diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 9a7f74a7d..d3a0cb96e 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -49,9 +49,6 @@ Behind the scenes, Scribe Platforms performs several steps to turn raw workflow * **Run SLSA-compliance initiatives** Once each provenance file is written, Scribe automatically executes the matching policy-as-code initiative (`slsa.l1` for unsigned L1, `slsa.l2` for signed L2). The initiative verifies the evidence set, emits a SARIF report, and—when applicable—signs that report before attaching it as additional evidence. -* **Execute SLSA Compliance Initiatives** -After provenance generation, Scribe automatically applies relevant policy-as-code initiatives (`slsa.l1` or `slsa.l2`). These initiatives validate the evidence, generate a SARIF report detailing compliance status, and (for Level 2) sign this report as additional, verifiable evidence. - ## 🧪 Example Usage L1 (Unsigned Provenance) diff --git a/docs/integrating-scribe/ci-integrations/github/action-bom.md b/docs/integrating-scribe/ci-integrations/github/action-bom.md index 7db826b6f..11c70ff5d 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-bom.md +++ b/docs/integrating-scribe/ci-integrations/github/action-bom.md @@ -177,7 +177,7 @@ To overcome the limitation install tool directly - **[installer](https://github. Containerized action can be used on Linux runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom@v2.0.3 + uses: scribe-security/action-bom@v2.0.4 with: target: 'busybox:latest' ``` @@ -185,7 +185,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-bom-cli@v2.0.3 + uses: scribe-security/action-bom-cli@v2.0.4 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-evidence.md b/docs/integrating-scribe/ci-integrations/github/action-evidence.md index 18e6d951c..cc6ebaddd 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-evidence.md +++ b/docs/integrating-scribe/ci-integrations/github/action-evidence.md @@ -142,7 +142,7 @@ The `valint evidence` action is a versatile action designed to include various t Containerized action can be used on Linux runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence@v2.0.3 + uses: scribe-security/action-evidence@v2.0.4 with: target: some_file.json ``` @@ -150,7 +150,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Include evidence derived from a file - uses: scribe-security/action-evidence-cli@v2.0.3 + uses: scribe-security/action-evidence-cli@v2.0.4 with: target: some_file.json ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-slsa.md b/docs/integrating-scribe/ci-integrations/github/action-slsa.md index 422703463..8ac6a4b22 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-slsa.md +++ b/docs/integrating-scribe/ci-integrations/github/action-slsa.md @@ -161,7 +161,7 @@ To overcome the limitation install tool directly - [installer](https://github.co Containerized action can be used on Linux runners as following ```yaml - name: Generate SLSA provenance - uses: scribe-security/action-slsa@v2.0.3 + uses: scribe-security/action-slsa@v2.0.4 with: target: 'busybox:latest' ``` @@ -169,7 +169,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-slsa-cli@v2.0.3 + uses: scribe-security/action-slsa-cli@v2.0.4 with: target: 'hello-world:latest' ``` diff --git a/docs/integrating-scribe/ci-integrations/github/action-verify.md b/docs/integrating-scribe/ci-integrations/github/action-verify.md index d668c05cc..0a45c22e1 100644 --- a/docs/integrating-scribe/ci-integrations/github/action-verify.md +++ b/docs/integrating-scribe/ci-integrations/github/action-verify.md @@ -182,7 +182,7 @@ Containerized action can be used on Linux runners as following ```yaml - name: valint verify id: valint_verify - uses: scribe-security/action-verify@v2.0.3 + uses: scribe-security/action-verify@v2.0.4 with: target: 'busybox:latest' ``` @@ -190,7 +190,7 @@ Containerized action can be used on Linux runners as following Composite Action can be used on Linux or Windows runners as following ```yaml - name: Generate cyclonedx json SBOM - uses: scribe-security/action-verify-cli@v2.0.3 + uses: scribe-security/action-verify-cli@v2.0.4 with: target: 'hello-world:latest' ``` diff --git a/docs/platforms/bom.md b/docs/platforms/bom.md index 1a0eaafa6..4a4fa2ed0 100644 --- a/docs/platforms/bom.md +++ b/docs/platforms/bom.md @@ -16,14 +16,9 @@ This command enables users to generate SBOMs on scale. --> ```bash -usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] - [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] - [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] - [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] - [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] - [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] - [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] - [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] bom [-h] [--allow-failures] [--save-scan-plan] [--dry-run] [--monitor.mount MOUNT] [--monitor.threshold THRESHOLD] [--monitor.clean-docker] [--max-threads MAX_THREADS] [--evidence.local.path PATH] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] + [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] + [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,bitbucket,azure} ... Export bom data @@ -54,7 +49,7 @@ options: --valint.payload PAYLOAD Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL - Valint log level (type: str, default: ) + Valint log level (type: str, default: quiet) --valint.arch ARCH Set Image architecture (type: str, default: ) --valint.input [INPUT ...] Valint extra input targets (default: []) @@ -76,7 +71,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x71cbe8ddd120>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7ad3cea82660>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -161,13 +156,9 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--default_product_key_strategy {namespace,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -246,12 +237,8 @@ Note that the image characterization string is a wildcarded string, with separat --> ```bash -usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] + [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -279,8 +266,7 @@ options: --exclude.image [IMAGE ...] Images to exclude from discovery process (default: []) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: - K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_k8s_image, trivy_iac_and_secrets. (default: []) @@ -332,14 +318,9 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] - [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] - [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]] +usage: platforms [options] bom [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] [--image.