2026-10-11T01:39:41.813592Z  INFO vector::app: Log level is enabled. level="info"
2026-10-11T01:39:41.814075Z  INFO vector::app: Loading configs. paths=["/etc/vector"]
2026-10-11T01:39:41.817459Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Obtained Kubernetes Node name to collect logs for (self). self_node_name="ip-10-0-171-231.ec2.internal"
2026-10-11T01:39:41.824524Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Including matching files. ret=["**/*"]
2026-10-11T01:39:41.824543Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}: vector::sources::kubernetes_logs: Internal log [Including matching files.] is being suppressed to avoid flooding.
2026-10-11T01:39:41.826673Z  INFO vector::topology::running: Running healthchecks.
2026-10-11T01:39:41.826737Z  INFO vector::topology::builder: Healthcheck passed.
2026-10-11T01:39:41.826755Z  INFO vector: Vector has started. debug="false" version="0.57.0" arch="x86_64" revision="8832452 2026-07-14 20:58:30.491174540"
2026-10-11T01:39:41.827070Z  INFO vector::api::grpc_server: GRPC API server bound to 127.0.0.1:8686.
2026-10-11T01:39:41.827094Z  INFO vector::api::grpc_server: GRPC API server started on 127.0.0.1:8686.
2026-10-11T01:39:41.827103Z  INFO vector::internal_events::api: API server running. address=127.0.0.1:8686
2026-10-11T01:50:56.024172Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-init-pod_5acae514-1e41-441d-a033-f2658ad7382e/prepare/0.log
2026/10/11 01:50:55 Entrypoint initialization
2026-10-11T01:51:08.331310Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-init-pod_5acae514-1e41-441d-a033-f2658ad7382e/step-init/0.log
2026-10-11T01:51:10.380872Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-init-pod_5acae514-1e41-441d-a033-f2658ad7382e/step-init/0.log
time="2026-10-11T01:51:09Z" level=info msg="[param] enable: false"
time="2026-10-11T01:51:09Z" level=info msg="[param] default-http-proxy: squid.caching.svc.cluster.local:3128"
time="2026-10-11T01:51:09Z" level=info msg="[param] default-no-proxy: brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai"
time="2026-10-11T01:51:09Z" level=info msg="[param] http-proxy-result-path: /tekton/results/http-proxy"
time="2026-10-11T01:51:09Z" level=info msg="[param] no-proxy-result-path: /tekton/results/no-proxy"
time="2026-10-11T01:51:09Z" level=info msg="Using in-cluster config" logger=KubeClient
time="2026-10-11T01:51:09Z" level=info msg="Cache proxy is disabled via param"
time="2026-10-11T01:51:09Z" level=info msg="[result] HTTP PROXY: "
time="2026-10-11T01:51:09Z" level=info msg="[result] NO PROXY: "
2026-10-11T01:51:14.494455Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026/10/11 01:51:13 Entrypoint initialization
2026/10/11 01:51:13 Decoded script /tekton/scripts/script-0-6vpp5
2026-10-11T01:51:24.752560Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-clone-repository-pod_2ca74b03-bd1a-41be-a073-c7db0ad215b5/step-clone/0.log
2026-10-11T01:51:26.803524Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 2 times.
2026-10-11T01:51:26.803539Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-clone-repository-pod_2ca74b03-bd1a-41be-a073-c7db0ad215b5/step-clone/0.log
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
time="2026-10-11T01:51:28Z" level=info msg="[param] url: https://github.com/conforma/golden-container.git"
time="2026-10-11T01:51:28Z" level=info msg="[param] depth: 1"
time="2026-10-11T01:51:28Z" level=info msg="[param] short-commit-length: 7"
time="2026-10-11T01:51:28Z" level=info msg="[param] subdirectory: source"
time="2026-10-11T01:51:28Z" level=info msg="[param] delete-existing: true"
time="2026-10-11T01:51:28Z" level=info msg="[param] target-branch: main"
time="2026-10-11T01:51:28Z" level=info msg="[param] merge-commit-author-name: Konflux CI Git Clone"
time="2026-10-11T01:51:28Z" level=info msg="[param] merge-commit-author-email: git-clone@konflux-ci.dev"
time="2026-10-11T01:51:28Z" level=info msg="[param] output-dir: /workspace/output"
time="2026-10-11T01:51:28Z" level=info msg="[param] retry-max-attempts: 10"
2026-10-11T01:51:30.923763Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026-10-11T01:51:31.442306Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026/10/11 01:51:30 Entrypoint initialization
2026/10/11 01:51:31 Decoded script /tekton/scripts/script-0-6mskk
2026-10-11T01:51:44.269269Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 1 times.
2026-10-11T01:51:44.269283Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-prefetch-dependencies-pod_bba914cc-1dfa-4893-a4bc-bf6bf0914057/step-prefetch-dependencies/0.log
2026-10-11T01:51:46.320423Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 2 times.
2026-10-11T01:51:46.320437Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-prefetch-dependencies-pod_bba914cc-1dfa-4893-a4bc-bf6bf0914057/step-prefetch-dependencies/0.log
2026-10-11T01:51:47.354373Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026/10/11 01:51:45 INFO Step was skipped due to when expressions were evaluated to false.
2026/10/11 01:51:46 Entrypoint initialization
2026-10-11T01:51:49.937206Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026/10/11 01:51:47 Decoded script /tekton/scripts/script-0-m254h
2026/10/11 01:51:47 Decoded script /tekton/scripts/script-1-h6pwf
2026/10/11 01:51:47 Decoded script /tekton/scripts/script-2-mn99z
2026/10/11 01:51:47 Decoded script /tekton/scripts/script-3-vdjz4
2026/10/11 01:51:47 Decoded script /tekton/scripts/script-4-cf4kb
2026-10-11T01:52:04.289683Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 1 times.
2026-10-11T01:52:04.289697Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-build-container-pod_30fc4d76-490a-4ce8-bdba-dc379e223352/step-build/0.log
2026-10-11T01:52:04.289818Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026-10-11T01:52:16.596403Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 1 times.
2026-10-11T01:52:16.596421Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-build-container-pod_30fc4d76-490a-4ce8-bdba-dc379e223352/step-sbom-syft-generate/0.log
2026-10-11T01:52:24.800321Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026-10-11T01:52:26.850821Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 2 times.
2026-10-11T01:52:26.850835Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-build-container-pod_30fc4d76-490a-4ce8-bdba-dc379e223352/step-build/0.log
[2026-10-11T01:52:25,847398864+00:00] Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
[2026-10-11T01:52:25,850382915+00:00] Update CA trust
[2026-10-11T01:52:28,031518007+00:00] Prepare system (architecture: x86_64)
Effective container policy:
{
  "default": [
    {
      "type": "insecureAcceptAnything"
    }
  ],
  "transports": {
    "docker-daemon": {
      "": [
        {
          "type": "insecureAcceptAnything"
        }
      ]
    }
  }
}
[2026-10-11T01:52:28,074423088+00:00] Run the build
[2026-10-11T01:52:28,077258714+00:00] konflux-build-cli image build -f /workspace/source/source/./Containerfile -t quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj --source source --context . --secret-dirs src=/additional-secret\,name=does-not-exist\,optional=true --workdir-mount '' --target '' --inherit-labels=true --source-date-epoch '' --rewrite-timestamp=false --squash=false --omit-history=false --image-source https://github.com/conforma/golden-container.git --image-revision 1170f583db17b9db20e993f89d6907dab9acc06f --quay-image-expires-after '' --build-args-file '' --annotations-file '' --legacy-build-timestamp '' --add-legacy-labels --include-legacy-buildinfo-path=true --skip-injections=false --skip-unused-stages=true --hermetic=false --image-pull-proxy '' --image-pull-noproxy '' --yum-repos-d-sources --yum-repos-d-target /etc/yum.repos.d --prefetch-dir '' --prefetch-dir-copy '' --prefetch-env-mount /cachi2/cachi2.env --prefetch-output-mount /cachi2/output --security-opts unmask=/proc/interrupts --rhsm-entitlements=/entitlement --containerfile-json-output /shared/parsed_dockerfile.json --resolved-base-images-output /shared/base_images_digests --no-cache --ulimits nofile=4096:4096 --src-tls-verify=true --dest-tls-verify=true --allow-cross-platform-images=false --build-args --envs --labels --annotations 
time="2026-10-11T01:52:28Z" level=info msg="[param] containerfile: /workspace/source/source/./Containerfile"
time="2026-10-11T01:52:28Z" level=info msg="[param] context: ."
