zregvart

go test -list -json ./... | jq -r 'select(.Action == "start") | .Package' | split -n 'l/3'

zregvart

ec validate image --images snapshot.json --ignore-rekor --policy policy.yaml --output yaml --debug 2>&1 | grep slsa_build_scripted_build.rego

zregvart

{
  "_type": "https://in-toto.io/Statement/v0.1",
  "predicateType": "https://slsa.dev/provenance/v1",
  "subject": [
    {
      "name": "registry.image-registry.svc.cluster.local:5000/work/simple",
      "digest": {
        "sha256": "b1be740ebf6a45c6cca0c5efe2d5278f4b7a8ef6a9023e84f0951a169ad7c27d"
      }
    }

zregvart

# prerequisite:
# kubectl apply -f - <<EOF
# ---
# apiVersion: v1
# kind: PersistentVolumeClaim
# metadata:
#   name: workspace
# spec:
#   accessModes:
#     - ReadWriteOnce

zregvart

$ ec validate image --image quay.io/redhat-appstudio/ec-golden-image --policy policy.yaml --output yaml
Error: 1 error occurred:
	* PEM decoding failed

zregvart

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: test-component-baqi-
  annotations:
    appstudio.redhat.com/updateComponentOnSuccess: '"false"'
    build.appstudio.openshift.io/image: 'quay.io/redhat-appstudio/test-images:40b546fe076e448e83d0412a632bc216'
    build.appstudio.openshift.io/repo: 'https://github.com/redhat-appstudio-qe/devfile-sample-python-basic.git'
    chains.tekton.dev/signed: 'true'
  deletionTimestamp: '2022-11-30T19:08:12Z'

zregvart

apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  annotations:
    appstudio.redhat.com/updateComponentOnSuccess: '"false"'
    build.appstudio.openshift.io/image: quay.io/hacbs-contract-demo/single-container-app
    build.appstudio.openshift.io/repo: https://github.com/jduimovich/single-container-app
    chains.tekton.dev/signed: "true"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"tekton.dev/v1beta1","kind":"PipelineRun","metadata":{"annotations":{},"name":"single-container-app-6d22125da60d6857","namespace":"work"},"spec":{"params":[{"name":"git-url","value":"https://github.com/jduimovich/single-container-app"},{"name":"output-image","value":"quay.io/hacbs-contract-demo/single-container-app"},{"name":"dockerfile","value":"Dockerfile"},{"name":"path-context","value":"."},{"name":"hacbs","value":true},{"name":"rebuild","value":true}],"pipelineRef":{"bundle":"quay.io/redhat-appstudio-tekton-catalog/pipeline-hacbs-docker-build:devel","name":"docker-build"},"serviceAccou

zregvart

FROM scratch

zregvart

{
  "attestations": [
    {
      "_type": "https://in-toto.io/Statement/v0.1",
      "predicateType": "https://slsa.dev/provenance/v0.2",
      "subject": [
        {
          "name": "quay.io/hacbs-contract-demo/single-nodejs-app",
          "digest": {
            "sha256": "abcbdfd92a75f7bba3ab97538b1324bf4677c1fb3eb82ca59cbd8970b3759b7e"

zregvart