b2_index

Tutorial: ec-cli

The ec-cli project is a command-line tool designed to enforce security and compliance policies on software artifacts, primarily container images. It takes an Application Snapshot (a list of components) as input, fetches relevant policies (often defined in the Rego language), and evaluates the artifacts against these rules. It interacts with OCI registries to fetch image details, signatures, and attestations, using Sigstore integration to verify their authenticity. Results are presented through a flexible Output Reporting system. The tool can be integrated into CI/CD pipelines using Tekton Tasks, and its own correctness is ensured by a comprehensive Acceptance Testing Framework. It also includes functionality for tracking Tekton Task bundle usage.

Source Repository: https://github.com/enterprise-contract/ec-cli

flowchart TD
    A0["Policy Definition & Evaluation
"]
    A1["Application Snapshot
"]
    A2["OCI Interaction
"]
    A3["Sigstore Integration
"]
    A4["Tekton Task Integration
"]
    A5["Acceptance Testing Framework
"]
    A6["Output Reporting
"]
    A7["Bundle Tracking
"]
    A0 -- "Evaluates" --> A1
    A0 -- "Fetches Policies/Data Via" --> A2
    A0 -- "Uses Verification From" --> A3
    A0 -- "Generates" --> A6
    A2 -- "Fetches Artifacts For" --> A3
    A3 -- "Verifies For" --> A0
    A4 -- "Executes" --> A0
    A5 -- "Tests" --> A0
    A5 -- "Stubs" --> A2
    A7 -- "Stores/Retrieves Bundles Via" --> A2
    A7 -- "Provides Data For" --> A4

Loading

Chapters

1. Policy Definition & Evaluation
2. Application Snapshot
3. Output Reporting
4. OCI Interaction
5. Sigstore Integration
6. Tekton Task Integration
7. Bundle Tracking
8. Acceptance Testing Framework

---

Generated by AI Codebase Knowledge Builder