time="2026-10-11T01:52:28Z" level=info msg="[param] source: source"
time="2026-10-11T01:52:28Z" level=info msg="[param] output-ref: quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"
time="2026-10-11T01:52:28Z" level=info msg="[param] secret-dirs: [src=/additional-secret,name=does-not-exist,optional=true]"
time="2026-10-11T01:52:28Z" level=info msg="[param] image-source: https://github.com/conforma/golden-container.git"
time="2026-10-11T01:52:28Z" level=info msg="[param] image-revision: 1170f583db17b9db20e993f89d6907dab9acc06f"
time="2026-10-11T01:52:28Z" level=info msg="[param] add-legacy-labels: true"
time="2026-10-11T01:52:28Z" level=info msg="[param] containerfile-json-output: /shared/parsed_dockerfile.json"
time="2026-10-11T01:52:28Z" level=info msg="[param] include-legacy-buildinfo-path: true"
time="2026-10-11T01:52:28Z" level=info msg="[param] yum-repos-d-target: /etc/yum.repos.d"
time="2026-10-11T01:52:28Z" level=info msg="[param] prefetch-output-mount: /cachi2/output"
time="2026-10-11T01:52:28Z" level=info msg="[param] prefetch-env-mount: /cachi2/cachi2.env"
time="2026-10-11T01:52:28Z" level=info msg="[param] resolved-base-images-output: /shared/base_images_digests"
time="2026-10-11T01:52:28Z" level=info msg="[param] rhsm-entitlements: /entitlement"
time="2026-10-11T01:52:28Z" level=info msg="[param] rhsm-mount-ca-certs: auto"
time="2026-10-11T01:52:28Z" level=info msg="[param] no-cache: true"
time="2026-10-11T01:52:28Z" level=info msg="[param] security-opts: [unmask=/proc/interrupts]"
time="2026-10-11T01:52:28Z" level=info msg="[param] ulimits: [nofile=4096:4096]"
time="2026-10-11T01:52:28Z" level=info msg="[param] sbom-format: spdx"
2026-10-11T01:53:05.849515Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-build-container-pod_30fc4d76-490a-4ce8-bdba-dc379e223352/step-push/0.log
[2026-10-11T01:53:03,920348844+00:00] Update CA trust
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
[2026-10-11T01:53:07,505548933+00:00] Convert image
[2026-10-11T01:53:07,506723232+00:00] Push image with unique tag
Pushing to quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj-build-container
[retry] executing: buildah push --format=docker --retry 3 --tls-verify=true quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj docker://quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj-build-container
Getting image source signatures
Copying blob sha256:b292391da7e2aaa2647a330fb3e52275643d95eb6b68b056874981dbc1bcc883
Copying blob sha256:6338bf48070048703b5e67ce3004f7e50baca61d725c74f673530571491f12bf
Copying blob sha256:1c4c7b821008611be4d06cbd2dce718750bece4ba6de72a7e85d1d75f8d2162f
time="2026-10-11T01:52:58Z" level=info msg="buildah [stderr] Trying to pull registry.access.redhat.com/ubi9/ubi-micro@sha256:414cfa255ea10eaef4528a26d5618eb67cf487b635ee20f8f14b9317bfd6a4be..."
time="2026-10-11T01:52:58Z" level=info msg="buildah [stderr] Getting image source signatures"
time="2026-10-11T01:53:01Z" level=info msg="buildah [stderr] Checking if image destination supports signatures"
time="2026-10-11T01:53:01Z" level=info msg="buildah [stderr] Copying blob sha256:a6ea345e47d8c80d172b8dedf5a286e29024b63b1af4934e688b7d12a0c8ab6b"
time="2026-10-11T01:53:01Z" level=info msg="buildah [stderr] Copying blob sha256:61c3e70d16b0534e4cf004a9c336e4ae8ee348580cca7a8fe487aa088ea63d12"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stderr] Copying config sha256:6922b7871a144fd939d85d27a53dd7a3790bb5078ea10bdc683da0f9b2e62728"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stderr] Writing manifest to image destination"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stderr] Storing signatures"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] 6922b7871a144fd939d85d27a53dd7a3790bb5078ea10bdc683da0f9b2e62728"
time="2026-10-11T01:53:02Z" level=info msg="Injecting buildinfo: added labels.json"
time="2026-10-11T01:53:02Z" level=info msg="Injecting buildinfo: no prefetch SBOM found, not adding content-sets.json"
time="2026-10-11T01:53:02Z" level=info msg="Building container image..."
