feat: show attestation-level policy evaluations on status #1684
Conversation
Signed-off-by: Miguel Martinez <miguel@chainloop.dev>
| Annotations []*Annotation `json:"annotations"` | ||
| IsPushed bool `json:"isPushed"` | ||
| PolicyEvaluations map[string][]*PolicyEvaluation `json:"policy_evaluations,omitempty"` | ||
| HasPolicyViolations bool `json:"hasPolicyViolations"` |
There was a problem hiding this comment.
This flag is to simplify checks out json output
cat /tmp/foo.json | jq .status.hasPolicyViolations
true
pkg/attestation/renderer/renderer.go
Outdated
|
|
||
| // Render the in-toto statement without envelope nor validation so it can be used for example for policy evaluation | ||
| func (ab *AttestationRenderer) RenderStatement(ctx context.Context) (*intoto.Statement, error) { | ||
| statement, err := ab.renderer.Statement(ctx) |
There was a problem hiding this comment.
If I'm not wrong, this call is already evaluating policies, there's no need to evaluate them again.
| } | ||
|
|
||
| // Add attestation-level policy evaluations | ||
| attestationEvaluations, err := c.EvaluateAttestationPolicies(ctx, statement) |
There was a problem hiding this comment.
If statement comes from renderer.Statement(), then this call is not needed, because policies are already evaluated in that method.
There was a problem hiding this comment.
I think you might be talking about Render which is the final output as DSSE envelope. renderer.statement is a new method that doesn't have the policies yes, afaik
There was a problem hiding this comment.
you were right, see the new change, thanks
|
|
||
| if policyEval.Skipped { | ||
| logger.Warn().Msgf("policy evaluation skipped (%s) for %s. Reasons: %s", policyEval.Name, subject, policyEval.SkipReasons) | ||
| logger.Debug().Msgf("policy evaluation skipped (%s) for %s. Reasons: %s", policyEval.Name, subject, policyEval.SkipReasons) |
There was a problem hiding this comment.
This will prevent users from seeing these violations when doing an att add
Signed-off-by: Miguel Martinez <miguel@chainloop.dev>
…dev#1684) Signed-off-by: Miguel Martinez <miguel@chainloop.dev> Signed-off-by: Austin Arlint <aarlint@gmail.com>
2 participants
Now, when we run
att statusoratt push, you'll get not only the policy evaluations related to materials but also the attestation-level ones.I've also lowered the level of some logger entries since now we show the info in the attestation result.
Init has not changed
$ chainloop att add --name sbom-2 --value ~/Desktop/result.cdx INF uploading result.cdx - sha256:925ed5a789bad4bc2658ba371530bf3b80639be02d7acd9069c0e52690508132 INF material kind detected kind=SBOM_CYCLONEDX_JSON INF material added to attestationStatus show all the policy information
and also push
refs #1616