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -394,11 +375,8 @@ platforms bom ecr --image.mapping "*.dkr.ecr.*.amazonaws.com/my-image*::my-produ --> ```bash -usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] +usage: platforms [options] bom [options] ecr [-h] [--instance.instance INSTANCE] [--default_product_key_strategy {aws-account,repository,tag,mapping}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--url URL] [--image.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -444,11 +422,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] - [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] - [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] +usage: platforms [options] bom [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] options: @@ -468,11 +443,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -485,14 +458,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) ``` @@ -514,12 +484,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] - [--repository.hooks [HOOKS ...]] +usage: platforms [options] bom [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -532,23 +498,20 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] - Github branches wildcards (default: ['*']) + Github branches wildcards (default: []) --scope.tag.name [NAME ...] - Github tags wildcards (default: ['*']) + Github tags wildcards (default: []) --branch.shallow Shallow branch discovery (default: False) --commit.skip Skip commits in discovery/evidence (default: False) --tag.only Only include tags in the evidence, skip branches (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: opengrep, trivy_iac_and_secrets, gitleaks_secrets, kics_scan. (default: []) @@ -576,10 +539,8 @@ Note that the image characterization string is a wildcarded string, some useful --> ```bash -usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] +usage: platforms [options] bom [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -592,8 +553,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] diff --git a/docs/platforms/discover.md b/docs/platforms/discover.md index 31f4875b5..2d0c88ff2 100644 --- a/docs/platforms/discover.md +++ b/docs/platforms/discover.md @@ -22,15 +22,10 @@ The evidence generation process uses Scribe's `valint` tool to upload and option --> ```bash -usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] - [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] - [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] - [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] - [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] discover [-h] [--check-token-permissions] [--db.local.store_policy {update,replace}] [--db.update_period UPDATE_PERIOD] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] + [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] + [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] + [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,dockerhub,k8s,github,jfrog,ecr,jenkins,bitbucket,azure} ... Discover assets and save data to a local store @@ -69,7 +64,7 @@ options: --valint.payload PAYLOAD Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL - Valint log level (type: str, default: ) + Valint log level (type: str, default: quiet) --valint.arch ARCH Set Image architecture (type: str, default: ) --valint.input [INPUT ...] Valint extra input targets (default: []) @@ -91,7 +86,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7a399b53a840>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7c3353adfd80>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -153,15 +148,11 @@ platforms discover gitlab \ --> ```bash -usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] - [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] - [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] - [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] - [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] - [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] - [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--organization.single] [--project.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] gitlab [-h] [--instance.instance INSTANCE] [--types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule,all} ...]] + [--exclude.types {organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} [{organization,project,authenticated_user,member,token,variable,branch,user,commit,pipeline,job,rule} ...]] [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] [--scope.skip_org_members] [--scope.skip_project_members] + [--scope.commit.past_days PAST_DAYS] [--scope.pipeline.past_days PAST_DAYS] [--scope.pipeline.analyzed_logs] [--scope.pipeline.reports] [--broad] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] [--skip-cache] + [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -176,8 +167,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -260,20 +250,13 @@ platforms discover github \ --> ```bash -usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] - [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] - [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] - [--token TOKEN] [--url URL] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] - [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] - [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] [--workflow.skip] - [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]] - [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] - [--hook.skip] [--repository.hooks [HOOKS ...]] [--bom] [--provenance] [--bom.scope.branch [BRANCH ...]] - [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]] - [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] [--slsa.all-versions] - [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache] - [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] +usage: platforms [options] discover [options] github [-h] [--instance.instance INSTANCE] [--types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable,all} ...]] + [--exclude.types {organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} [{organization,repository,branch,commit,workflow,run,member,authenticated_user,collaborator,secret,variable} ...]] [--token TOKEN] [--url URL] + [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--scope.commit.past_days PAST_DAYS] + [--workflow.skip] [--scope.workflow.past_days PAST_DAYS] [--scope.workflow.analyzed_logs] [--scope.workflow.name [NAME ...]] [--scope.workflow.run [RUN ...]] [--scope.runners] [--scope.api-sbom] [--broad] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] + [--repository.hooks [HOOKS ...]] [--bom] [--provenance] [--bom.scope.branch [BRANCH ...]] [--slsa.scope.branch [BRANCH ...]] [--slsa.scope.tag [TAG ...]] [--slsa.scope.workflow [WORKFLOW ...]] [--slsa.scope.image [IMAGE ...]] [--slsa-enable] [--slsa.tags-only] + [--slsa.all-versions] [--slsa.types {source_sbom,image_sbom,all} [{source_sbom,image_sbom,all} ...]] [--slsa.skip-cache] [--slsa.cache-ttl CACHE_TTL] [--slsa.cache-group CACHE_GROUP] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--skip-cache] + [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -288,8 +271,7 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -308,12 +290,14 @@ options: Include analyzed workflow logs (default: False) --scope.workflow.name [NAME ...] Scope Workflow names (default: ['*']) + --scope.workflow.run [RUN ...] + Scope Workflow runs by ID (default: ['*']) --scope.runners Include repository allocated runners in evidence (default: False) --scope.api-sbom Include repositories SBOM in evidence (default: False) --broad Retrieves limited information (only organizations, repositories and workflows) (default: False) --hook-config [HOOK_CONFIG ...] Paths to YAML files containing custom hook definitions. (type: str, default: []) - --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_iac_and_secrets. (default: []) + --hook [HOOK ...] Specify hook IDs to execute. Available preconfigured hooks are: trivy_iac_and_secrets, trivy_iac_and_secrets_sarif. (default: []) --hook.skip Skip hooks (default: False) --repository.hooks [HOOKS ...] Inline hook format :::::: (type: ToolHookString, default: []) @@ -340,11 +324,9 @@ options: --slsa.cache-group CACHE_GROUP Scribe SLSA cache group, default to runners pipeline ID, empty to use global context (default: any) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --skip-cache, -f Skip Scribe Evidence cache lookup (default: False) --cache-ttl CACHE_TTL time to live for cache (default: 2d) @@ -390,16 +372,11 @@ platforms discover dockerhub \ --> ```bash -usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] - [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] - [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] - [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] [--namespace.single] - [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] - [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hook [HOOK ...]] +usage: platforms [options] discover [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,namespace,repository,repository_tag,webhook,token,all} [{instance,namespace,repository,repository_tag,webhook,token,all} ...]] + [--exclude.types {instance,namespace,repository,repository_tag,webhook,token} [{instance,namespace,repository,repository_tag,webhook,token} ...]] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--namespace-list [NAMESPACE_LIST ...]] [--scope.past_days PAST_DAYS] [--broad] + [--namespace.single] [--repository.single] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] + [--hook.skip] [--repository.hook [HOOK ...]] options: -h, --help Show this help message and exit. @@ -480,15 +457,9 @@ platforms discover k8s \ --> ```bash -usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] - [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] - [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] - [--token TOKEN] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] - [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] - [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] +usage: platforms [options] discover [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,secret,deployment,all} [{namespace,pod,secret,deployment,all} ...]] [--exclude.types {namespace,pod,secret,deployment} [{namespace,pod,secret,deployment} ...]] [--url URL] [--token TOKEN] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--secret.skip] [--deployment.skip] [--broad] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] + [--pod.mapping [MAPPING ...]] [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--namespace.hooks [HOOKS ...]] [--default_product_key_strategy {namespace,pod,image,mapping}] options: -h, --help Show this help message and exit. @@ -579,17 +550,11 @@ platforms discover jfrog \ --> ```bash -usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] - [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] - [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] - [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] - [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] [--hook-config [HOOK_CONFIG ...]] - [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] +usage: platforms [options] discover [options] jfrog [-h] [--instance.instance INSTANCE] [--types {jf-repository,repository,repository_tag,user,token,webhook,all} [{jf-repository,repository,repository_tag,user,token,webhook,all} ...]] + [--exclude.types {jf-repository,repository,repository_tag,user,token,webhook} [{jf-repository,repository,repository_tag,user,token,webhook} ...]] [--token TOKEN] [--url URL] [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] + [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] + [--scope.tag_limit TAG_LIMIT] [--broad] [--jf-repository.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--instance.mapping [MAPPING ...]] [--jf-repository.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] + [--hook-config [HOOK_CONFIG ...]] [--hook [HOOK ...]] [--hook.skip] [--repository.hooks [HOOKS ...]] options: -h, --help Show this help message and exit. @@ -618,8 +583,7 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days - filter. 0 for no limit, default is 10. (type: int, default: 20) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 20) --broad Retrieves limited information (only jf-repositories and repositories) (default: False) --jf-repository.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -683,15 +647,10 @@ platforms discover ecr \ --> ```bash -usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] - [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] - [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] - [--token TOKEN] [--url URL] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] - [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] - [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] discover [options] ecr [-h] [--instance.instance INSTANCE] [--types {aws-account,repository,repository_tags,all} [{aws-account,repository,repository_tags,all} ...]] [--exclude.types {aws-account,repository,repository_tags} [{aws-account,repository,repository_tags} ...]] [--token TOKEN] [--url URL] + [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.past_days PAST_DAYS] [--scope.tag_limit TAG_LIMIT] [--broad] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] + [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -720,8 +679,7 @@ options: --scope.past_days PAST_DAYS Ignore tags pushed earlier that previous to this number of days (type: int, default: 30) --scope.tag_limit TAG_LIMIT - Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days - filter. 