scout attest ootb policy #18606
scout attest ootb policy #18606
Conversation
dvdksn
commented
Nov 6, 2023
dvdksn
commented
- scout: add attestation ootb policy
- build: clarify default image store limitation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
dvdksn
force-pushed
the
scout-attest-ootb-policy
branch
2 times, most recently
from
f09774d to
c44a79e
Compare
dvdksn
force-pushed
the
scout-attest-ootb-policy
branch
from
c44a79e to
7114da9
Compare
Signed-off-by: David Karlsson <[email protected]>
dvdksn
force-pushed
the
scout-attest-ootb-policy
branch
from
7114da9 to
6391863
Compare
content/scout/policy/_index.md
Outdated
| [provenance](../../build/attestations/slsa-provenance.md) attestations. | ||
|
|
||
| This policy is unfulfilled if an artifact is lacking either an SBOM | ||
| attestation, or a provenance attestation with information about the Git |
There was a problem hiding this comment.
condition is backwards here, should be
..., or a provenance attestation without information about the Git repository and base images is being used`
There was a problem hiding this comment.
Maybe the wording is not perfect here but saying that "policy is unfulfilled if an artifact is lacking [...] a provenance attestation without information about the Git repository and base images" becomes a double negative.
There was a problem hiding this comment.
It reads to me currently as
policy is unfulfilled if ... a provenance attestation with information about the Git repository and base images is being used.
which is the opposite of what we want.
Maybe this?
This policy is unfulfilled if an artifact is lacking either an SBOM attestation
or a provenance attestation, or if the provenance is lacking information
about the Git repository and base images used.
There was a problem hiding this comment.
your suggestion reads better, let me update it
dvdksn
force-pushed
the
scout-attest-ootb-policy
branch
from
6391863 to
781ade2
Compare
Signed-off-by: David Karlsson <[email protected]>
dvdksn
force-pushed
the
scout-attest-ootb-policy
branch
from
781ade2 to
241040e
Compare
