Managing compliance with Enterprise Contract Red Hat Trusted Application Pipeline 1.4 Learn how Enterprise Contract enables you to better verify and govern compliance of the code you promote. Additionally, customize the sample policies to fit your corporate standards. Red Hat Customer Content Services

Commands:
gunzip ec-amd64.gz chmod +x ec-amd64
sudo mv ec-amd64 /usr/local/bin/ec
echo 'package zero_to_hero import future.keywords.contains import future.keywords.if import future.keywords.in METADATA 1 title: Builder ID description: Verify the SLSA Provenance has the builder.id set to the expected value. custom: short_name: builder_id 2 failure_msg: The builder ID %q is not the expected %q solution: >- Ensure the correct build system was used to build the container image. deny contains result if { some attestation in input.attestations 3 attestation.statement.predicateType == "https://slsa.dev/provenance/v0.2" expected := "https://localhost/dummy-id" got := attestation.statement.predicate.builder.id expected != got result := { "code": "zero_to_hero.builder_id", "msg": sprintf("The builder ID %q is not expected, %q", [got, expected]) } } ' > rules.rego
ec validate image --public-key cosign.pub --image "USDREPOSITORY:latest" --policy policy.yaml --output policy-input=input.json
echo " --- sources: - policy: - USD(pwd)/rules.rego " > policy.yaml
ec validate image --public-key cosign.pub --image "USDREPOSITORY:latest" --policy policy.yaml --show-successes --info --output yaml
ec validate image --policy '{ "sources": [ { "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"], "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"], "config": {"include": ["@minimal"]} } ] }'
{ "sources": [ { "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:latest" ], "data": [ "git::https://github.com/enterprise-contract/ec-policies//example/data" ], "config": { "exclude": [ "attestation_task_bundle", "slsa_build_scripted_build" ] } } ] }
{ "sources": [ { "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:latest" ], "data": [ "git::https://github.com/enterprise-contract/ec-policies//example/data" ], "config": { "exclude": [ "attestation_task_bundle.unacceptable_task_bundle" ] } } ] }
{ "sources": [ { "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:latest" ], "data": [ "git::https://github.com/enterprise-contract/ec-policies//example/data" ], "config": { "include": [ "test", "java" ] } } ] }
{ "sources": [ { "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:latest" ], "data": [ "git::https://github.com/enterprise-contract/ec-policies//example/data" ], "config": { "include": [ ""*"", 1 "attestation_task_bundle.unacceptable_task_bundle" ], "exclude": [ "attestation_task_bundle.*" ] } } ] }
{ "sources": [ { "policy": [ "oci::quay.io/enterprise-contract/ec-release-policy:latest" ], "data": [ "git::https://github.com/enterprise-contract/ec-policies//example/data" ], "config": { "exclude": [ "test:get-clair-scan", "test:clamav-scan" ] } } ] }
cd sigstore-ocp source tas-env-variables.sh
export OPENSHIFT_APPS_SUBDOMAIN=apps.USD(oc get dns cluster -o jsonpath='{ .spec.baseDomain }') export OIDC_AUTHENTICATION_REALM=sigstore export FULCIO_URL=https://fulcio.USDOPENSHIFT_APPS_SUBDOMAIN export OIDC_ISSUER_URL=https://keycloak-keycloak-system.USDOPENSHIFT_APPS_SUBDOMAIN/auth/realms/USDOIDC_AUTHENTICATION_REALM export REKOR_URL=https://rekor.USDOPENSHIFT_APPS_SUBDOMAIN export TUF_URL=https://tuf.USDOPENSHIFT_APPS_SUBDOMAIN
source ./tas-env-vars.sh
cosign sign -y --fulcio-url=USDFULCIO_URL --rekor-url=USDREKOR_URL --oidc-issuer=USDOIDC_ISSUER_URL USDIMAGE
cd sigstore-ocp source tas-env-variables.sh
export OPENSHIFT_APPS_SUBDOMAIN=apps.USD(oc get dns cluster -o jsonpath='{ .spec.baseDomain }') export OIDC_AUTHENTICATION_REALM=sigstore export FULCIO_URL=https://fulcio.USDOPENSHIFT_APPS_SUBDOMAIN export OIDC_ISSUER_URL=https://keycloak-keycloak-system.USDOPENSHIFT_APPS_SUBDOMAIN/auth/realms/USDOIDC_AUTHENTICATION_REALM export REKOR_URL=https://rekor.USDOPENSHIFT_APPS_SUBDOMAIN export TUF_URL=https://tuf.USDOPENSHIFT_APPS_SUBDOMAIN
{ "builder": { "id": "https://localhost/dummy-id" }, "buildType": "https://example.com/tekton-pipeline", "invocation": {}, "buildConfig": {}, "metadata": { "completeness": { "parameters": false, "environment": false, "materials": false }, "reproducible": false }, "materials": [] }
cosign attest -y --predicate ./predicate.json --type slsaprovenance IMAGE_NAME:TAG
cosign attest -y --predicate ./predicate.json --type slsaprovenance example.io/hello-world:latest
cosign tree example.io/hello-world:latest 📦 Supply Chain Security Related artifacts for an image: example.io/hello-world@sha256:7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35 └── 💾 Attestations for an image tag: example.io/hello-world:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.att └── 🍒 sha256:40d94d96a6d3ab3d94b429881e1b470ae9a3cac55a3ec874051bdecd9da06c2e └── 🔐 Signatures for an image tag: example.io/hello-world:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.sig └── 🍒 sha256:f32171250715d4538aec33adc40fac2343f5092631d4fc2457e2116a489387b7
ec validate image --image IMAGE_NAME:TAG --certificate-identity-regexp 'SIGNER_EMAIL_ADDR' --certificate-oidc-issuer-regexp 'keycloak-keycloak-system' --output yaml --show-successes
ec validate image --image example.io/hello-world:latest --certificate-identity 'jdoe@example.com' --certificate-oidc-issuer 'keycloak-keycloak-system' --output yaml --show-successes success: true successes: - metadata: code: builtin.attestation.signature_check msg: Pass - metadata: code: builtin.attestation.syntax_check msg: Pass - metadata: code: builtin.image.signature_check msg: Pass ec-version: v0.1.2427-499ef12 effective-time: "2024-01-21T19:57:51.338191Z" key: "" policy: {} success: true
echo '{ "builder": { "id": "https://localhost/dummy-id" }, "buildType": "https://localhost/dummy-type", "invocation": {}, "buildConfig": {}, "metadata": { "buildStartedOn": "2023-09-25T16:26:44Z", "buildFinishedOn": "2023-09-25T16:28:59Z", "completeness": { "parameters": false, "environment": false, "materials": false }, "reproducible": false }, "materials": [] } ' > predicate.json
cosign attest -y --fulcio-url=USDFULCIO_URL --rekor-url=USDREKOR_URL --oidc-issuer=USDOIDC_ISSUER_URL --predicate predicate.json --type slsaprovenance USDIMAGE
ec validate image --image USDIMAGE --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' --output yaml --show-successes