0 for no limit, default is 10. (type: int, default: 10) + Limit the number of recent tags to be discovered. Scoping to tag names is done on the limited tag list. Limit applies also to the past_days filter. 0 for no limit, default is 10. (type: int, default: 10) --broad Retrieves limited information (only aws-account and repository) (default: False) --aws-account.mapping [MAPPING ...] Repository product key mapping in the format of asset::product_key::product_version (type: AssetMappingString, default: []) @@ -780,13 +738,9 @@ platforms discover bitbucket \ ```bash usage: platforms [options] discover [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} [{workspace,project,repository,branch,commit,authenticated_user,webhooks,repo_permission,user_permission,branch_protection,token,all} ...]] - [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--default_product_key_strategy {mapping}] [--workspace.single] [--project.single] [--repository.single] - [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] + [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] + [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--broad] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--default_product_key_strategy {mapping}] + [--workspace.single] [--project.single] [--repository.single] [--skip-cache] [--cache-ttl CACHE_TTL] [--cache-group CACHE_GROUP] options: -h, --help Show this help message and exit. @@ -805,11 +759,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -821,14 +773,11 @@ options: Skip Branch protection in discovery/evidence (default: False) --broad Retrieves limited information (only workspaces, repositories) (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.single Export all workspaces in a single evidence (default: False) @@ -883,12 +832,9 @@ platforms discover jenkins \ ```bash usage: platforms [options] discover [options] jenkins [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--url URL] [--broad] - [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] - [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] - [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] - [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] - [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] - [--folder.mapping [MAPPING ...]] + [--types {all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} [{all,computer_set,users,jobs,job_runs,credential_stores,plugins,security_settings,all} ...]] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] + [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] + [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -909,28 +855,23 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to - scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder - that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no - limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: - []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, - default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) ``` diff --git a/docs/platforms/evidence.md b/docs/platforms/evidence.md index 5a3592ed7..1a80ba370 100644 --- a/docs/platforms/evidence.md +++ b/docs/platforms/evidence.md @@ -23,14 +23,10 @@ The evidence command uses Scribe's `valint` tool to upload the evidence and to s --> ```bash -usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] - [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] - [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] - [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] - [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] - [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] +usage: platforms [options] evidence [-h] [--evidence.local.path PATH] [--evidence.local.prefix PREFIX] [--evidence.local_only] [--max-threads MAX_THREADS] [--thread-timeout THREAD_TIMEOUT] [--rate-limit-retry RATE_LIMIT_RETRY] [--allow-failures] [--export-partial] [--skip-evidence] [--valint.scribe.client-secret CLIENT_SECRET] + [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] + [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] + [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] {gitlab,k8s,dockerhub,github,jfrog,ecr,jenkins,bitbucket,azure} ... Export evidence data (Deprecated) @@ -63,7 +59,7 @@ options: --valint.payload PAYLOAD Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL - Valint log level (type: str, default: ) + Valint log level (type: str, default: quiet) --valint.arch ARCH Set Image architecture (type: str, default: ) --valint.input [INPUT ...] Valint extra input targets (default: []) @@ -85,7 +81,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x749f8ea05c60>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7542684831a0>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -126,11 +122,8 @@ platforms evidence gitlab --organization.mapping "my-org::my-product::1.0" --pro --> ```bash -usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] [--default_product_key_strategy {mapping}] - [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] - [--project.single] +usage: platforms [options] evidence [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--pipeline.skip] + [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--organization.single] [--project.single] options: -h, --help Show this help message and exit. @@ -143,8 +136,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -180,11 +172,8 @@ platforms evidence github --organization.mapping "my-org::my-product::1.0" --rep --> ```bash -usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] - [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] +usage: platforms [options] evidence [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] + [--commit.skip] [--tag.only] [--default_product_key_strategy {mapping}] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--organization.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -197,8 +186,7 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -209,11 +197,9 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --organization.single Export all organizations in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -235,14 +221,9 @@ platforms evidence dockerhub --namespace.mapping "my-namespace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] - [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] - [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] - [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] - [--default_product_key_strategy {mapping,mapping,mapping,mapping}] +usage: platforms [options] evidence [options] dockerhub [-h] [--instance.instance INSTANCE] [--types {instance,token,repository,namespace,repository_tag,webhook,all}] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] + [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--namespace.