Home

Tutorial: ec-cli

The ec-cli is a command-line tool designed to validate container images and related artifacts against security and organizational policies. It checks things like image signatures, attestations (like build provenance or SBOMs), and vulnerability scan results using policies written in Rego. Key features include integration with Sigstore for verifying digital signatures and attestations, handling OCI artifacts from container registries, and processing Application Snapshots which define the set of images belonging to an application release. It can also track the usage of Tekton task bundles. The results of the validation are then presented in various user-friendly or machine-readable reports.

Source Repository: https://github.com/enterprise-contract/ec-cli

flowchart TD
    A0["Policy Definition & Sources
"]
    A1["Validation Engine (Evaluator)
"]
    A2["Application Snapshot
"]
    A3["Image & OCI Artifact Handling
"]
    A4["Sigstore Verification
"]
    A5["Tekton Bundle Tracking
"]
    A6["Output Reporting
"]
    A0 -- "Provides rules to" --> A1
    A0 -- "Configures" --> A4
    A1 -- "Uses for artifact access" --> A3
    A1 -- "Uses for verification" --> A4
    A1 -- "Produces results for" --> A6
    A2 -- "Provides input to" --> A1
    A3 -- "Stores/retrieves data for" --> A5
    A5 -- "Generates data for" --> A0

Loading

Chapters

1. Application Snapshot
2. Policy Definition & Sources
3. Validation Engine (Evaluator)
4. Sigstore Verification
5. Image & OCI Artifact Handling
6. Tekton Bundle Tracking
7. Output Reporting

---

Generated by AI Codebase Knowledge Builder