time="2026-10-11T01:53:02Z" level=info msg="buildah [stderr] time=\"2026-10-11T01:53:02Z\" level=warning msg=\"missing \\\"GIT_ID\\\" build argument. Try adding \\\"--build-arg GIT_ID=<VALUE>\\\" to the command line\""
time="2026-10-11T01:53:02Z" level=info msg="buildah [stderr] time=\"2026-10-11T01:53:02Z\" level=warning msg=\"missing \\\"BUILD_DATE\\\" build argument. Try adding \\\"--build-arg BUILD_DATE=<VALUE>\\\" to the command line\""
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 1/8: FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:414cfa255ea10eaef4528a26d5618eb67cf487b635ee20f8f14b9317bfd6a4be"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 2/8: ARG GIT_ID"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 3/8: ARG TARGETARCH"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 4/8: ARG BUILD_DATE"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 5/8: LABEL name=\"Enterprise Contract Golden Container\"       vendor=\"Red Hat, Inc.\"       maintainer=\"hacbs-contract@redhat.com\"       version=\"1\"       release=\"1\"       build-date=$BUILD_DATE       summary=\"Trivial image build in compliance with Enterprise Contract policy\"       description=\"Trivial image build in compliance with Enterprise Contract policy\"       url=\"https://github.com/enterprise-contract/golden-container\"       distribution-scope=\"public\"       io.k8s.description=\"Trivial image build in compliance with Enterprise Contract policy\"       io.k8s.display-name=\"Enterprise Contract Contract Golden Container\"       io.openshift.tags=\"golden\"       vcs-ref=$GIT_ID       vcs-type=git       architecture=$TARGETARCH       com.redhat.component=\"enterprise-contract-golden-container\"       com.redhat.build-host=\"somewhere.over.the.rainbow\""
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 6/8: COPY --from=.konflux-buildinfo . /usr/share/buildinfo/"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 7/8: COPY --from=.konflux-buildinfo . /root/buildinfo/"
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] STEP 8/8: LABEL \"org.opencontainers.image.created\"=\"2026-10-11T01:52:28Z\" \"org.opencontainers.image.source\"=\"https://github.com/conforma/golden-container.git\" \"org.opencontainers.image.revision\"=\"1170f583db17b9db20e993f89d6907dab9acc06f\" \"build-date\"=\"2026-10-11T01:52:28Z\" \"architecture\"=\"x86_64\" \"vcs-url\"=\"https://github.com/conforma/golden-container.git\" \"vcs-ref\"=\"1170f583db17b9db20e993f89d6907dab9acc06f\" \"vcs-type\"=\"git\""
time="2026-10-11T01:53:02Z" level=info msg="buildah [stdout] COMMIT quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"
time="2026-10-11T01:53:03Z" level=info msg="buildah [stdout] --> cb5c99dbea02"
time="2026-10-11T01:53:03Z" level=info msg="buildah [stdout] Successfully tagged quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"
time="2026-10-11T01:53:03Z" level=info msg="buildah [stdout] cb5c99dbea0283f8ef4a027b16b587724b0b022f346a46e6c97639ae96905ead"
time="2026-10-11T01:53:03Z" level=info msg="Build completed successfully"
time="2026-10-11T01:53:03Z" level=info msg="Writing parsed Containerfile to: /shared/parsed_dockerfile.json"
time="2026-10-11T01:53:03Z" level=info msg="Containerfile JSON written successfully"
time="2026-10-11T01:53:03Z" level=info msg="Writing resolved base images to: /shared/base_images_digests"
time="2026-10-11T01:53:03Z" level=info msg="Resolved base images written successfully"
{"image_url":"quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"}[2026-10-11T01:53:03,072640710+00:00] Add metadata
Getting image source signatures
Copying blob sha256:b292391da7e2aaa2647a330fb3e52275643d95eb6b68b056874981dbc1bcc883
Copying blob sha256:1c4c7b821008611be4d06cbd2dce718750bece4ba6de72a7e85d1d75f8d2162f
Copying blob sha256:6338bf48070048703b5e67ce3004f7e50baca61d725c74f673530571491f12bf
Copying config sha256:cb5c99dbea0283f8ef4a027b16b587724b0b022f346a46e6c97639ae96905ead
Writing manifest to image destination
[2026-10-11T01:53:03,246872002+00:00] End build
2026-10-11T01:53:12.068549Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
Copying config sha256:cb5c99dbea0283f8ef4a027b16b587724b0b022f346a46e6c97639ae96905ead
Writing manifest to image destination
[2026-10-11T01:53:10,657971508+00:00] Push image with git revision
Pushing to quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj
[retry] executing: buildah push --format=docker --retry 3 --tls-verify=true --digestfile /workspace/source/image-digest quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj docker://quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj
Getting image source signatures
Copying blob sha256:b292391da7e2aaa2647a330fb3e52275643d95eb6b68b056874981dbc1bcc883
Copying blob sha256:6338bf48070048703b5e67ce3004f7e50baca61d725c74f673530571491f12bf
Copying blob sha256:1c4c7b821008611be4d06cbd2dce718750bece4ba6de72a7e85d1d75f8d2162f
Copying config sha256:cb5c99dbea0283f8ef4a027b16b587724b0b022f346a46e6c97639ae96905ead
Writing manifest to image destination
sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj
[retry] executing: kubectl get configmap cluster-config -n konflux-info -o json
Keyless signing is disabled (none of rekorInternalUrl, fulcioInternalUrl, defaultOIDCIssuer, tufInternalUrl are configured in the konflux-info/cluster-config configmap)
[2026-10-11T01:53:11,522355294+00:00] End push
[2026-10-11T01:53:11,792500276+00:00] Generate SBOM
Running syft on the image
Running syft on the source code
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal)
[2026-10-11T01:53:14,326151364+00:00] End sbom-syft-generate
[2026-10-11T01:53:14,816340142+00:00] Prepare SBOM
[2026-10-11T01:53:14,880962185+00:00] Generate SBOM with mobster
Skipping SBOM validation
2026-10-11T01:53:31.854957Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 2 times.
2026-10-11T01:53:31.854972Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-build-container-pod_30fc4d76-490a-4ce8-bdba-dc379e223352/step-upload-sbom/0.log
[2026-10-11T01:53:29,898397449+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
2026-10-11 01:53:26,684 [INFO] mobster.log: Logging level set to 20
2026-10-11 01:53:26,980 [INFO] mobster.oci: Fetching manifest for registry.access.redhat.com/ubi9/ubi-micro@sha256:414cfa255ea10eaef4528a26d5618eb67cf487b635ee20f8f14b9317bfd6a4be
2026-10-11 01:53:28,457 [INFO] mobster.cmd.generate.oci_image.contextual_sbom.contextualize: Contextual workflow will be used. Parent SBOM used for contextualization: https://anchore.com/syft/dir/var/workdir/source-3511c1a9-0ec3-4454-bf6d-0a95249b4ccc
2026-10-11 01:53:28,586 [INFO] mobster.cmd.generate.oci_image.contextual_sbom.logging: {"event_type": "contextual_sbom_matching_statistics", "parent_sbom_reference": "https://anchore.com/syft/dir/var/workdir/source-3511c1a9-0ec3-4454-bf6d-0a95249b4ccc", "component_sbom_reference": "https://konflux-ci.dev/spdxdocs/quay.io/redhat-appstudio-qe/test-images@sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5-96754ba4-b945-4812-9d9a-79130d9b2a7f", "component_packages": {"total": 35, "matched": 22, "unmatched_all": 13, "unmatched_component_only": 13, "unmatched_without_unique_id": 0}, "parent_packages": {"total": 174, "matched": 146, "unmatched_all": 28, "unmatched_removed_at_build": 28, "unmatched_without_unique_id": 0}, "match_methods": {"by_checksum": 0, "by_verification_code": 14, "by_purl": 8, "total": 22}, "match_origins": {"syft_to_syft": 19, "syft_to_hermeto": 0, "hermeto_to_syft": 3, "hermeto_to_hermeto": 0}, "duplicate_identifiers": {"checksums": {"count": 0, "details": []}, "verification_codes": {"count": 0, "details": []}, "purls": {"count": 0, "details": []}}}
2026-10-11 01:53:28,586 [INFO] mobster.cmd.generate.oci_image: Contextual SBOM workflow finished successfully.
2026-10-11 01:53:28,586 [INFO] mobster.log: Contextual workflow completed in 1.70s
2026-10-11 01:53:28,684 [INFO] mobster.main: Exiting with code 0.
[2026-10-11T01:53:29,683908802+00:00] End prepare-sboms
Using token for quay.io/redhat-appstudio-qe
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj@sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/test-images@sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5] to [quay.io/redhat-appstudio-qe/test-images:sha256-37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/test-images@sha256:df18bf8e914de27d00293e1d4574f332b38c37d3559926a6f583c722a8209bec
[2026-10-11T01:53:55,977833792+00:00] End upload-sbom
2026-10-11T01:54:41.630967Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-apply-tags-pod_b8214f06-bb70-4f24-967f-57c9912ce1b3/prepare/0.log
2026-10-11T01:54:41.631075Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 2 times.
2026-10-11T01:54:41.631080Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-apply-tags-pod_b8214f06-bb70-4f24-967f-57c9912ce1b3/step-apply-additional-tags/0.log
2026-10-11T01:54:43.696851Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026/10/11 01:54:40 Entrypoint initialization
time="2026-10-11T01:54:43Z" level=info msg="[param] image-url: quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"
time="2026-10-11T01:54:43Z" level=info msg="[param] digest: sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5"
time="2026-10-11T01:54:43Z" level=info msg="[param] tags-from-image-label: konflux.additional-tags"
time="2026-10-11T01:54:44Z" level=warning msg="No tags given in 'konflux.additional-tags' image label"
2026-10-11T01:54:48.336121Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026/10/11 01:54:47 Entrypoint initialization
2026-10-11T01:54:52.451014Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 2 times.