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] + [--instance.mapping [MAPPING ...]] [--namespace.single] [--repository.single] [--default_product_key_strategy {mapping,mapping,mapping,mapping}] options: -h, --help Show this help message and exit. @@ -294,11 +275,8 @@ platforms evidence k8s --namespace.mapping "my-namespace::my-product::1.0" --pod --> ```bash -usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] - [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] - [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] +usage: platforms [options] evidence [options] k8s [-h] [--instance.instance INSTANCE] [--types {namespace,pod,all}] [--scope.namespace [NAMESPACE ...]] [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] + [--default_product_key_strategy {namespace,pod,image,mapping}] [--secret.skip] [--url URL] [--token TOKEN] [--namespace.single] [--pod.single] [--namespace.mapping [MAPPING ...]] [--pod.mapping [MAPPING ...]] options: -h, --help Show this help message and exit. @@ -350,12 +328,8 @@ platforms evidence jfrog --jf-repository.mapping "*::my-product::1.0" --namespac --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -406,12 +380,8 @@ platforms evidence ecr --repository.mapping "*my-service*::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] - [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] - [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] - [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] +usage: platforms [options] evidence [options] ecr [-h] [--instance.instance INSTANCE] [--url URL] [--types {instance,aws-account,repository,all}] [--scope.aws-account [AWS_ACCOUNT ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] + [--exclude.aws-account [AWS_ACCOUNT ...]] [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--aws-account.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--aws-account.single] [--repository.single] [--default_product_key_strategy {instance,aws-account,repository,tag,mapping}] options: @@ -462,14 +432,9 @@ platforms evidence bitbucker --workspace.mapping "my-workspace::my-product::1.0" --> ```bash -usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] - [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] - [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] - [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] - [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] - [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] - [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] - [--project.single] [--repository.single] +usage: platforms [options] evidence [options] bitbucket [-h] [--instance.instance INSTANCE] [--types {workspace,project,repository,all,all}] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--default_product_key_strategy {mapping}] [--workspace.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--workspace.single] [--project.single] [--repository.single] options: -h, --help Show this help message and exit. @@ -488,11 +453,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -505,14 +468,11 @@ options: --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by reopsitory name too. (default: mapping) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --workspace.single Export all workspaces in a single evidence (default: False) --project.single Export all projects in a single evidence (default: False) --repository.single Export all repos in a single evidence (default: False) @@ -535,12 +495,9 @@ platforms evidence jenkins --instance-mapping "my-instance::my-product::1.0" --f --> ```bash -usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] - [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] - [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] - [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] - [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] - [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] [--folder.single] +usage: platforms [options] evidence [options] jenkins [-h] [--instance.instance INSTANCE] [--types {instance,folder,all,all}] [--username USERNAME] [--password PASSWORD] [--url URL] [--credential_stores.skip] [--users.skip] [--plugins.skip] [--security_settings.skip] [--computer_set.skip] [--jobs.skip] [--scope.folder [FOLDER ...]] + [--exclude.folder [FOLDER ...]] [--scope.job_runs.past_days PAST_DAYS] [--scope.job_runs.max MAX] [--scope.job_runs.analyzed_logs] [--job_runs.skip] [--default_product_key_strategy {mapping}] [--instance-mapping [INSTANCE_MAPPING ...]] [--folder.mapping [MAPPING ...]] + [--folder.single] options: -h, --help Show this help message and exit. @@ -560,28 +517,23 @@ options: --computer_set.skip Skip computer sets in discovery/evidence (default: False) --jobs.skip Skip jobs (default: False) --scope.folder [FOLDER ...] - Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to - scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder - that starts with folder-a. folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: - ['*']) + Jenkins folder/job list. Default is all folders. The folder scoping is defined as a path of folders and can include the job name in order to scope specific jobs. Wildcard is supported only as a suffix. examples: folder-a* will discover all folders that are included in a root folder that starts with folder-a. + folder-a/* will discover all folders and jobs under the root folder folder-a (type: JenkinsFolderScope, default: ['*']) --exclude.folder [FOLDER ...] Jenkins folder/job list to exclude from discovery. Format is like the --scope.folder argument (type: JenkinsFolderScope, default: []) --scope.job_runs.past_days PAST_DAYS Number of past days to include in the job run discovery, 0 for no time limit (type: int, default: 30) --scope.job_runs.max MAX - Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no - limit (type: int, default: 10) + Mam number of job runs to include in the job run discovery. This argument will limit the number of job runs in the past_days range. 