Skip to content

Get image manifests in parallel #1616

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joejstuart wants to merge 1 commit into
base: main
Choose a base branch
from
+446 −150
Open

Get image manifests in parallel #1616

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions antora/docs/modules/ROOT/pages/packages/pipeline_required_tasks.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Produce a warning when a task that will be required in the future is not current
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `%s is missing and will be required on %s`
* Code: `required_tasks.missing_future_required_task`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L35[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L53[Source, window="_blank"]

[#required_tasks__missing_required_task]
=== link:#required_tasks__missing_required_task[Missing required task]
Expand All @@ -26,7 +26,7 @@ Ensure that the set of required tasks is included in the Pipeline definition.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `%s is missing or outdated`
* Code: `required_tasks.missing_required_task`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L72[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L90[Source, window="_blank"]

[#required_tasks__tasks_found]
=== link:#required_tasks__tasks_found[Pipeline contains tasks]
Expand All @@ -36,7 +36,7 @@ Confirm at least one task is present in the pipeline definition.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `No tasks found in pipeline`
* Code: `required_tasks.tasks_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L59[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L77[Source, window="_blank"]

[#required_tasks__required_tasks_list_present]
=== link:#required_tasks__required_tasks_list_present[Required task list is present in rule data]
Expand All @@ -46,7 +46,7 @@ Confirm the `required-tasks` rule data was provided, since it's required by the
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `The required tasks list is missing from the rule data`
* Code: `required_tasks.required_tasks_list_present`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L91[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L109[Source, window="_blank"]

[#required_tasks__required_tasks_found]
=== link:#required_tasks__required_tasks_found[Required tasks found in pipeline definition]
Expand All @@ -56,4 +56,4 @@ Produce a warning if a list of current or future required tasks does not exist i
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Required tasks do not exist for pipeline %q`
* Code: `required_tasks.required_tasks_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L16[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L34[Source, window="_blank"]
12 changes: 6 additions & 6 deletions antora/docs/modules/ROOT/pages/packages/pipeline_task_bundle.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Confirm the `trusted_tasks` rule data was provided, since it's required by the p
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Missing required trusted_tasks data`
* Code: `task_bundle.missing_required_data`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L98[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L116[Source, window="_blank"]

[#task_bundle__untrusted_task_bundle]
=== link:#task_bundle__untrusted_task_bundle[Task bundle is not trusted]
Expand All @@ -26,7 +26,7 @@ For each Task in the Pipeline definition, check if the Tekton Bundle used is a t
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' uses an untrusted task bundle '%s'`
* Code: `task_bundle.untrusted_task_bundle`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L83[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L101[Source, window="_blank"]

[#task_bundle__out_of_date_task_bundle]
=== link:#task_bundle__out_of_date_task_bundle[Task bundle is out of date]
Expand All @@ -36,7 +36,7 @@ For each Task in the Pipeline definition, check if the Tekton Bundle used is the
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Pipeline task '%s' uses an out of date task bundle '%s', new version of the Task must be used before %s`
* Code: `task_bundle.out_of_date_task_bundle`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L34[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L52[Source, window="_blank"]

[#task_bundle__empty_task_bundle_reference]
=== link:#task_bundle__empty_task_bundle_reference[Task bundle reference is empty]
Expand All @@ -46,7 +46,7 @@ Check that a valid task bundle reference is being used.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' uses an empty bundle image reference`
* Code: `task_bundle.empty_task_bundle_reference`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L70[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L88[Source, window="_blank"]

[#task_bundle__disallowed_task_reference]
=== link:#task_bundle__disallowed_task_reference[Task bundle was not used or is not defined]
Expand All @@ -56,7 +56,7 @@ Check for the existence of a task bundle. This rule will fail if the task is not
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' does not contain a bundle reference`
* Code: `task_bundle.disallowed_task_reference`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L56[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L74[Source, window="_blank"]

[#task_bundle__unpinned_task_bundle]
=== link:#task_bundle__unpinned_task_bundle[Unpinned task bundle reference]
Expand All @@ -66,4 +66,4 @@ Check if the Tekton Bundle used for the Tasks in the Pipeline definition is pinn
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Pipeline task '%s' uses an unpinned task bundle reference '%s'`
* Code: `task_bundle.unpinned_task_bundle`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L20[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L38[Source, window="_blank"]
8 changes: 4 additions & 4 deletions antora/docs/modules/ROOT/pages/packages/release_slsa_build_scripted_build.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Verify that the predicate.buildConfig.tasks.steps attribute for the task respons
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Build task %q does not contain any steps`
* Code: `slsa_build_scripted_build.build_script_used`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L21[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L24[Source, window="_blank"]

[#slsa_build_scripted_build__build_task_image_results_found]
=== link:#slsa_build_scripted_build__build_task_image_results_found[Build task set image digest and url task results]
Expand All @@ -32,7 +32,7 @@ Confirm that a build task exists and it has the expected IMAGE_DIGEST and IMAGE_
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Build task not found`
* Code: `slsa_build_scripted_build.build_task_image_results_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L48[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L51[Source, window="_blank"]