2026-10-11T01:54:52.451030Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_buildah-demo-vddxxctnnj-push-dockerfile-pod_bc7ef2a9-b8c6-4ab1-b70a-2914e82c8b74/step-push/0.log
time="2026-10-11T01:54:52Z" level=info msg="[param] image-url: quay.io/redhat-appstudio-qe/test-images:buildah-demo-vddxxctnnj"
time="2026-10-11T01:54:52Z" level=info msg="[param] image-digest: sha256:37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5"
time="2026-10-11T01:54:52Z" level=info msg="[param] containerfile: Containerfile"
time="2026-10-11T01:54:52Z" level=info msg="[param] context: ."
time="2026-10-11T01:54:52Z" level=info msg="[param] tag-suffix: .dockerfile"
time="2026-10-11T01:54:52Z" level=info msg="[param] artifact-type: application/vnd.konflux.dockerfile"
time="2026-10-11T01:54:52Z" level=info msg="[param] source: source"
time="2026-10-11T01:54:52Z" level=info msg="[param] result-path-image-ref: /tekton/results/IMAGE_REF"
time="2026-10-11T01:54:52Z" level=info msg="[param] alternative-filename: Dockerfile"
time="2026-10-11T01:54:53Z" level=info msg="oras [stdout] quay.io/redhat-appstudio-qe/test-images@sha256:3255f196af5659ee4c3854739a97bebe70ee0d4614b9aaec84cfbb60d0897be8"
time="2026-10-11T01:54:53Z" level=info msg="Containerfile 'source/Containerfile' is pushed to registry with tag: sha256-37d94c1ab9838578eb1525122aa0da7dcd4e1fcd33ae857d409886ea8cd854c5.dockerfile"
{"tags":null}
{"image_ref":"quay.io/redhat-appstudio-qe/test-images@sha256:3255f196af5659ee4c3854739a97bebe70ee0d4614b9aaec84cfbb60d0897be8"}
2026-10-11T01:56:17.627313Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-97ca67eb0e556fc36d0364a063d34c34-pod_e317d955-3019-4d64-b02f-58c22886f806/place-scripts/0.log
2026-10-11T01:56:17.627561Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026/10/11 01:56:17 Decoded script /tekton/scripts/script-2-ptvck
2026/10/11 01:56:17 Entrypoint initialization
2026-10-11T01:56:27.903243Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 2 times.
2026-10-11T01:56:27.903256Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-97ca67eb0e556fc36d0364a063d34c34-pod_e317d955-3019-4d64-b02f-58c22886f806/step-assert/0.log
2026-10-11T01:56:27.903388Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026-10-11T01:56:29.956819Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 1 times.
2026-10-11T01:56:29.956835Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-97ca67eb0e556fc36d0364a063d34c34-pod_e317d955-3019-4d64-b02f-58c22886f806/step-initialize-tuf/0.log
2026-10-11T01:56:29.957023Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026/10/11 01:56:29 INFO Step was skipped due to when expressions were evaluated to false.
Single Component mode? false
{
  "components": [
    {
      "name": "",
      "containerImage": "quay.io/konflux-ci/ec-golden-image:latest",
      "source": {}
    },
    {
      "name": "",
      "containerImage": "quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task",
      "source": {}
    }
  ],
  "artifacts": {}
}
2026-10-11T01:56:42.291286Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 1 times.
2026-10-11T01:56:42.291300Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-97ca67eb0e556fc36d0364a063d34c34-pod_e317d955-3019-4d64-b02f-58c22886f806/step-assert/0.log
2026-10-11T01:56:42.291466Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
{
  "timestamp": "1791683800",
  "namespace": "",
  "successes": 84,
  "failures": 0,
  "warnings": 0,
  "result": "SUCCESS"
}
Success: true
Result: SUCCESS
Violations: 0, Warnings: 0, Successes: 84

Components:
- Name: -sha256:accce62e3f7018ff8dead73b5b4fc3cba816069ed939750555ce0effe6aef99c-arm64
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:accce62e3f7018ff8dead73b5b4fc3cba816069ed939750555ce0effe6aef99c
  Violations: 0, Warnings: 0, Successes: 21

- Name: -sha256:718c880015c46cf996593ae2a9fb050caf4f48b9e716cc80fd191b560816968a-amd64
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:718c880015c46cf996593ae2a9fb050caf4f48b9e716cc80fd191b560816968a
  Violations: 0, Warnings: 0, Successes: 21

- Name: 
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Violations: 0, Warnings: 0, Successes: 21

- Name: 
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:1d1ffaeff4867f7ccf7126d4e30f376b7becbfee2a65352fde244622fd257acb
  Violations: 0, Warnings: 0, Successes: 21

true
Version            v0.9.25
Source ID          b345847182602d9a5ce9e957fa76fe02575c8018
Change date        2026-04-27 12:52:43 +0000 UTC (23 weeks ago)
ECC                v0.1.7
OPA                v1.15.2
Conftest           v0.68.2
Cosign             v3.0.4
Sigstore           v1.10.4
Rekor              v1.5.0
Tekton Pipeline    v1.9.2
Kubernetes Client  v0.35.0
{"success": true,"components": [{"name": "-sha256:accce62e3f7018ff8dead73b5b4fc3cba816069ed939750555ce0effe6aef99c-arm64","containerImage": "quay.io/konflux-ci/ec-golden-image@sha256:accce62e3f7018ff8dead73b5b4fc3cba816069ed939750555ce0effe6aef99c","source": {},"successes": [{"msg": "Pass","metadata": {"code": "attestation_type.known_attestation_type","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.pipelinerun_attestation_found"],"description": "Confirm the attestation found for the image has a known attestation type.","title": "Known attestation type found"}},{"msg": "Pass","metadata": {"code": "attestation_type.pipelinerun_attestation_found","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"description": "Confirm at least one PipelineRun attestation is present.","title": "PipelineRun attestation found"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.signature_check","description": "The attestation signature matches available signing materials.","title": "Attestation signature check passed"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.syntax_check","description": "The attestation has correct syntax.","title": "Attestation syntax check passed"}},{"msg": "Pass","metadata": {"code": "builtin.image.signature_check","description": "The image signature matches available signing materials.","title": "Image signature check passed"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.allowed_builder_ids_provided","collections": ["slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_builder_ids` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed builder IDs provided"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_accepted","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set to one of the values in the `allowed_builder_ids` rule data, e.g. \"https://tekton.dev/chains/v2\".","title": "SLSA Builder ID is known and accepted"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_found","collections": ["slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set.","title": "SLSA Builder ID found"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_script_used","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicate.buildConfig.tasks.steps attribute for the task responsible for building and pushing the image is not empty.","title": "Build task contains steps"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_task_image_results_found","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm that a build task exists and it has the expected IMAGE_DIGEST and IMAGE_URL task results.","title": "Build task set image digest and url task results"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.subject_build_task_matches","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify the subject of the attestations matches the IMAGE_DIGEST and IMAGE_URL values from the build task.","title": "Provenance subject matches build task image result"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.allowed_predicate_types_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed predicate types provided"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.attestation_predicate_type_accepted","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.","title": "Expected attestation predicate type found"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.attested_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Attestation contains source reference.","title": "Source reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.expected_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the provided source code reference is the one being attested.","title": "Expected source code reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.rule_data_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the expected rule data keys have been provided in the expected format. The keys are `supported_vcs` and `supported_digests`.","title": "Rule data provided"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_format_okay","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm at least one entry in the predicate.materials array of the attestation contains the expected attributes: uri and digest.sha1.","title": "Materials have uri and digest"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_include_git_sha","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that each entry in the predicate.materials array with a SHA-1 digest includes a valid Git commit SHA.","title": "Materials include git commit shas"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_uri_is_git_repo","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure each entry in the predicate.materials array with a SHA-1 digest includes a valid Git URI.","title": "Material uri is a git repo"}},{"msg": "Pass","metadata": {"code": "tasks.pipeline_has_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that at least one Task is present in the PipelineRun attestation.","title": "Pipeline run includes at least one task"}},{"msg": "Pass","metadata": {"code": "tasks.successful_pipeline_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["tasks.pipeline_has_tasks"],"description": "Ensure that all of the Tasks in the Pipeline completed successfully. Note that skipped Tasks are not taken into account and do not influence the outcome.","title": "Successful pipeline tasks"}}],"success": true,"signatures": [{"keyid": "","sig": "MEYCIQDC5rk6js22xhAcaErWcTF0BgEWFLEsNtMey3P18pG4sQIhAPrPuT++uer8e+FPcKoDvD6Rvgt06PXyIxkfWU10xpi/"}],"attestations": [{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1/PipelineRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY",
