Base image checks Package

Confirm that either the allowed_registry_prefixes or a signing_identities entry was provided, since at least one is required by the policy rules in this package.

Solution: Make sure to configure either a signing identity under the rh-release key in the signing_identities data source or a list of trusted registry prefixes in allowed_registry_prefixes.

Verify that the base images used when building a container image are permitted. Images can be permitted in three ways: by having a valid signature verified against the rh-release entry in signing_identities rule data (preferred), by matching a component digest in the snapshot, or by matching a registry prefix from allowed_registry_prefixes rule data (deprecated). Registry prefix matching is deprecated and will be removed in a future release.

Solution: Make sure the base image is permitted by one of the following methods (in order of preference): configure a signing identity under the rh-release key in the signing_identities data source so the image signature can be verified, ensure the image digest matches a component in the snapshot, or add the image registry to the allowed_registry_prefixes data source (deprecated).

Verify the expected information was provided about which base images were used during the build process. The list of base images comes from any associated CycloneDX or SPDX SBOMs.

Solution: Ensure a CycloneDX SBOM is associated with the image.