[#slsa_build_scripted_build__image_built_by_trusted_task]
=== link:#slsa_build_scripted_build__image_built_by_trusted_task[Image built by trusted Task]
Expand All @@ -44,7 +44,7 @@ Verify the digest of the image being validated is reported by a trusted Task in
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Image %q not built by a trusted task: %s`
* Code: `slsa_build_scripted_build.image_built_by_trusted_task`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L107[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L110[Source, window="_blank"]

[#slsa_build_scripted_build__subject_build_task_matches]
=== link:#slsa_build_scripted_build__subject_build_task_matches[Provenance subject matches build task image result]
Expand All @@ -56,4 +56,4 @@ Verify the subject of the attestations matches the IMAGE_DIGEST and IMAGE_URL va
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `The attestation subject, %q, does not match any of the images built`
* Code: `slsa_build_scripted_build.subject_build_task_matches`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L73[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/slsa_build_scripted_build/slsa_build_scripted_build.rego#L76[Source, window="_blank"]
20 changes: 10 additions & 10 deletions antora/docs/modules/ROOT/pages/packages/release_tasks.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Ensure that the all required tasks are resolved from trusted tasks.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `%s is required and present but not from a trusted task`
* Code: `tasks.required_untrusted_task_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L164[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L167[Source, window="_blank"]

[#tasks__required_tasks_found]
=== link:#tasks__required_tasks_found[All required tasks were included in the pipeline]
Expand All @@ -30,7 +30,7 @@ Ensure that the set of required tasks are included in the PipelineRun attestatio
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `%s is missing`
* Code: `tasks.required_tasks_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L140[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L143[Source, window="_blank"]

[#tasks__data_provided]
=== link:#tasks__data_provided[Data provided]
Expand All @@ -42,7 +42,7 @@ Confirm the expected data keys have been provided in the expected format. The ke
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `%s`
* Code: `tasks.data_provided`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L291[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L294[Source, window="_blank"]

[#tasks__future_required_tasks_found]
=== link:#tasks__future_required_tasks_found[Future required tasks were found]
Expand All @@ -54,7 +54,7 @@ Produce a warning when a task that will be required in the future was not includ
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `%s is missing and will be required on %s`
* Code: `tasks.future_required_tasks_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L55[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L58[Source, window="_blank"]

[#tasks__pinned_task_refs]
=== link:#tasks__pinned_task_refs[Pinned Task references]
Expand All @@ -66,7 +66,7 @@ Ensure that all Tasks in the SLSA Provenance attestation use an immuntable refer
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Task %s is used by pipeline task %s via an unpinned reference.`
* Code: `tasks.pinned_task_refs`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L225[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L228[Source, window="_blank"]

[#tasks__pipeline_has_tasks]
=== link:#tasks__pipeline_has_tasks[Pipeline run includes at least one task]
Expand All @@ -78,7 +78,7 @@ Ensure that at least one Task is present in the PipelineRun attestation.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `No tasks found in PipelineRun attestation`
* Code: `tasks.pipeline_has_tasks`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L85[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L88[Source, window="_blank"]

[#tasks__pipeline_required_tasks_list_provided]
=== link:#tasks__pipeline_required_tasks_list_provided[Required tasks list for pipeline was provided]
Expand All @@ -90,7 +90,7 @@ Produce a warning if the required tasks list rule data was not provided.
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Required tasks do not exist for pipeline`
* Code: `tasks.pipeline_required_tasks_list_provided`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L34[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L37[Source, window="_blank"]

[#tasks__required_tasks_list_provided]
=== link:#tasks__required_tasks_list_provided[Required tasks list was provided]
Expand All @@ -102,7 +102,7 @@ Confirm the `required-tasks` rule data was provided, since it's required by the
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Missing required required-tasks data`
* Code: `tasks.required_tasks_list_provided`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L201[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L204[Source, window="_blank"]

[#tasks__successful_pipeline_tasks]
=== link:#tasks__successful_pipeline_tasks[Successful pipeline tasks]
Expand All @@ -114,7 +114,7 @@ Ensure that all of the Tasks in the Pipeline completed successfully. Note that s
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task %q did not complete successfully, %q`
* Code: `tasks.successful_pipeline_tasks`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L110[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L113[Source, window="_blank"]

[#tasks__unsupported]
=== link:#tasks__unsupported[Task version unsupported]
Expand All @@ -124,4 +124,4 @@ The Tekton Task used is or will be unsupported. The Task is annotated with `buil
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Task %q is used by pipeline task %q is or will be unsupported as of %s. %s`
* Code: `tasks.unsupported`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L252[Source, window="_blank"]
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/tasks/tasks.rego#L255[Source, window="_blank"]
Loading