"sig": "MEUCIQDc8MhqhXrS9VjAuf/Cv8kE4sQum937vncHdKYx68EWVgIgIO3EY2rnxCj5PiYtW2Gc3SVkJTc6uflY8wbWcnZIcbI="}]}]},{"name": "-sha256:718c880015c46cf996593ae2a9fb050caf4f48b9e716cc80fd191b560816968a-amd64","containerImage": "quay.io/konflux-ci/ec-golden-image@sha256:718c880015c46cf996593ae2a9fb050caf4f48b9e716cc80fd191b560816968a","source": {},"successes": [{"msg": "Pass","metadata": {"code": "attestation_type.known_attestation_type","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.pipelinerun_attestation_found"],"description": "Confirm the attestation found for the image has a known attestation type.","title": "Known attestation type found"}},{"msg": "Pass","metadata": {"code": "attestation_type.pipelinerun_attestation_found","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"description": "Confirm at least one PipelineRun attestation is present.","title": "PipelineRun attestation found"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.signature_check","description": "The attestation signature matches available signing materials.","title": "Attestation signature check passed"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.syntax_check","description": "The attestation has correct syntax.","title": "Attestation syntax check passed"}},{"msg": "Pass","metadata": {"code": "builtin.image.signature_check","description": "The image signature matches available signing materials.","title": "Image signature check passed"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.allowed_builder_ids_provided","collections": ["slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_builder_ids` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed builder IDs provided"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_accepted","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set to one of the values in the `allowed_builder_ids` rule data, e.g. \"https://tekton.dev/chains/v2\".","title": "SLSA Builder ID is known and accepted"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_found","collections": ["slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set.","title": "SLSA Builder ID found"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_script_used","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicate.buildConfig.tasks.steps attribute for the task responsible for building and pushing the image is not empty.","title": "Build task contains steps"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_task_image_results_found","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm that a build task exists and it has the expected IMAGE_DIGEST and IMAGE_URL task results.","title": "Build task set image digest and url task results"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.subject_build_task_matches","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify the subject of the attestations matches the IMAGE_DIGEST and IMAGE_URL values from the build task.","title": "Provenance subject matches build task image result"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.allowed_predicate_types_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed predicate types provided"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.attestation_predicate_type_accepted","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.","title": "Expected attestation predicate type found"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.attested_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Attestation contains source reference.","title": "Source reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.expected_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the provided source code reference is the one being attested.","title": "Expected source code reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.rule_data_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the expected rule data keys have been provided in the expected format. The keys are `supported_vcs` and `supported_digests`.","title": "Rule data provided"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_format_okay","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm at least one entry in the predicate.materials array of the attestation contains the expected attributes: uri and digest.sha1.","title": "Materials have uri and digest"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_include_git_sha","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that each entry in the predicate.materials array with a SHA-1 digest includes a valid Git commit SHA.","title": "Materials include git commit shas"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_uri_is_git_repo","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure each entry in the predicate.materials array with a SHA-1 digest includes a valid Git URI.","title": "Material uri is a git repo"}},{"msg": "Pass","metadata": {"code": "tasks.pipeline_has_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that at least one Task is present in the PipelineRun attestation.","title": "Pipeline run includes at least one task"}},{"msg": "Pass","metadata": {"code": "tasks.successful_pipeline_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["tasks.pipeline_has_tasks"],"description": "Ensure that all of the Tasks in the Pipeline completed successfully. Note that skipped Tasks are not taken into account and do not influence the outcome.","title": "Successful pipeline tasks"}}],"success": true,"signatures": [{"keyid": "","sig": "MEUCIHMj42Jk4Pe1QhEz4/fImqGv6BlpSkxFjhHiYOmOV7NAAiEAky4ALcPzv9sncy2iFYhCbfylvKcchv2TP1YGpE0q/kA="}],"attestations": [{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1/PipelineRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY",
"sig": "MEUCIQDc8MhqhXrS9VjAuf/Cv8kE4sQum937vncHdKYx68EWVgIgIO3EY2rnxCj5PiYtW2Gc3SVkJTc6uflY8wbWcnZIcbI="}]}]},{"name": "","containerImage": "quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25","source": {},"successes": [{"msg": "Pass","metadata": {"code": "attestation_type.known_attestation_type","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.pipelinerun_attestation_found"],"description": "Confirm the attestation found for the image has a known attestation type.","title": "Known attestation type found"}},{"msg": "Pass","metadata": {"code": "attestation_type.pipelinerun_attestation_found","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"description": "Confirm at least one PipelineRun attestation is present.","title": "PipelineRun attestation found"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.signature_check","description": "The attestation signature matches available signing materials.","title": "Attestation signature check passed"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.syntax_check","description": "The attestation has correct syntax.","title": "Attestation syntax check passed"}},{"msg": "Pass","metadata": {"code": "builtin.image.signature_check","description": "The image signature matches available signing materials.","title": "Image signature check passed"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.allowed_builder_ids_provided","collections": ["slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_builder_ids` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed builder IDs provided"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_accepted","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set to one of the values in the `allowed_builder_ids` rule data, e.g. \"https://tekton.dev/chains/v2\".","title": "SLSA Builder ID is known and accepted"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_found","collections": ["slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set.","title": "SLSA Builder ID found"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_script_used","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicate.buildConfig.tasks.steps attribute for the task responsible for building and pushing the image is not empty.","title": "Build task contains steps"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_task_image_results_found","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm that a build task exists and it has the expected IMAGE_DIGEST and IMAGE_URL task results.","title": "Build task set image digest and url task results"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.subject_build_task_matches","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify the subject of the attestations matches the IMAGE_DIGEST and IMAGE_URL values from the build task.","title": "Provenance subject matches build task image result"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.allowed_predicate_types_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed predicate types provided"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.attestation_predicate_type_accepted","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.","title": "Expected attestation predicate type found"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.attested_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Attestation contains source reference.","title": "Source reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.expected_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the provided source code reference is the one being