0 for no limit (type: int, default: 10) --scope.job_runs.analyzed_logs Include analyzed job run logs (default: False) --job_runs.skip Skip commits in discovery/evidence (default: False) --default_product_key_strategy {mapping} Deferment product key by mapping. In the future - we shall support by folder name too. (default: mapping) --instance-mapping [INSTANCE_MAPPING ...] - Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: - []) + Instance product key mapping in the format of *::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.mapping [MAPPING ...] - Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, - default: []) + Folder product key mapping in the format of folder_path::product_key::product_version, wildcards are supported (type: AssetMappingString, default: []) --folder.single Export all repos in a single evidence (default: False) ``` diff --git a/docs/platforms/hooks.md b/docs/platforms/hooks.md index 434f82253..4e6206336 100644 --- a/docs/platforms/hooks.md +++ b/docs/platforms/hooks.md @@ -120,6 +120,7 @@ These hooks are provided by the `platforms` container along with required config | Trivy Vulnerability Scan | trivy_image | repository | dockerhub | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | image | dockerhub | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy IaC and Secrets Scan | trivy_iac_and_secrets | repository | github | trivy | trivy | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | +| Trivy IaC and Secrets Scan (SARIF) | trivy_iac_and_secrets_sarif | repository | github | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | Trivy Vulnerability Scan | trivy_image | repository | jfrog | trivy | sarif | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) | | AppArmor Profile Check | apparmor_namespace | namespace | k8s | apparmor | json | | | Kubescape Cluster Scan | kubescape_cluster | namespace | k8s | kubescape | kubescape | [Apache-2.0](https://github.com/kubescape/kubescape/blob/master/LICENSE) | @@ -174,6 +175,34 @@ run: |
+Trivy IaC and Secrets Scan (SARIF) + +```yaml +name: Trivy IaC and Secrets Scan (SARIF) +id: trivy_iac_and_secrets_sarif +type: repository +platform: github +command: discover +tool: trivy +parser: sarif +predicate-type: auto +allow_failure: false +use-stdout-evidence: false +license: '[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)' +run: | + trivy repository \ + --scanners misconfig,secret \ + --exit-code 0 \ + --format sarif \ + --output $HOOK_OUTPUT_FILE \ + ${REPO_BRANCH:+--branch "$REPO_BRANCH"} \ + ${REPO_TAG:+--tag "$REPO_TAG"} \ + $REMOTE_SOURCE_URL +``` +
+ +
+ Opengrep Static Analysis Scan ```yaml @@ -190,7 +219,7 @@ license: '[LGPL-2.1](https://github.com/opengrep/opengrep/blob/main/LICENSE)' predicate-type: auto timeout: 300 run: | - opengrep scan --metrics=on --config auto --sarif -o "$HOOK_OUTPUT_FILE" "$LOCAL_SOURCE_DIR" + opengrep scan --debug --config auto --sarif -o "$HOOK_OUTPUT_FILE" "$LOCAL_SOURCE_DIR" ```
diff --git a/docs/platforms/usage.md b/docs/platforms/usage.md index 977741988..1c20b9b14 100644 --- a/docs/platforms/usage.md +++ b/docs/platforms/usage.md @@ -61,9 +61,7 @@ In the following sections, we shall explain each command in detail, by going thr --> ```bash -usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] - [--db.local.path PATH] - {discover,evidence,bom,verify} ... +usage: platforms [-h] [--config CONFIG] [--print_config [=flags]] [--log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--log-file LOG_FILE] [--db.local.path PATH] {discover,evidence,bom,verify} ... CLI tool for collecting evidence and enforcing policies via CI/CD platform APIs @@ -71,8 +69,7 @@ options: -h, --help Show this help message and exit. --config CONFIG Path to a configuration file. --print_config [=flags] - Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords - separated by comma. The supported flags are: comments, skip_default, skip_null. + Print the configuration after applying all other arguments and exit. The optional flags customizes the output and are one or more keywords separated by comma. The supported flags are: comments, skip_default, skip_null. --log-level {TRACE,DEBUG,INFO,WARNING,ERROR,CRITICAL} Set the logging level (default: INFO) --log-file LOG_FILE Set the logging file (default: ) diff --git a/docs/platforms/verify.md b/docs/platforms/verify.md index 091f89fbe..ebc526fca 100644 --- a/docs/platforms/verify.md +++ b/docs/platforms/verify.md @@ -19,15 +19,10 @@ The recommended use of the verify command with the product-mapping capabilities; --> ```bash -usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] - [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] - [--valint.input [INPUT ...]] [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] - [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] - [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] [--valint.components COMPONENTS] [--valint.label LABEL] - [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE] - [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] - [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE] - [--valint.gate-name GATE_NAME] +usage: platforms [options] verify [-h] [--valint.scribe.client-secret CLIENT_SECRET] [--valint.cache.disable] [--valint.context-type CONTEXT_TYPE] [--valint.assume-context ASSUME_CONTEXT] [--valint.payload PAYLOAD] [--valint.log-level LOG_LEVEL] [--valint.arch ARCH] [--valint.input [INPUT ...]] + [--valint.output-directory OUTPUT_DIRECTORY] [--valint.bin BIN] [--valint.product-key PRODUCT_KEY] [--valint.product-version PRODUCT_VERSION] [--valint.predicate-type PREDICATE_TYPE] [--valint.statement STATEMENT] [--valint.source SOURCE] [--valint.attest ATTEST] [--valint.sign] + [--valint.components COMPONENTS] [--valint.label LABEL] [--unique] [--valint.git-commit GIT_COMMIT] [--valint.git-branch GIT_BRANCH] [--valint.git-tag GIT_TAG] [--valint.bundle BUNDLE] [--valint.bundle-auth BUNDLE_AUTH] [--valint.bundle-branch BUNDLE_BRANCH] [--valint.bundle-commit BUNDLE_COMMIT] + [--valint.bundle-tag BUNDLE_TAG] [--allow-failures] [--max-threads MAX_THREADS] [--valint.gate-type GATE_TYPE] [--valint.gate-name GATE_NAME] {k8s,dockerhub,gitlab,github,jfrog,ecr,bitbucket,jenkins,azure} ... Verify supply chain policies @@ -45,7 +40,7 @@ options: --valint.payload PAYLOAD Valint payload (type: str, default: ) --valint.log-level LOG_LEVEL - Valint log level (type: str, default: ) + Valint log level (type: str, default: quiet) --valint.arch ARCH Set Image architecture (type: str, default: ) --valint.input [INPUT ...] Valint extra input targets (default: []) @@ -67,7 +62,7 @@ options: --valint.sign sign evidence (default: False) --valint.components COMPONENTS components list (type: str, default: ) - --valint.label LABEL Set additional labels (type: at 0x7381d5ad4040>, default: []) + --valint.label LABEL Set additional labels (type: at 0x7ccc847e9580>, default: []) --unique Allow unique assets (default: False) --valint.git-commit GIT_COMMIT Set Input Target Git commit (type: str, default: ) @@ -164,10 +159,8 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --proje --> ```bash -usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] - [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] - [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] +usage: platforms [options] verify [options] gitlab [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,project,all}] [--scope.organization [ORGANIZATION ...]] [--scope.project [PROJECT ...]] [--scope.branch [BRANCH ...]] [--scope.tag [TAG ...]] [--commit.skip] [--organization.mapping [MAPPING ...]] + [--project.