-security/action-evidence-cli@v2.0.1 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index b5dbe3eb1..33ea17c9d 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -161,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v2.0.0 + uses: scribe-security/action-slsa@v2.0.1 with: target: 'busybox:latest' ``` @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v2.0.0 + uses: scribe-security/action-slsa-cli@v2.0.1 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index 17e97014d..3370459aa 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -182,7 +182,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v2.0.0 + uses: scribe-security/action-verify@v2.0.1 with: target: 'busybox:latest' ``` @@ -190,7 +190,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v2.0.0 + uses: scribe-security/action-verify-cli@v2.0.1 with: target: 'hello-world:latest' ``` diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index 400a15052..1a0eaafa6 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,9 +16,14 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] + [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] + [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] + [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] + [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] + [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket,azure} ... Export bom data @@ -71,7 +76,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x77102f359080>, default: []) + --valint.label LABEL Set additional labels (type: at 0x71cbe8ddd120>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -156,9 +161,13 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] + [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -237,8 +246,12 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] - [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] + [--default_product_key_strategy {namespace,pod,image,mapping}] + [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -266,7 +279,8 @@ options: --exclude.image [IMAGE ...] Images to exclude from discovery process (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: + K8sImageMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_k8s_image, trivy_iac_and_secrets. (default: []) @@ -318,9 +332,14 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] + [--default_product_key_strategy {jf-repository,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] + [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -375,8 +394,11 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] +usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -422,8 +444,11 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] + [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] + [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: @@ -443,9 +468,11 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -458,11 +485,14 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are + supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) ``` @@ -484,8 +514,12 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] +usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] + [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -498,7 +532,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace + / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -509,9 +544,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are + supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: opengrep, trivy_iac_and_secrets, gitleaks_secrets, kics_scan. (default: []) @@ -539,8 +576,10 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -553,7 +592,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index 92f2983da..31f4875b5 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -22,10 +22,15 @@ The evidence generation process uses Scribe's `valint` tool to upload and option --> ```bash -usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] - [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] - [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] - [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] + [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] + [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] + [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] + [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] + [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] + [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket,azure} ... Discover assets and save data to a local store @@ -86,7 +91,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x79b17cc96de0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7a399b53a840>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -148,11 +153,15 @@ platforms discover gitlab \ --> ```bash -usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] - [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] [--token TOKEN] [--url URL] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] - [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] [--skip-cache] - [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] + [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] + [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] + [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] + [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--organization.single] [--project.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -167,7 +176,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -250,13 +260,20 @@ platforms discover github \ --> ```bash -usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] - [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] [--token TOKEN] [--url URL] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] - [--workflow.skip] [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]] [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] [--bom] - [--provenance] [--bom.scope.branch [BRANCH ...]] [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]] [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] [--slsa.all-versions] - [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache] [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--skip-cache] [--cache-ttl CACHE_TTL] - [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] + [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] + [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] + [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] + [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] [--workflow.skip] + [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]] + [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] + [--hook.skip] [--repository.hooks [HOOKS ...]] [--bom] [--provenance] [--bom.scope.branch [BRANCH ...]] + [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]] + [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] [--slsa.all-versions] + [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache] + [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -271,7 +288,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace + / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -322,9 +340,11 @@ options: --slsa.cache-group CACHE_GROUP Scribe SLSA cache group, default to runners pipeline ID, empty to use global context (default: any) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are + supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --skip-cache, -f Skip Scribe Evidence cache lookup (default: False) --cache-ttl CACHE_TTL time to live for cache (default: 2d) @@ -370,11 +390,16 @@ platforms discover dockerhub \ --> ```bash -usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] - [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] - [--namespace.single] [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] - [--hook.skip] [--repository.hook [HOOK ...]] +usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] + [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] + [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] + [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -455,9 +480,15 @@ platforms discover k8s \ --> ```bash -usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] - [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] +usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] + [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] + [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] + [--token TOKEN] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] + [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] + [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] + [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] + [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. @@ -548,11 +579,17 @@ platforms discover jfrog \ --> ```bash -usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] - [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] - [--scope.tag_limit TAG_LIMIT] [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] +usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] + [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] + [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] + [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] + [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]] + [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -581,7 +618,8 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 20) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days + filter. 0 for no limit, default is 10. (type: int, default: 20) --broad Retrieves limited information (only jf-repositories and repositories) (default: False) --jf-repository.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -645,10 +683,15 @@ platforms discover ecr \ --> ```bash -usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] [--token TOKEN] [--url URL] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] + [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] + [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] + [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] + [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] + [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -677,7 +720,8 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 10) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days + filter. 0 for no limit, default is 10. (type: int, default: 10) --broad Retrieves limited information (only aws-account and repository) (default: False) --aws-account.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -736,9 +780,13 @@ platforms discover bitbucket \ ```bash usage: platforms [options] discover [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--default_product_key_strategy {mapping}] - [--workspace.single] [--project.single] [--repository.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] + [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] + [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--default_product_key_strategy {mapping}] [--workspace.single] [--project.single] [--repository.single] + [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -757,9 +805,11 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -771,11 +821,14 @@ options: Skip Branch protection in discovery/evidence (default: False) --broad Retrieves limited information (only workspaces, repositories) (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are + supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.single Export all workspaces in a single evidence (default: False) @@ -830,9 +883,12 @@ platforms discover jenkins \ ```bash usage: platforms [options] discover [options] jenkins [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] [--broad] - [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] - [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] + [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] + [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] + [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] + [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] + [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] + [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -853,23 +909,28 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. - folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to + scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder + that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: + ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no + limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: + []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, + default: []) ``` diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index aac9299d4..5a3592ed7 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -23,10 +23,14 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] - [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] - [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] + [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] + [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] + [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] + [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] + [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket,azure} ... Export evidence data (Deprecated) @@ -81,7 +85,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x791559f91bc0>, default: []) + --valint.label LABEL Set additional labels (type: at 0x749f8ea05c60>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -122,8 +126,11 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] +usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] + [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] + [--project.single] options: -h, --help Show this help message and exit. @@ -136,7 +143,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -172,8 +180,11 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] - [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] +usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -186,7 +197,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace + / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -197,9 +209,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are + supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -221,9 +235,14 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] + [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] + [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -275,8 +294,11 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] + [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -328,8 +350,12 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -380,8 +406,12 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] + [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -432,9 +462,14 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] [--project.single] [--repository.single] +usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] + [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] + [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] + [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] + [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] + [--project.