Pre-build-script task checks Package
This package verifies that the pre-build-script tasks in the attestation are executed in a controlled environment
Rules Included
Script runner image comes from allowed registry
Verify that the images used to run the pre-build script tasks come from a known set of trusted registries to reduce potential supply chain attacks. By default this policy defines trusted registries as registries that are fully maintained by Red Hat and only contain content produced by Red Hat. The list of allowed registries can be customized by setting the allowed_registry_prefixes
list in the rule data.
Solution: Make sure the image referenced in the parameter 'SCRIPT_RUNNER_IMAGE' comes from a trusted registry. The list of trusted registries is a configurable data source.
-
Rule type: FAILURE
-
FAILURE message:
Pre-Build-Script task runner image %q is from a disallowed registry
-
Code:
pre_build_script_task.pre_build_script_task_runner_image_allowed
Script runner image is a valid image reference
Verify that a valid image reference is specified as image being used to run the pre-build script task
Solution: Make sure the value in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' result is a valid image reference
-
Rule type: FAILURE
-
FAILURE message:
Pre-Build-Script task runner image %q is not a valid image reference
-
Code:
pre_build_script_task.valid_pre_build_script_task_runner_image_ref
Script runner image is included in the sbom
Verify that the image used to run the pre-build script task is included in the SBOM
Solution: Make sure the image referenced in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' result is included in the SBOM.
-
Rule type: FAILURE
-
FAILURE message:
Pre-Build-Script task runner image %q is not in the SBOM
-
Code:
pre_build_script_task.pre_build_script_task_runner_image_in_sbom
Script runner image is listed in the task results
Verify that the image used to run the pre-build script task is listed in the task result SCRIPT_RUNNER_IMAGE_REFERENCE
Solution: Make sure the image used to run the pre-build task is referenced in the 'SCRIPT_RUNNER_IMAGE_REFERENCE' task result.
-
Rule type: FAILURE
-
FAILURE message:
The runner image used for the pre-Build-Script task '%s' is not listed in the task results
-
Code:
pre_build_script_task.pre_build_script_task_runner_image_in_results