Readme example

example.rego

package in_toto.policies.npm

import data.in_toto.constants
import data.in_toto.rules
import data.in_toto.tickets

# METADATA
# description: |
#   Mint a signed ticket only if the DAG is verified, and the given artifacts
#   are the outputs of some final, "sink" step. This ticket type is specifically
#   for one policy and one artifact (OPOA), although nothing prevents multiple
#   artifacts and/or policies. There is no ticket produced in case of failure.
# entrypoint: true
opoa_ticket := tickets.opoa_ticket(
	input.artifacts,
	steps.publish.outputs, # Depend on final, "sink" step(s).
	"npm",
	input.attestations,
	input.parameters,
)

# METADATA
# description: The "publish" step.
steps.publish := inputs_and_outputs if {
	# Prerequisite step(s): this is how we build up the DAG.
	steps.build

	# Expected Inputs.
	# MATCH * WITH products FROM build
	# DISALLOW *
	inputs := verified.delegation.statement.subject
	rules.disallow("*", rules.match("*", "", inputs, "", steps.build.outputs))

	# Virtual document.
	inputs_and_outputs := {
		"inputs": inputs,
		"outputs": inputs,
	}
}

# METADATA
# description: The "build" step.
steps.build := inputs_and_outputs if {
	# Expected Inputs.
	# ALLOW git+https://github.com/sigstore/sigstore-js@refs/heads/main
	# DISALLOW *
	inputs := verified.bundle.statement.predicate.buildDefinition.resolvedDependencies
	config_source := $"git+{input.parameters.github_repository}@{input.parameters.github_ref}"
	rules.disallow("*", rules.allow(config_source, inputs))

	# Expected Outputs.
	# CREATE pkg:npm/sigstore@4.0.0
	# DISALLOW *
	purl := $"pkg:npm/{input.parameters.package_name}@{input.parameters.package_version}"
	outputs := verified.bundle.statement.subject
	rules.disallow("*", rules.create(purl, inputs, outputs))

	# Last but not least, send our own virtual document out.
	# Each Step knows best and SHOULD define what its I/O was for other Steps to be able to correlate.
	inputs_and_outputs := {
		"inputs": inputs,
		"outputs": outputs,
	}
}

# METADATA
# description: Verify Sigstore signature for this GitHub Actions workflow run.
verified.bundle.statement := statement if {
	repository := $"https://github.com/{input.parameters.github_repository}"
	issuer := "https://token.actions.githubusercontent.com"
	identity := $"{repository}/{input.parameters.entry_point}@{input.parameters.github_ref}"

	statement := verify_sigstore_bundle(issuer, identity, input.attestations.build).statement
	statement._type == constants.statement_v1
	statement.predicateType == constants.provenance_v1

	# Predicate Validators.
	valid_build_definition
	statement.predicate.runDetails.builder.id == constants.gha_builder_id
}

# METADATA
# description: Verify Sigstore delegation.
verified.delegation.statement := statement if {
	statement := verify_sigstore_delegation(_delegation.url, _delegation.key, input.attestations.publish).statement
	statement._type == constants.statement_v0_1
	statement.predicateType == constants.publish_v1

	# Predicate Validators.
	statement.predicate.name == input.parameters.package_name
	statement.predicate.version == input.parameters.package_version
	statement.predicate.registry == input.parameters.registry
}

# METADATA
# description: Validate build definition.
valid_build_definition if {
	definition := verified.bundle.statement.predicate.buildDefinition

	definition.buildType == constants.gha_workflow_v1
	definition.externalParameters.workflow.ref == input.parameters.github_ref
	definition.externalParameters.workflow.repository == $"https://github.com/{input.parameters.github_repository}"
	definition.externalParameters.workflow.path == input.parameters.entry_point
	definition.internalParameters.github.repository_id == input.parameters.github_repository_id
	definition.internalParameters.github.repository_owner_id == input.parameters.github_repository_owner_id
}

# TBD: Determine the right, stable interface for fetching a custom
# public key distributed by the Sigstore Root of Trust.
# https://github.com/sigstore/root-signing/tree/main/targets/registry.npmjs.org
_delegation.key := "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"
_delegation.url := "registry.npmjs.org"