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -453,9 +488,11 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -468,11 +505,14 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are + supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --workspace.single Export all workspaces in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -495,9 +535,12 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] - [--folder.single] +usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] + [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] + [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] + [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] [--folder.single] options: -h, --help Show this help message and exit. @@ -517,23 +560,28 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. - folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to + scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder + that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: + ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no + limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: + []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, + default: []) --folder.single Export all repos in a single evidence (default: False) ``` diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index 1c20b9b14..977741988 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -61,7 +61,9 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] + [--db.local.path PATH] + {discover,evidence,bom,verify} ... CLI tool for collecting evidence and enforcing policies via CI/CD platform APIs @@ -69,7 +71,8 @@ options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords separated by comma. The supported flags are: comments, skip_default, skip_null. + Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords + separated by comma. The supported flags are: comments, skip_default, skip_null. --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 326d4f728..091f89fbe 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,10 +19,15 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] - [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] - [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] - [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE] [--valint.gate-name GATE_NAME] +usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] + [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] + [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] + [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] + [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE] + [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] + [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE] + [--valint.gate-name GATE_NAME] {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins,azure} ... Verify supply chain policies @@ -62,7 +67,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x70a36b1dff60>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7381d5ad4040>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -159,8 +164,10 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] +usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] + [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] + [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -173,7 +180,8 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -206,8 +214,11 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] - [--tag.only] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] + [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] + [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -220,7 +231,8 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace + / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -229,9 +241,11 @@ options: --commit.skip Skip commits in discovery/evidence (default: False) --tag.only Only include tags in the evidence, skip branches (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are + supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --initiative INITIATIVE Set initiative file (type: str, default: ssdf@v2) --org-policy-skip-aggregate @@ -254,9 +268,13 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] + [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] + [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -326,8 +344,12 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] +usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] + [--default_product_key_strategy {namespace,pod,image,mapping}] + [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] + [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] + [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -357,7 +379,8 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: + K8sImageMappingString, default: []) --initiative INITIATIVE Set the initiative file (type: str, default: sspb-gl@v2) --policy-skip-aggregate @@ -403,9 +426,13 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] - [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] +usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] + [--default_product_key_strategy {jf-repository,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] + [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] + [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] + [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -456,8 +483,12 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] +usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] + [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] + [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] + [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] + [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: @@ -477,9 +508,11 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / + project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format + 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -490,11 +523,14 @@ options: --branch-protection.skip Skip Branch protection in discovery/evidence (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are + supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported + (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported + (type: AssetMappingString, default: []) --initiative INITIATIVE Set initiative file (type: str, default: ) --org-policy-skip-aggregate diff --git a/docs/valint/help/valint_slsa.md b/docs/valint/help/valint_slsa.md index dc6feb12f..9865db9df 100644 --- a/docs/valint/help/valint_slsa.md +++ b/docs/valint/help/valint_slsa.md @@ -51,6 +51,9 @@ Flags for `slsa` subcommand | | --pubkey | Public key path | | | -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --source | Git repository source for target | | +| | --source-asset-id | Source asset id for Git source repo | | +| | --source-asset-name | Source asset name for Git source repo | | +| | --source-asset-platform | Source asset platform for Git source repo | | | | --started-on | Set metadata started time (YYYY-MM-DDThh:mm:ssZ) | | | | --statement | Import statement path | | diff --git a/docs/valint/help/valint_verify.md b/docs/valint/help/valint_verify.md index bb9f514ff..81e2089a1 100644 --- a/docs/valint/help/valint_verify.md +++ b/docs/valint/help/valint_verify.md @@ -65,6 +65,10 @@ Flags for `verify` subcommand | | --skip-bundle | Skip bundle download | | | -y | --skip-confirmation | Skip Sigstore Confirmation | | | | --skip-report | Skip Policy report stage | | +| | --source | SLSA Git repository source for target | | +| | --source-asset-id | Source asset id for SLSA Git repository source | | +| | --source-asset-name | Source asset name for SLSA Git repository source | | +| | --source-asset-platform | Source asset platform for SLSA Git repository source | | | | --uri | Default policy allowed uris | | From e4bd0a002ac49b4747c8911e6c656e3b77ee730c Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 13:23:43 +0300 Subject: [PATCH 21/25] update readme --- scripts/sync_docs.sh | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index 1c3e0fbd5..3247faf8d 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -340,9 +340,26 @@ sidebar_position: 4 export_azure-tasks() { repo="azure-tasks" repo_dir="${submodules_dir}/${repo}" - dst_dir="docs/integrating-scribe/ci-integrations" - - sed -n '/^# Azure Pipelines Task/,$p' ${dst_dir}/azure.md > ${repo_dir}/README.md + src="docs/integrating-scribe/ci-integrations/azure.md" + dst="${repo_dir}/README.md" + + # 1) grab the title from front-matter + title=$(grep '^title:' "$src" | sed 's/^title:[[:space:]]*//') + + # 2) write out a new README: + { + # H1 from title + echo "# $title" + echo + + # skip until after the second '---' line, then print everything + awk 'c<2 { + if (/^---/) { c++; } + next + } + { print } + ' "$src" + } > "$dst" } import_cli() { From 7994b500a3713cf28c64501d919d9ee39a712b61 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 13:27:18 +0300 Subject: [PATCH 22/25] update readme --- .github/workflows/export.