attested.","title": "Expected source code reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.rule_data_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the expected rule data keys have been provided in the expected format. The keys are `supported_vcs` and `supported_digests`.","title": "Rule data provided"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_format_okay","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm at least one entry in the predicate.materials array of the attestation contains the expected attributes: uri and digest.sha1.","title": "Materials have uri and digest"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_include_git_sha","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that each entry in the predicate.materials array with a SHA-1 digest includes a valid Git commit SHA.","title": "Materials include git commit shas"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_uri_is_git_repo","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure each entry in the predicate.materials array with a SHA-1 digest includes a valid Git URI.","title": "Material uri is a git repo"}},{"msg": "Pass","metadata": {"code": "tasks.pipeline_has_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that at least one Task is present in the PipelineRun attestation.","title": "Pipeline run includes at least one task"}},{"msg": "Pass","metadata": {"code": "tasks.successful_pipeline_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["tasks.pipeline_has_tasks"],"description": "Ensure that all of the Tasks in the Pipeline completed successfully. Note that skipped Tasks are not taken into account and do not influence the outcome.","title": "Successful pipeline tasks"}}],"success": true,"signatures": [{"keyid": "","sig": "MEUCIQD86lmOqCovYZDPKm0XxxsLgDQcFIFAv+QZxrFSHmCvQAIgTd1I005ox8MfABqsAen6PZEyg2MCEQNBCx1NLS3V0JQ="}],"attestations": [{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1beta1/TaskRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY",
"sig": "MEUCIQDcgZIwEkLFqD7U9HrobgEC8Jo7wm+xJ5AoyO3qg+aj8QIgb9xDpjYGRMmpVk+QATeVKlHonzBiu51HtT3J+lQXPXc="}]},{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1beta1/PipelineRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY","sig": "MEYCIQDKSihaAR/zAhJhR5GCqleDvfUUtvRw61vk0YeTBAnOSQIhAKa09B4yEfaSJronmWBFbu5cVPNxm17CMl/PElEz1POa"}]}]},{"name": "","containerImage": "quay.io/konflux-ci/ec-golden-image@sha256:1d1ffaeff4867f7ccf7126d4e30f376b7becbfee2a65352fde244622fd257acb","source": {},"successes": [{"msg": "Pass","metadata": {"code": "attestation_type.known_attestation_type","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.pipelinerun_attestation_found"],"description": "Confirm the attestation found for the image has a known attestation type.","title": "Known attestation type found"}},{"msg": "Pass","metadata": {"code": "attestation_type.pipelinerun_attestation_found","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"description": "Confirm at least one PipelineRun attestation is present.","title": "PipelineRun attestation found"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.signature_check","description": "The attestation signature matches available signing materials.","title": "Attestation signature check passed"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.syntax_check","description": "The attestation has correct syntax.","title": "Attestation syntax check passed"}},{"msg": "Pass","metadata": {"code": "builtin.image.signature_check","description": "The image signature matches available signing materials.","title": "Image signature check passed"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.allowed_builder_ids_provided","collections": ["slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_builder_ids` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed builder IDs provided"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_accepted","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set to one of the values in the `allowed_builder_ids` rule data, e.g. \"https://tekton.dev/chains/v2\".","title": "SLSA Builder ID is known and accepted"}},{"msg": "Pass","metadata": {"code": "slsa_build_build_service.slsa_builder_id_found","collections": ["slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the attestation attribute predicate.builder.id is set.","title": "SLSA Builder ID found"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_script_used","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicate.buildConfig.tasks.steps attribute for the task responsible for building and pushing the image is not empty.","title": "Build task contains steps"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.build_task_image_results_found","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm that a build task exists and it has the expected IMAGE_DIGEST and IMAGE_URL task results.","title": "Build task set image digest and url task results"}},{"msg": "Pass","metadata": {"code": "slsa_build_scripted_build.subject_build_task_matches","collections": ["slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify the subject of the attestations matches the IMAGE_DIGEST and IMAGE_URL values from the build task.","title": "Provenance subject matches build task image result"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.allowed_predicate_types_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the `allowed_predicate_types` rule data was provided, since it is required by the policy rules in this package.","title": "Allowed predicate types provided"}},{"msg": "Pass","metadata": {"code": "slsa_provenance_available.attestation_predicate_type_accepted","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the predicateType field of the attestation indicates the in-toto SLSA Provenance format was used to attest the PipelineRun.","title": "Expected attestation predicate type found"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.attested_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Attestation contains source reference.","title": "Source reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.expected_source_code_reference","collections": ["minimal","slsa3","redhat","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Verify that the provided source code reference is the one being attested.","title": "Expected source code reference"}},{"msg": "Pass","metadata": {"code": "slsa_source_correlated.rule_data_provided","collections": ["minimal","slsa3","redhat","redhat_rpms","policy_data","redhat_security"],"description": "Confirm the expected rule data keys have been provided in the expected format. The keys are `supported_vcs` and `supported_digests`.","title": "Rule data provided"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_format_okay","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Confirm at least one entry in the predicate.materials array of the attestation contains the expected attributes: uri and digest.sha1.","title": "Materials have uri and digest"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_include_git_sha","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that each entry in the predicate.materials array with a SHA-1 digest includes a valid Git commit SHA.","title": "Materials include git commit shas"}},{"msg": "Pass","metadata": {"code": "slsa_source_version_controlled.materials_uri_is_git_repo","collections": ["minimal","slsa3","redhat","redhat_rpms","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure each entry in the predicate.materials array with a SHA-1 digest includes a valid Git URI.","title": "Material uri is a git repo"}},{"msg": "Pass","metadata": {"code": "tasks.pipeline_has_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["attestation_type.known_attestation_type"],"description": "Ensure that at least one Task is present in the PipelineRun attestation.","title": "Pipeline run includes at least one task"}},{"msg": "Pass","metadata": {"code": "tasks.successful_pipeline_tasks","collections": ["minimal","redhat","redhat_rpms","slsa3","redhat_security"],"depends_on": ["tasks.pipeline_has_tasks"],"description": "Ensure that all of the Tasks in the Pipeline completed successfully. Note that skipped Tasks are not taken into account and do not influence the outcome.","title": "Successful pipeline tasks"}}],"success": true,"signatures": [{"keyid": "",
{
  "policy": {
    "name": "Default",
    "description": "Includes rules for levels 1, 2 & 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml",
    "sources": [
      {
        "name": "Default",
        "policy": [
          "oci::quay.io/enterprise-contract/ec-release-policy:konflux@sha256:0d3ab4efb94bd8ee361bda3146cae0c509c41d597431af658ce2570112efe469"
        ],
        "data": [
          "git::github.com/release-engineering/rhtap-ec-policy//data?ref=5a749b9a6e46d358ee240e8c884fabd8da93b6c5",
          "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:1ef4231af73705a7e18f2e35b1e0980c901fcf3f3e89b9370b7c9ac17483ff1c",
          "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest@sha256:0b31c7bc77a7463a1bc52f3d3625ef0e0e75443da7fd2de8005d7885282138ea",
          "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest@sha256:7b00455045ea3873a72caeb1e7ac7d036bd53963a26409891a4cc9d0d242b9fc"
        ],
        "config": {
          "exclude": [
            "slsa_source_correlated.source_code_reference_provided"
          ],
          "include": [
            "@slsa3"
          ]
        }
      }
    ],
    "publicKey": "k8s://chains-e2e-dmwr/golden-image-public-keyerpcjwrfxr"
  },
  "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----\n",
  "effective-time": "2026-10-11T01:56:29.979174792Z"
}
2026-10-11T01:57:09.004068Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 5 times.
