Chapter 3. Creating a policy

Procedure

1. Configure your policy in the command line as a JSON or YAML string, as in the following example:

   $ ec validate image --policy '{
       "sources": [
           {
               "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"],
               "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"],
               "config": {"include": ["@minimal"]}
           }
       ]
   }' ...

   Copy to Clipboard Toggle word wrap

2. (Optional) Exclude a particular package of rules from your Conforma policy, as in the following example:

   {
     "sources": [
       {
         "policy": [
           "oci::quay.io/enterprise-contract/ec-release-policy:latest"
         ],
         "data": [
           "git::https://github.com/enterprise-contract/ec-policies//example/data"
         ],
         "config": {
           "exclude": [
             "attestation_task_bundle",
             "slsa_build_scripted_build"
           ]
         }
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

   This command includes every rule from every package except for the rules in the specified packages.

3. (Optional) Exclude a single rule, as in the following example:

   {
     "sources": [
       {
         "policy": [
           "oci::quay.io/enterprise-contract/ec-release-policy:latest"
         ],
         "data": [
           "git::https://github.com/enterprise-contract/ec-policies//example/data"
         ],
         "config": {
           "exclude": [
             "attestation_task_bundle.unacceptable_task_bundle"
           ]
         }
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

   This commands includes every rule from the attestation_task_bundle package except for the unacceptable_task_bundle rule.

4. (Optional) Include rules from only a particular package, as in the following example:

   {
     "sources": [
       {
         "policy": [
           "oci::quay.io/enterprise-contract/ec-release-policy:latest"
         ],
         "data": [
           "git::https://github.com/enterprise-contract/ec-policies//example/data"
         ],
         "config": {
           "include": [
             "test",
             "java"
           ]
         }
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

   This command includes only the rules from the specified packages.

5. (Optional) Include only some rules from a particular package. This means that you can specify both include and exclude to select only the rules you want your Conforma policy to include, as in the following example:

   {
     "sources": [
       {
         "policy": [
           "oci::quay.io/enterprise-contract/ec-release-policy:latest"
         ],
         "data": [
           "git::https://github.com/enterprise-contract/ec-policies//example/data"
         ],
         "config": {
           "include": [
             ""*"",
             "attestation_task_bundle.unacceptable_task_bundle"
           ],
           "exclude": [
             "attestation_task_bundle.*"
           ]
         }
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

   asterisk (*)

   The asterisk (*) acts as a wildcard to match any package. It does not match partial names. For example, you cannot specify "s*" to match every package that starts with "s".

   These commands specify that you want to include only the unacceptable_task_bundle rule from the attestation_task_bundle package, and exclude all the other rules in that package.

6. (Optional) Exclude certain checks so that Conforma can validate your container image even if those checks fail or don’t complete, as in the following example:

   {
     "sources": [
       {
         "policy": [
           "oci::quay.io/enterprise-contract/ec-release-policy:latest"
         ],
         "data": [
           "git::https://github.com/enterprise-contract/ec-policies//example/data"
         ],
         "config": {
           "exclude": [
             "test:get-clair-scan",
             "test:clamav-scan"
           ]
         }
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

   This command specifies that, if either of the identified checks fails or does not complete, Conforma can still finish to validate your container image.

7. (Optional) Modify the defaults for rules in a package by running either the config.policy.include command or the config.policy.exclude command, along with a list of strings.

   Your list of strings should include one of the following:

   package name

   Choose from the packages in the "Available rule collections" list.

   rule name

   Specify a rule name by entering the name of the package and the rule code, separated by a dot (.), as in this example: attestation_type.unknown_att_type. You can find rule codes under "Attestation type" in the upstream Conforma documentation.

   package name:term

   Some policy rules process a list of items. When you add "term" to the "package name" string, you can exclude or include a particular item from that list. This works similarly to "package name," except that it applies only to policy rules in the package that match that term. For example, if you run the test package, you can choose to ignore a given test case but include all the others.

   rule name:term

   This is similar to "package name:term" except that, instead of including or excluding an item from a package, you can include or exclude a particular package policy rule.

   @collection name

   Add this to your string to specify a predefined collection of rules. Prefix the collection name with the @ symbol. Choose from the available rule collections.