policy

Documentation

Index

• func AttestationToPayloadJSON(ctx context.Context, predicateType string, verifiedAttestation oci.Signature) ([]byte, error)
• func EvaluatePolicyAgainstJSON(ctx context.Context, name, policyType string, policyBody string, ...) error

Functions

func AttestationToPayloadJSON

func AttestationToPayloadJSON(ctx context.Context, predicateType string, verifiedAttestation oci.Signature) ([]byte, error)

AttestationToPayloadJSON takes in a verified Attestation (oci.Signature) and marshals it into a JSON depending on the payload that's then consumable by policy engine like cue, rego, etc.

Anything fed here must have been validated with either `VerifyLocalImageAttestations` or `VerifyImageAttestations`

If there's no error, and payload is empty means the predicateType did not match the attestation.

func EvaluatePolicyAgainstJSON

func EvaluatePolicyAgainstJSON(ctx context.Context, name, policyType string, policyBody string, jsonBytes []byte) error

EvaluatePolicyAgainstJson is used to run a policy engine against JSON bytes. These bytes can be for example Attestations, or ClusterImagePolicy result types. name - which attestation are we evaluating policyType - cue|rego policyBody - String representing either cue or rego language jsonBytes - Bytes to evaluate against the policyBody in the given language