Skip to content

Commit

Permalink
chore: add a table of content and example expected values
Browse files Browse the repository at this point in the history
Signed-off-by: behnazh-w <[email protected]>
  • Loading branch information
behnazh-w committed Sep 13, 2024
1 parent 3f2d672 commit 7ffe436
Showing 1 changed file with 7 additions and 7 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
How to use Verification Summary Attestations
============================================

This tutorial explains how to use the Verification Summary Attestations (VSA) generated by Macaron, using the VSAs for the `Graal Development Kit (GDK) <https://graal.cloud/gdk/>`_ artifacts as an example.
This tutorial explains how to use the `Verification Summary Attestations (VSA) <https://slsa.dev/spec/v1.0/verification_summary>`_ generated by Macaron, using the VSAs for the `Graal Development Kit (GDK) <https://graal.cloud/gdk/>`_ artifacts as an example.

For more information about VSAs, please refer to the :ref:`Verification Summary Attestation page<vsa>`. To use Macaron to generate VSAs see this :ref:`tutorial <gen-vsa_tutorial>`.

* https://slsa.dev/spec/v1.0/verification_summary
.. contents:: :local:

--------
Use case
Expand Down Expand Up @@ -113,7 +113,7 @@ Here is a pretty-printed version of the policy as it appears in the VSA, along w
is_component(component_id, purl),
match("^pkg:maven/io.micronaut/micronaut-core@.*$", purl).
This policy makes sure the :ref:`mcn_provenance_expectation_1 <checks>` check, which verifies the content of the provenance file matches :ref:`CUE expectation <pages/using:Verifying provenance expectations in CUE language>`.
This policy makes sure the :ref:`mcn_provenance_expectation_1 <checks>` check, which verifies the content of the provenance file matches a :ref:`CUE expectation <pages/using:Verifying provenance expectations in CUE language>`.

* Policy prelude (``#include "prelude.dl"``): Copies all the pre-written rules and the generated fact import statements into the policy program. All user-written policy files must begin with ``#include "prelude.dl"``.

Expand All @@ -132,7 +132,7 @@ Here is a pretty-printed version of the policy as it appears in the VSA, along w
attestations: [
{
attestation: {
jobimage: "<IMAGE-ADDRESS>",
jobimage: "<IMAGE-NAME>",
projecturl: "https://<REPO_URL>",
},
},
Expand All @@ -141,11 +141,11 @@ Here is a pretty-printed version of the policy as it appears in the VSA, along w
}
* ``jobimage: "<IMAGE-ADDRESS>"``: This condition checks that the ``jobimage`` attribute matches a specific pattern. ``<IMAGE-ADDRESS>`` is a placeholder for the actual image name used at build time.
* ``jobimage: "<IMAGE-NAME>"``: This condition checks that the ``jobimage`` attribute matches a specific pattern. ``<IMAGE-NAME>`` is a placeholder for the actual image name used at build time, e.g., ``container-registry.oracle.com/os/oraclelinux:9-slim``.

* ``projecturl: "https://<REPO_URL>"``: This checks that the ``projecturl`` attribute exactly matches the expected Repository URL. ``<REPO_URL>`` is a placeholder for the actual repository URL.
* ``projecturl: "https://<REPO_URL>"``: This checks that the ``projecturl`` attribute exactly matches the expected Repository URL. ``<REPO_URL>`` is a placeholder for the actual repository URL, e.g., ``internal.repo.com/micronaut-projects/micronaut-core``.

* The template CUE expectation can be downloaded in `this location <https://github.com/oracle/macaron/tree/main/src/macaron/resources/policies/gdk/expectation.cue.template>`_.
* The template CUE expectation can be downloaded from `this location <https://github.com/oracle/macaron/tree/main/src/macaron/resources/policies/gdk/expectation.cue.template>`_.


'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Expand Down

0 comments on commit 7ffe436

Please sign in to comment.