2026-10-11T01:57:09.004083Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-45f155574afc3b1e5e7e800a91645a5d-pod_8f1b34d3-9fde-4535-933e-e0dc15e2d040/place-scripts/0.log
2026-10-11T01:57:09.004259Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
2026-10-11T01:57:10.043822Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] has been suppressed 8 times.
2026-10-11T01:57:10.043838Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Currently ignoring file too small to fingerprint. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-45f155574afc3b1e5e7e800a91645a5d-pod_8f1b34d3-9fde-4535-933e-e0dc15e2d040/step-initialize-tuf/0.log
2026-10-11T01:57:10.043953Z  WARN source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Currently ignoring file too small to fingerprint.] is being suppressed to avoid flooding.
2026/10/11 01:57:07 Entrypoint initialization
2026/10/11 01:57:08 Decoded script /tekton/scripts/script-2-p4hl8
Single Component mode? false
{
  "components": [
    {
      "name": "",
      "containerImage": "quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task",
      "source": {}
    }
  ],
  "artifacts": {}
}
2026/10/11 01:57:12 INFO Step was skipped due to when expressions were evaluated to false.
"sig": "MEUCIQCTy9ClDtA6jcnlnvugBFNVl0OY4rM6C/1S+FmEFNGdjAIgSN281DQfsDONpyyFyuHjw8X7jpmSLYdrJS2UDECVdYU="}],"attestations": [{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1/PipelineRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY","sig": "MEUCIQDc8MhqhXrS9VjAuf/Cv8kE4sQum937vncHdKYx68EWVgIgIO3EY2rnxCj5PiYtW2Gc3SVkJTc6uflY8wbWcnZIcbI="}]}]}],"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----\n","policy": {"name": "Default","description": "Includes rules for levels 1, 2 & 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml","sources": [{"name": "Default","policy": ["oci::quay.io/enterprise-contract/ec-release-policy:konflux@sha256:0d3ab4efb94bd8ee361bda3146cae0c509c41d597431af658ce2570112efe469"],"data": ["git::github.com/release-engineering/rhtap-ec-policy//data?ref=5a749b9a6e46d358ee240e8c884fabd8da93b6c5","oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:1ef4231af73705a7e18f2e35b1e0980c901fcf3f3e89b9370b7c9ac17483ff1c","oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest@sha256:0b31c7bc77a7463a1bc52f3d3625ef0e0e75443da7fd2de8005d7885282138ea","oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest@sha256:7b00455045ea3873a72caeb1e7ac7d036bd53963a26409891a4cc9d0d242b9fc"],"config": {"exclude": ["slsa_source_correlated.source_code_reference_provided"],"include": ["@slsa3"]}}],"publicKey": "k8s://chains-e2e-dmwr/golden-image-public-keyerpcjwrfxr"},"ec-version": "v0.9.25","effective-time": "2026-10-11T01:56:29.979174792Z"}
2026-10-11T01:57:21.363918Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] has been suppressed 3 times.
2026-10-11T01:57:21.363932Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Found new file to watch. file=/var/log/pods/chains-e2e-dmwr_verify-enterprise-contract-45f155574afc3b1e5e7e800a91645a5d-pod_8f1b34d3-9fde-4535-933e-e0dc15e2d040/step-assert/0.log
2026-10-11T01:57:21.364137Z  INFO source{component_kind="source" component_id=kubernetes_logs component_type=kubernetes_logs}:file_server: vector::internal_events::file::source: Internal log [Found new file to watch.] is being suppressed to avoid flooding.
Success: false
Result: FAILURE
Violations: 11, Warnings: 0, Successes: 3
Component: 
ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25

Results:
✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "build-container" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-buildah:0.1@sha256:c3712257615d206ef40013bf1c5c681670fc8f7fd6aac9fa4c86f7afeff627ef.
  The denial reason is: not_allowed
  Term: buildah
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:buildah" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "clair-scan" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-clair-scan:0.1@sha256:fba8170329ab00b864ee7d16e0358df4c4386880e10894fd7bbbb1457112477b.
  The denial reason is: not_allowed
  Term: clair-scan
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:clair-scan" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "clamav-scan" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-clamav-scan:0.1@sha256:28b425322aa84f988c6c4f8d503787b3fb301668b2ad6728846b8f8c45ba012b.
  The denial reason is: not_allowed
  Term: clamav-scan
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:clamav-scan" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "deprecated-base-image-check" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-deprecated-image-check:0.1@sha256:28d724dd6f6c365b2a839d9e52baac91559fd78c160774769c1ec724301f78d4.
  The denial reason is: not_allowed
  Term: deprecated-image-check
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:deprecated-image-check" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "clone-repository" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-git-clone:0.1@sha256:f4e37778cba00296606ddfbc1c58181330899cafcaa1ee41c75a7cf8bed312f0.
  The denial reason is: not_allowed
  Term: git-clone
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:git-clone" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "init" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-init:0.1@sha256:5ce77110e2a49407a69a7922042dc0859f7e8f5f75dc0cd0bcc2d17860469bdb.
  The denial reason is: not_allowed
  Term: init
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:init" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "sanity-inspect-image" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-inspect-image:0.1@sha256:fd4efd9d12eea3a8d47532c4226e685618845d0ba95abb98e008020243d96301.
  The denial reason is: not_allowed
  Term: sanity-inspect-image
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:sanity-inspect-image" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "sanity-label-check" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-label-check:0.1@sha256:534770bf7a7c10277ab5f9c1e7b766abbffb343cc864dd9545aecc5278257dc3.
  The denial reason is: not_allowed
  Term: sanity-label-check
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:sanity-label-check" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "sanity-optional-label-check" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-label-check:0.1@sha256:534770bf7a7c10277ab5f9c1e7b766abbffb343cc864dd9545aecc5278257dc3.
  The denial reason is: not_allowed
  Term: sanity-label-check
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:sanity-label-check" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "sbom-json-check" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-sbom-json-check:0.1@sha256:ce6a0932da9b41080108284d1366fc2de8374fca5137500138e16ad9e04610c6.
  The denial reason is: not_allowed
  Term: sbom-json-check
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:sbom-json-check" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

✕ [Violation] trusted_task.trusted
  ImageRef: quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25
  Reason: PipelineTask "show-summary" uses an untrusted task reference:
  oci://quay.io/redhat-appstudio-tekton-catalog/task-summary:0.1@sha256:c0f66b28c338426774e34a8d4a00349fbab798b19df5841a95727148d5ef3c65.
  The denial reason is: not_allowed
  Term: summary
  Title: Tasks are trusted
  Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
  first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
  creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
  fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
  this rule add "trusted_task.trusted:summary" to the `exclude` section of the policy configuration.
  Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
  trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
  when newer versions are made available.

