feat(contract): reject attestation level policies in materials#2484
feat(contract): reject attestation level policies in materials#2484Piskoo wants to merge 1 commit intochainloop-dev:mainfrom
Conversation
Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>
|
|
||
| // Check if any policy has kind ATTESTATION - this is not allowed for material-level policies | ||
| for _, policySpec := range policies { | ||
| if policySpec.GetKind() == schemav1.CraftingSchema_Material_ATTESTATION { |
There was a problem hiding this comment.
we need to review this because we support providing ATTESTATION as material type. But maybe the key here is to make sure it's not the only option. cc/ @jiparis
There was a problem hiding this comment.
ATTESTATION policies can be designed to run against an attestation material, or against the attestation itself (or both), but I don't think we have enough information at this point to know it, even if it's the only execution path.
In my opinion, we have two options:
- change the semantics so that ATTESTATION materials are not allowed anymore (what this PR is implementing).
- or some kind of metadata in the policy that allow policy authors to specify how the policy should be run.
There was a problem hiding this comment.
We could also "double check" if the users' intention was to apply attestation policy to a material, to do that we could require a selector
There was a problem hiding this comment.
What policies do we have that use an attestation as the material?
3 participants
This PR adds validation to contract creation and update, that prevents assigning policies that contain execution path for kind
ATTESTATIONon material level.Example:
For
sbom-presentpolicyValid contract
Passes, the contract is created/updated
Invalid contract
Returns
Already existing contracts are unaffected, invalid contract will also fail if raw contract is given during
att initin--contractflag.