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--project-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -180,8 +173,7 @@ options: --scope.organization [ORGANIZATION ...] Gitlab organization list (default: ['*']) --scope.project [PROJECT ...] - Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + Gitlab projects epositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Gitlab branches wildcards (default: null) --scope.tag [TAG ...] @@ -214,11 +206,8 @@ platforms verify gitlab --organization.mapping "my-org::my-product::1.0" --repos --> ```bash -usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] - [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] - [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] [--tag.only] - [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] - [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] +usage: platforms [options] verify [options] github [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {organization,repository,all}] [--scope.organization [ORGANIZATION ...]] [--scope.repository [REPOSITORY ...]] [--scope.branch [BRANCH ...]] [--scope.tag.name [NAME ...]] [--branch.shallow] [--commit.skip] + [--tag.only] [--organization.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -231,8 +220,7 @@ options: --scope.organization [ORGANIZATION ...] Github organization list (default: ['*']) --scope.repository [REPOSITORY ...] - Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace - / project_name' (default: ['*']) + Github repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.branch [BRANCH ...] Github branches wildcards (default: ['*']) --scope.tag.name [NAME ...] @@ -241,11 +229,9 @@ options: --commit.skip Skip commits in discovery/evidence (default: False) --tag.only Only include tags in the evidence, skip branches (default: False) --organization.mapping [MAPPING ...] - Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are - supported (type: AssetMappingString, default: []) + Organization product key mapping in the format of org::product_key::product_version where org is the organization name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --initiative INITIATIVE Set initiative file (type: str, default: ssdf@v2) --org-policy-skip-aggregate @@ -268,13 +254,9 @@ To evaluate policies on DockerHub evidence. --> ```bash -usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] - [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] - [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] - [--policy-skip-aggregate] +usage: platforms [options] verify [options] dockerhub [-h] [--instance.instance INSTANCE] [--username USERNAME] [--password PASSWORD] [--token TOKEN] [--url URL] [--types {token,repository,namespace,all}] [--default_product_key_strategy {namespace,repository,tag,mapping}] + [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--scope.namespace [NAMESPACE ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -344,12 +326,8 @@ The option `--image.policy` sets the image mapping policy file, defaulting to "c --> ```bash -usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] - [--default_product_key_strategy {namespace,pod,image,mapping}] - [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] - [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] - [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] - [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] +usage: platforms [options] verify [options] k8s [-h] [--instance.instance INSTANCE] [--url URL] [--token TOKEN] [--types {namespace,pod,cluster-images,all}] [--default_product_key_strategy {namespace,pod,image,mapping}] [--default_product_version_strategy {namespace_hash,pod_hash,image_id}] [--scope.namespace [NAMESPACE ...]] + [--scope.pod [POD ...]] [--scope.image [IMAGE ...]] [--ignore-state] [--exclude.namespace [NAMESPACE ...]] [--exclude.pod [POD ...]] [--exclude.image [IMAGE ...]] [--namespace.single] [--pod.single] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -379,8 +357,7 @@ options: --namespace.single Export all namespaces (default: False) --pod.single Export all pods in a single evidence (default: False) --image.mapping [MAPPING ...] - K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: - K8sImageMappingString, default: []) + K8s namespace;pod;image to product_key:product_version mappinge.g. my-namespace::my-pod::my-image::product_key::product_version (type: K8sImageMappingString, default: []) --initiative INITIATIVE Set the initiative file (type: str, default: sspb-gl@v2) --policy-skip-aggregate @@ -426,13 +403,9 @@ To evaluate policies on Jfrog evidence. --> ```bash -usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] - [--default_product_key_strategy {jf-repository,repository,tag,mapping}] - [--default_product_version_strategy {tag,short_image_id,image_id}] [--scope.jf-repository [JF_REPOSITORY ...]] - [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] - [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] - [--exclude.repository [REPOSITORY ...]] [--exclude.repository_tags [REPOSITORY_TAGS ...]] - [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] +usage: platforms [options] verify [options] jfrog [-h] [--instance.instance INSTANCE] [--token TOKEN] [--url URL] [--types {token,repository,jf-repository,all}] [--default_product_key_strategy {jf-repository,repository,tag,mapping}] [--default_product_version_strategy {tag,short_image_id,image_id}] + [--scope.jf-repository [JF_REPOSITORY ...]] [--scope.repository [REPOSITORY ...]] [--scope.repository_tags [REPOSITORY_TAGS ...]] [--scope.image_platform [IMAGE_PLATFORM ...]] [--exclude.jf-repository [JF_REPOSITORY ...]] [--exclude.repository [REPOSITORY ...]] + [--exclude.repository_tags [REPOSITORY_TAGS ...]] [--image.mapping [MAPPING ...]] [--initiative INITIATIVE] [--policy-skip-aggregate] options: -h, --help Show this help message and exit. @@ -483,12 +456,8 @@ platforms verify bitbucket --workspace.mapping "my-workspace::my-product::1.0" - --> ```bash -usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] - [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] - [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] - [--scope.project [PROJECT ...]] [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] - [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] - [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] +usage: platforms [options] verify [options] bitbucket [-h] [--instance.instance INSTANCE] [--app_password APP_PASSWORD] [--username USERNAME] [--workspace_token WORKSPACE_TOKEN] [--workspace WORKSPACE] [--url