Pre-build-script task checks Package

This package verifies that the pre-build-script tasks in the attestation are executed in a controlled environment

Package Name

  • pre_build_script_task

Rules Included

Script runner image comes from allowed registry

Verify that the images used to run the pre-build script tasks come from a known set of trusted registries to reduce potential supply chain attacks. By default this policy defines trusted registries as registries that are fully maintained by Red Hat and only contain content produced by Red Hat. The list of allowed registries can be customized by setting the allowed_registry_prefixes list in the rule data.

Solution: Make sure the image referenced in the parameter 'SCRIPT_RUNNER_IMAGE' comes from a trusted registry. The list of trusted registries is a configurable data source.

  • Rule type: FAILURE

  • FAILURE message: Pre-Build-Script task runner image %q is from a disallowed registry

  • Code: pre_build_script_task.pre_build_script_task_runner_image_allowed

  • Source

Script runner image is a valid image reference

Verify that a valid image reference is specified as image being used to run the pre-build script task

Solution: Make sure the value in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' result is a valid image reference

  • Rule type: FAILURE

  • FAILURE message: Pre-Build-Script task runner image %q is not a valid image reference

  • Code: pre_build_script_task.valid_pre_build_script_task_runner_image_ref

  • Source

Script runner image is included in the sbom

Verify that the image used to run the pre-build script task is included in the SBOM

Solution: Make sure the image referenced in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' result is included in the SBOM.

  • Rule type: FAILURE

  • FAILURE message: Pre-Build-Script task runner image %q is not in the SBOM

  • Code: pre_build_script_task.pre_build_script_task_runner_image_in_sbom

  • Source

Script runner image is listed in the task results

Verify that the image used to run the pre-build script task is listed in the task result SCRIPT_RUNNER_IMAGE_REFERENCE

Solution: Make sure the image used to run the pre-build task is referenced in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' task result.

  • Rule type: FAILURE

  • FAILURE message: The runner image used for the pre-Build-Script task '%s' is not listed in the task results

  • Code: pre_build_script_task.pre_build_script_task_runner_image_in_results

  • Source