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/export.yaml b/.github/workflows/export.yaml index bed2d3f6c..de694dfe6 100644 --- a/.github/workflows/export.yaml +++ b/.github/workflows/export.yaml @@ -12,7 +12,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-24.04] # TODO: only build - repo: ["valint", "action-bom", "action-verify", "action-slsa", "orbs", "azure-tasks", "helm-charts", "valint-pipe"] + repo: ["valint", "action-bom", "action-verify", "action-slsa", "action-evidence", "orbs", "azure-tasks", "helm-charts", "valint-pipe"] runs-on: ${{ matrix.os }} defaults: run: From 69365e7a692264276139e6bedeb3406f97c1ca60 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 13:40:34 +0300 Subject: [PATCH 23/25] test marsh --- docs/guides/enforcing-sdlc-initiative.md | 10 +++++----- .../ci-integrations/github/action-bom.md | 4 ++-- .../ci-integrations/github/action-evidence.md | 4 ++-- .../ci-integrations/github/action-slsa.md | 4 ++-- .../ci-integrations/github/action-verify.md | 4 ++-- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/guides/enforcing-sdlc-initiative.md b/docs/guides/enforcing-sdlc-initiative.md index f4e83ec78..072f5811b 100644 --- a/docs/guides/enforcing-sdlc-initiative.md +++ b/docs/guides/enforcing-sdlc-initiative.md @@ -330,11 +330,11 @@ In this case, no rule was disabled, and all of them were verified. ### Migration from an older version -Before initiatives were introduced in `valint v2.0.1`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format. +Before initiatives were introduced in `valint v2.0.2`, a slightly different format of configs was used for the policy engine. Essentially, there were only `rule` and `policy` configs, so if you're using one of those, here's how you can migrate to the new format. #### Rule configs migration -In general, older rule configs can be used in `valint v2.0.1` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config: +In general, older rule configs can be used in `valint v2.0.2` and newer with some minor changes. The main difference is that, from now on, `valint` requires each config to state its format. The only change needed is to add this line to your rule config: ```yaml config-type: rule @@ -344,7 +344,7 @@ After that, you can pass the rule config to `valint` using the same `--rule` fla #### Policy configs migration -Policy configs were deprecated in `valint v2.0.1`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward. +Policy configs were deprecated in `valint v2.0.2`. Policies themselves were renamed to _controls_ and are now consumed as part of the _initiative_ config. The migration process is slightly more complex but still quite straightforward. If you use a single policy config, you can copy it entirely under the `controls` key in the new initiative config. For example, if you have a policy config like this: @@ -403,12 +403,12 @@ including smart filtering as shown in the [Rule Filtering](../valint/initiatives ::: :::note -Starting with `valint v2.0.1`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details. +Starting with `valint v2.0.2`, some initiatives are shipped as part of the Scribe Catalog. See [this section](#example) and [this section](#sample-policy-catalog) for more details. ::: #### Example -Let's take SLSA L2 as an example. Prior to `valint v2.0.1`, one could verify a single SLSA L2 rule using the following command: +Let's take SLSA L2 as an example. Prior to `valint v2.0.2`, one could verify a single SLSA L2 rule using the following command: ```bash valint verify alpine:latest --rule slsa/l2-provenance-authenticated@v1 --product-key --product-version diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 0bc1583d0..775debb5f 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -177,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v2.0.1 + uses: scribe-security/action-bom@v2.0.2 with: target: 'busybox:latest' ``` @@ -185,7 +185,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v2.0.1 + uses: scribe-security/action-bom-cli@v2.0.2 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 0bff62abc..6e87398f9 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -142,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v2.0.1 + uses: scribe-security/action-evidence@v2.0.2 with: target: some_file.json ``` @@ -150,7 +150,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v2.0.1 + uses: scribe-security/action-evidence-cli@v2.0.2 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 33ea17c9d..6763aa0f3 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -161,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v2.0.1 + uses: scribe-security/action-slsa@v2.0.2 with: target: 'busybox:latest' ``` @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v2.0.1 + uses: scribe-security/action-slsa-cli@v2.0.2 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index 3370459aa..ff0171c51 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -182,7 +182,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v2.0.1 + uses: scribe-security/action-verify@v2.0.2 with: target: 'busybox:latest' ``` @@ -190,7 +190,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v2.0.1 + uses: scribe-security/action-verify-cli@v2.0.2 with: target: 'hello-world:latest' ``` From 550a7f4034027c564c76daf2e68a992d28d2fc9b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 14:16:31 +0300 Subject: [PATCH 24/25] test marsh --- scripts/sync_docs.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/scripts/sync_docs.sh b/scripts/sync_docs.sh index 3247faf8d..6b0f9af98 100644 --- a/scripts/sync_docs.sh +++ b/scripts/sync_docs.sh @@ -194,6 +194,10 @@ import_action-installer() { import_action-slsa() { import_action "action-slsa" } +import_action-evidence() { + repo="action-evidence" + import_action ${repo} +} export_action-bom() { repo="action-bom" @@ -215,6 +219,12 @@ export_action-slsa() { export_action_extra ${repo} } +export_action-evidence() { + repo="action-evidence" + export_action ${repo} + export_action_extra ${repo} +} + import_valint-pipe() { repo="valint-pipe" repo_dir="${submodules_dir}/${repo}" From 685b7cae325153d6066cc81e20404d12ef4fa6ad Mon Sep 17 00:00:00 2001 From: houdini91 Date: Tue, 8 Jul 2025 14:17:13 +0300 Subject: [PATCH 25/25] remove empty files --- docs/guides/secure-sfw-slsa/s | 0 docs/guides/secure-sfw-slsa/s2 | 0 2 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 docs/guides/secure-sfw-slsa/s delete mode 100644 docs/guides/secure-sfw-slsa/s2 diff --git a/docs/guides/secure-sfw-slsa/s b/docs/guides/secure-sfw-slsa/s deleted file mode 100644 index e69de29bb..000000000 diff --git a/docs/guides/secure-sfw-slsa/s2 b/docs/guides/secure-sfw-slsa/s2 deleted file mode 100644 index e69de29bb..000000000