URL] [--types {workspace,project,repository,all}] [--scope.workspace [WORKSPACE ...]] [--scope.project [PROJECT ...]] + [--scope.repository [REPOSITORY ...]] [--scope.commit [COMMIT ...]] [--scope.branch [BRANCH ...]] [--scope.webhook [WEBHOOK ...]] [--commit.skip] [--branch-protection.skip] [--workspace.mapping [MAPPING ...]] [--project.mapping [MAPPING ...]] [--repository.mapping [MAPPING ...]] [--initiative INITIATIVE] [--org-policy-skip-aggregate] [--repo-policy-skip-aggregate] options: @@ -508,11 +477,9 @@ options: --scope.workspace [WORKSPACE ...] BitBucket workspace list (default: ['*']) --scope.project [PROJECT ...] - BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / - project_name' (default: ['*']) + BitBucket projects wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.repository [REPOSITORY ...] - BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format - 'namespace / project_name' (default: ['*']) + BitBucket repositories wildcards. Default is all projects. Note that a project name includes as a prefix its namesapce in the format 'namespace / project_name' (default: ['*']) --scope.commit [COMMIT ...] BitBucket commit wildcards (default: []) --scope.branch [BRANCH ...] @@ -523,14 +490,11 @@ options: --branch-protection.skip Skip Branch protection in discovery/evidence (default: False) --workspace.mapping [MAPPING ...] - Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are - supported (type: AssetMappingString, default: []) + Workspace product key mapping in the format of workspace::product_key::product_version where org is the workspace name, wildcards are supported (type: AssetMappingString, default: []) --project.mapping [MAPPING ...] - Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported - (type: AssetMappingString, default: []) + Project product key mapping in the format of project::product_key::product_version where org is the project name, wildcards are supported (type: AssetMappingString, default: []) --repository.mapping [MAPPING ...] - Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported - (type: AssetMappingString, default: []) + Repository product key mapping in the format of repo::product_key::product_version where repo is the repository name, wildcards are supported (type: AssetMappingString, default: []) --initiative INITIATIVE Set initiative file (type: str, default: ) --org-policy-skip-aggregate diff --git a/docs/quick-start/README.md b/docs/quick-start/README.md index 74e34096a..8b67a41f2 100644 --- a/docs/quick-start/README.md +++ b/docs/quick-start/README.md @@ -147,8 +147,8 @@ jobs: # **Next Steps** Additional guides for securing and managing your software supply chain: -- **[Managing SBOMs & Vulnerabilities](../../guides/manag-sbom-and-vul)** -- **[Securing Software with SLSA Framework](../../guides/secure-sfw-slsa)** -- **[Enforcing SDLC Policies](../../guides/enforcing-sdlc-policy)** -- **[Achieving SSDF Compliance](../../guides/ssdf-compliance)** -- **[Securing Your Builds](../../guides/securing-builds)** +- **[Managing SBOMs & Vulnerabilities](guides/manag-sbom-and-vul)** +- **[Securing Software with SLSA Framework](guides/secure-sfw-slsa)** +- **[Enforcing SDLC Initiative](guides/enforcing-sdlc-initiative)** +- **[Achieving SSDF Compliance](guides/ssdf-compliance)** +- **[Securing Your Builds](guides/securing-builds)** diff --git a/docs/valint/initiatives.md b/docs/valint/initiatives.md index 778767bbc..a975959cb 100644 --- a/docs/valint/initiatives.md +++ b/docs/valint/initiatives.md @@ -946,29 +946,9 @@ To simplify the rule-args input, the rules template engine has built-in function List of supported functions: -- `on_target` - returns the value of the argument if the `--all-evidence` flag is not used, see below -- `asset` -- used for specifying asset labels as they are set by `platforms`, for example: `asset_name` would result in `asset=asset_name`. -- `asset_on_target` -- same as `asset`, but disables filtering when the `--all-evidence` flag is used. -- `asset_if_found` -- same as `asset`, but doesn't disable the rule if no arg value is found and uses an empty string instead. +- `on_target` - returns the value of the argument unless the `--all-evidence` flag is used, see below -
- Example - -In the following rule, the `MyAsset` input arg (specified as `--rule-args MyAsset=MyAssetValue`) is used to filter the evidence by the asset label as it is set by the `platforms` tool: - -```yaml -... -with: - defaults: - evidence: - labels: - - '{{ asset .Args.MyAsset }}' -... -``` - -When being run with the `--rule-args MyAsset=MyAssetValue` flag, the rule will use the `asset=MyAssetValue` label for the evidence lookup. - -
+See the example [below](#whole-product-evaluation). ### Whole product evaluation @@ -980,7 +960,7 @@ valint verify --initiative my-initiative@v2 --all-evidence \ --scribe.client-secret ``` -If template args are used within the initiative, they should be defined through built-in functions that disable filtering when the `--all-evidence` flag is used. For example, the following example filters evidence by label only when the `--all-evidence` flag is not used: +If template args are used within the initiative, and you want to disable filtering during whole product evaluation, they should be defined using built-in functions. For example, the following example filters evidence by label only when the `--all-evidence` flag is not used: ```yaml ... diff --git a/docs/valint/overview.md b/docs/valint/overview.md index fe65f1a40..269f5ccae 100644 --- a/docs/valint/overview.md +++ b/docs/valint/overview.md @@ -87,6 +87,9 @@ Valint can collect the output of SCA tools, SBOM tools, or application security Valint can act as a supply chain policy evaluation and enforcement agent. To this end, it pulls required evidence objects previously uploaded to an evidence store (Scribe Hub or on-prem) and evaluates them against policies that you set. These are either canned policies that you can parametrize or coded policies that you author and maintain by a gitops process. The output of an evaluation includes evaluation details, a verdict, and a reference to the evidence. +## Evidence Deduplication +Evidence of the same `target` with the same `labels` uploaded to the same product (defined by `product-key` and `product-version`) of the same team is deduplicated. This means that if you upload the same evidence twice, the older one is replaced by the newer one. + ## Using alternative Evidence Stores In lieu of Scribe Hub, you can configure Valint to use other stores to store and retrieve evidence. However, in this scenario, you cannot benefit from Scribe Hub’s evidence retrieval by context, data enrichment and risk analysis, and cross-organizational supply chain transparency sharing. * OCI registry