v1.4.2

📢 What's New

This releases ships a number of fixes and improvements, the most important one is that AMPEL now normalizes how SKIP is handled across root evaluations. When an evaluation results in skip, AMPEL now returns false across all policy material types. The verifier can be configured to return SKIP to the user and the CLI can opt to return an error code on SKIP. Thanks to @marcusburghardt for the discussion to shape the right behavior!

Two improvements to the policy runtime shipped: policies now have access to some of the verifier engine metadata such as evaluation start time, version, etc. via a new ampel. object. Additionally, code in when: conditions now can access the loaded predicates.

We also include two fixes on the VEX transformer from @arpitjain099 and pulled in fixes from the signer.

As always test it out and let us know any issues or suggestions!

What's Changed

• Pull in signer dsse fix by @puerco in #384
• Bump chainguard-dev/actions/boilerplate from 1.6.39 to 1.6.40 in the actions group across 1 directory by @dependabot[bot] in #382
• Fail Policy when its chain finds no subject by @puerco in #386
• Expose predicate data to when: environment by @puerco in #389
• Index the right list when intersecting filter results by @arpitjain099 in #387
• Accept every in-toto DigestSet algorithm as a verify subject by @puerco in #391
• Bump the actions group with 2 updates by @dependabot[bot] in #390
• Name the checks of a policy without controls by @puerco in #392
• Fail evaluations when nothing was verified by @puerco in #394
• Expose verifier engine data to CEL environment by @puerco in #395
• Do not dereference a missing date when ordering VEX statements by @arpitjain099 in #397

New Contributors

• @arpitjain099 made their first contribution in #387

Full Changelog: v1.4.1...v1.4.2