Tips and Tricks

# 1. Set up complete development environment
cd cli/
./hack/setup-dev-environment.sh

# 2. Run a demo to verify everything works
EC_DEBUG=1 ./hack/demo.sh

# 3. Check what policies are currently deployed
cd ../hacks/
./show-deployed-ec-policies.sh --short

# Update your development environment
./hack/update-infra-deployments.sh

# Test your changes
./hack/demo.sh

# Check build versions
./show-latest-build-versions.sh

# Preview what would be deleted (dry run)
./prune_quay_tags.sh --repo myorg/myapp --filter "^pr-" --days 30 --dry-run

# Actually delete old PR images
./prune_quay_tags.sh --repo myorg/myapp --filter "^pr-" --days 30

# Clean up development tags older than 1 week
./prune_quay_tags.sh --repo myorg/myapp --filter ".*-dev$" --days 7

# 1. Copy snapshot image to staging
./copy-snapshot-image.sh "$SNAPSHOT_JSON" "quay.io/myorg/app-staging"

# 2. Expand snapshot for bundle processing
./expand-snapshot.sh "namespace/snapshot-name" cli.json bundle.json

# 3. Validate with policies
ec validate image --file-path cli.json --policy staging/policy

# Verify required tools are installed
command -v kubectl >/dev/null 2>&1 || echo "❌ kubectl not found"
command -v kind >/dev/null 2>&1 || echo "❌ kind not found" 
command -v cosign >/dev/null 2>&1 || echo "❌ cosign not found"
command -v skopeo >/dev/null 2>&1 || echo "❌ skopeo not found"

# Check authentication
kubectl auth can-i create pods --namespace=default
docker login quay.io

# Check if cluster already exists
kind get clusters

# Delete existing cluster if needed
kind delete cluster --name ec

# Verify Docker/Podman is running
docker ps

# Check authentication status
docker login quay.io

# For Podman users
podman login quay.io

# Verify credentials are stored
cat ~/.docker/config.json | jq '.auths'

# Make scripts executable
chmod +x hack/*.sh

# Check script location
ls -la hack/demo.sh

# Install common tools on Fedora/RHEL
sudo dnf install kubectl podman skopeo cosign

# Install on Ubuntu/Debian
sudo apt install kubectl podman skopeo

# Check policy syntax
ec opa test ./policy

# Verify image signatures
cosign verify --key cosign.pub quay.io/example/image:tag

# Debug with verbose output
EC_DEBUG=1 ./hack/demo.sh

# Verify image exists
skopeo inspect docker://quay.io/example/image:tag

# Check registry connectivity
curl -I https://quay.io/v2/

#!/usr/bin/env bash
# Copyright The Conforma Contributors
# SPDX-License-Identifier: Apache-2.0

# Brief description of what the script does
#
# Usage: ./script.sh [OPTIONS] ARGS
#   OPTIONS:
#     --flag VALUE    Description of flag
#     --dry-run       Show what would be done
#   ARGS:
#     arg1           Description of argument
#
# Examples:
#   ./script.sh --flag value arg1
#   ./script.sh --dry-run arg1

$ ec inspect policy-data [OPTIONS]

# Inspect policy from file
ec inspect policy-data --policy policy.yaml

# Inspect policy from Kubernetes resource
ec inspect policy-data --policy "namespace/policy-name"

# JSON output for programmatic processing
ec inspect policy-data --policy policy.yaml --output json

# YAML output for readability
ec inspect policy-data --policy policy.yaml --output yaml

# Show detailed information including source resolution
ec inspect policy-data --policy policy.yaml --verbose --sources --rule-data

# Focus on rule data configuration
ec inspect policy-data --policy policy.yaml --rule-data --output json

# Show only policy sources
ec inspect policy-data --policy policy.yaml --sources

Policy Configuration Analysis
=============================

Policy Source: policy.yaml
Effective Time: 2024-12-08T15:30:00Z

Sources:
--------
- Name: policies
  Policy Sources:
    - git::github.com/conforma/policy.git//policy/lib?ref=main
    - git::github.com/conforma/policy.git//policy/release?ref=main
  Data Sources:
    - git::github.com/conforma/policy.git//data?ref=main

Configuration:
--------------
Include Rules:
  - slsa_source_version_controlled
  - github_certificate
  - step_image_registries

Rule Data:
----------
allowed_registry_prefixes:
  - quay.io/redhat-appstudio/
  - registry.redhat.io/
  - registry.access.redhat.com/

allowed_gh_workflow_repos:
  - myorg/myrepo

trusted_tasks:
  - name: buildah
    ref: quay.io/konflux-ci/tekton-catalog/task-buildah:0.1
  - name: git-clone
    ref: quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1

Public Key: 
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA
naYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==
-----END PUBLIC KEY-----

Validation Status: ✅ Valid
Source Resolution: ✅ All sources accessible
Rule Data Validation: ✅ All required data present

{
  "policy": {
    "sources": [
      {
        "name": "policies",
        "policy": [
          "git::github.com/conforma/policy.git//policy/lib?ref=main",
          "git::github.com/conforma/policy.git//policy/release?ref=main"
        ],
        "data": [
          "git::github.com/conforma/policy.git//data?ref=main"
        ],
        "ruleData": {
          "allowed_registry_prefixes": [
            "quay.io/redhat-appstudio/",
            "registry.redhat.io/"
          ],
          "allowed_gh_workflow_repos": [
            "myorg/myrepo"
          ],
          "trusted_tasks": [
            {
              "name": "buildah",
              "ref": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.1"
            }
          ]
        }
      }
    ],
    "configuration": {
      "include": [
        "slsa_source_version_controlled",
        "github_certificate",
        "step_image_registries"
      ]
    },
    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----"
  },
  "metadata": {
    "effectiveTime": "2024-12-08T15:30:00Z",
    "sourceResolution": "success",
    "validationStatus": "valid",
    "resolvedSources": 3,
    "includedRules": 3
  }
}

# Debug policy configuration issues
ec inspect policy-data --policy policy.yaml --verbose

# Check if all sources are accessible
ec inspect policy-data --policy policy.yaml --sources --output json | jq '.metadata.sourceResolution'

# Generate policy audit report
ec inspect policy-data --policy policy.yaml --output json > policy-audit.json

# Extract rule data for compliance review
ec inspect policy-data --policy policy.yaml --rule-data --output yaml

# Validate policy structure before deployment
ec inspect policy-data --policy policy.yaml --verbose

# Check policy at specific point in time
ec inspect policy-data --policy policy.yaml --effective-time "2024-01-01T00:00:00Z"

# Extract trusted tasks for automation
TRUSTED_TASKS=$(ec inspect policy-data --policy policy.yaml --rule-data --output json | jq -r '.policy.sources[0].ruleData.trusted_tasks[].ref')

# Validate multiple policies
for policy in policies/*.yaml; do
  echo "Inspecting $policy..."
  ec inspect policy-data --policy "$policy" --output json | jq '.metadata.validationStatus'
done

# Check source accessibility with verbose output
ec inspect policy-data --policy policy.yaml --sources --verbose

# Test with specific git reference
ec inspect policy-data --policy policy.yaml --effective-time "2024-01-01T00:00:00Z"

# Inspect rule data structure
ec inspect policy-data --policy policy.yaml --rule-data --output yaml

# Validate against expected schema
ec inspect policy-data --policy policy.yaml --verbose | grep -A 10 "Rule Data Validation"