For more information about policy issues, see the policy documentation: https://conforma.dev/docs/policy/
false
{"success": false,"components": [{"name": "","containerImage": "quay.io/konflux-ci/ec-golden-image@sha256:304040ca1911aa4d911bd7c6d6d07193c57dc49dbc43e63828b42ab204fb1b25","source": {},"violations": [{"msg": "PipelineTask \"build-container\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-buildah:0.1@sha256:c3712257615d206ef40013bf1c5c681670fc8f7fd6aac9fa4c86f7afeff627ef. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:buildah\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "buildah","title": "Tasks are trusted"}},{"msg": "PipelineTask \"clair-scan\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-clair-scan:0.1@sha256:fba8170329ab00b864ee7d16e0358df4c4386880e10894fd7bbbb1457112477b. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:clair-scan\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "clair-scan","title": "Tasks are trusted"}},{"msg": "PipelineTask \"clamav-scan\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-clamav-scan:0.1@sha256:28b425322aa84f988c6c4f8d503787b3fb301668b2ad6728846b8f8c45ba012b. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:clamav-scan\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "clamav-scan","title": "Tasks are trusted"}},{"msg": "PipelineTask \"deprecated-base-image-check\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-deprecated-image-check:0.1@sha256:28d724dd6f6c365b2a839d9e52baac91559fd78c160774769c1ec724301f78d4. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:deprecated-image-check\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "deprecated-image-check","title": "Tasks are trusted"}},{"msg": "PipelineTask \"clone-repository\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-git-clone:0.1@sha256:f4e37778cba00296606ddfbc1c58181330899cafcaa1ee41c75a7cf8bed312f0. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:git-clone\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "git-clone","title": "Tasks are trusted"}},{"msg": "PipelineTask \"init\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-init:0.1@sha256:5ce77110e2a49407a69a7922042dc0859f7e8f5f75dc0cd0bcc2d17860469bdb. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:init\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "init","title": "Tasks are trusted"
}},{"msg": "PipelineTask \"sanity-inspect-image\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-inspect-image:0.1@sha256:fd4efd9d12eea3a8d47532c4226e685618845d0ba95abb98e008020243d96301. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:sanity-inspect-image\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "sanity-inspect-image","title": "Tasks are trusted"}},{"msg": "PipelineTask \"sanity-label-check\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-label-check:0.1@sha256:534770bf7a7c10277ab5f9c1e7b766abbffb343cc864dd9545aecc5278257dc3. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:sanity-label-check\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "sanity-label-check","title": "Tasks are trusted"}},{"msg": "PipelineTask \"sanity-optional-label-check\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-sanity-label-check:0.1@sha256:534770bf7a7c10277ab5f9c1e7b766abbffb343cc864dd9545aecc5278257dc3. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:sanity-label-check\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "sanity-label-check","title": "Tasks are trusted"}},{"msg": "PipelineTask \"sbom-json-check\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-sbom-json-check:0.1@sha256:ce6a0932da9b41080108284d1366fc2de8374fca5137500138e16ad9e04610c6. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:sbom-json-check\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "sbom-json-check","title": "Tasks are trusted"}},{"msg": "PipelineTask \"show-summary\" uses an untrusted task reference: oci://quay.io/redhat-appstudio-tekton-catalog/task-summary:0.1@sha256:c0f66b28c338426774e34a8d4a00349fbab798b19df5841a95727148d5ef3c65. The denial reason is: not_allowed","metadata": {"code": "trusted_task.trusted","collections": ["redhat","redhat_security"],"description": "Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add \"trusted_task.trusted:summary\" to the `exclude` section of the policy configuration.","solution": "If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available.","term": "summary","title": "Tasks are trusted"}}],"successes": [{"msg": "Pass","metadata": {"code": "builtin.attestation.signature_check","description": "The attestation signature matches available signing materials.","title": "Attestation signature check passed"}},{"msg": "Pass","metadata": {"code": "builtin.attestation.syntax_check","description": "The attestation has correct syntax.","title": "Attestation syntax check passed"}},{"msg": "Pass","metadata": {"code": "builtin.image.signature_check","description": "The image signature matches available signing materials.","title": "Image signature check passed"}}],"success": false,"signatures": [{"keyid": "","sig": "MEUCIQD86lmOqCovYZDPKm0XxxsLgDQcFIFAv+QZxrFSHmCvQAIgTd1I005ox8MfABqsAen6PZEyg2MCEQNBCx1NLS3V0JQ="}],"attestations": [{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1beta1/TaskRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY","sig": "MEUCIQDcgZIwEkLFqD7U9HrobgEC8Jo7wm+xJ5AoyO3qg+aj8QIgb9xDpjYGRMmpVk+QATeVKlHonzBiu51HtT3J+lQXPXc="}]},{"type": "https://in-toto.io/Statement/v0.1","predicateType": "https://slsa.dev/provenance/v0.2","predicateBuildType": "tekton.dev/v1beta1/PipelineRun","signatures": [{"keyid": "SHA256:IhiN7gY+Z3uSSd7tmj6w5Zfhqafzdhm3DZjIvGc6iYY",
{
  "policy": {
    "name": "Default",
    "description": "Includes rules for levels 1, 2 & 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml",
    "sources": [
      {
        "name": "Default",
        "policy": [
          "oci::quay.io/enterprise-contract/ec-release-policy:konflux@sha256:0d3ab4efb94bd8ee361bda3146cae0c509c41d597431af658ce2570112efe469"
        ],
        "data": [
          "git::github.com/release-engineering/rhtap-ec-policy//data?ref=5a749b9a6e46d358ee240e8c884fabd8da93b6c5",
          "oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:1ef4231af73705a7e18f2e35b1e0980c901fcf3f3e89b9370b7c9ac17483ff1c",
          "oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest@sha256:0b31c7bc77a7463a1bc52f3d3625ef0e0e75443da7fd2de8005d7885282138ea",
          "oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest@sha256:7b00455045ea3873a72caeb1e7ac7d036bd53963a26409891a4cc9d0d242b9fc"
        ],
        "config": {
          "include": [
            "trusted_task.trusted"
          ]
        }
      }
    ],
    "publicKey": "k8s://chains-e2e-dmwr/golden-image-public-keyszdwvocunj"
  },
  "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----\n",
  "effective-time": "2026-10-11T01:57:13.2857789Z"
}
Version            v0.9.25
Source ID          b345847182602d9a5ce9e957fa76fe02575c8018
Change date        2026-04-27 12:52:43 +0000 UTC (23 weeks ago)
ECC                v0.1.7
OPA                v1.15.2
Conftest           v0.68.2
Cosign             v3.0.4
Sigstore           v1.10.4
Rekor              v1.5.0
Tekton Pipeline    v1.9.2
Kubernetes Client  v0.35.0
{
  "timestamp": "1791683839",
  "namespace": "",
  "successes": 3,
  "failures": 11,
  "warnings": 0,
  "result": "FAILURE"
}
"sig": "MEYCIQDKSihaAR/zAhJhR5GCqleDvfUUtvRw61vk0YeTBAnOSQIhAKa09B4yEfaSJronmWBFbu5cVPNxm17CMl/PElEz1POa"}]}]}],"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZP/0htjhVt2y0ohjgtIIgICOtQtA\nnaYJRuLprwIv6FDhZ5yFjYUEtsmoNcW7rx2KM6FOXGsCX3BNc7qhHELT+g==\n-----END PUBLIC KEY-----\n","policy": {"name": "Default","description": "Includes rules for levels 1, 2 & 3 of SLSA v0.1. This is the default config used for new Konflux applications. Source: https://github.com/conforma/config/blob/main/default/policy.yaml","sources": [{"name": "Default","policy": ["oci::quay.io/enterprise-contract/ec-release-policy:konflux@sha256:0d3ab4efb94bd8ee361bda3146cae0c509c41d597431af658ce2570112efe469"],"data": ["git::github.com/release-engineering/rhtap-ec-policy//data?ref=5a749b9a6e46d358ee240e8c884fabd8da93b6c5","oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:1ef4231af73705a7e18f2e35b1e0980c901fcf3f3e89b9370b7c9ac17483ff1c","oci::quay.io/konflux-ci/konflux-vanguard/data-acceptable-bundles:latest@sha256:0b31c7bc77a7463a1bc52f3d3625ef0e0e75443da7fd2de8005d7885282138ea","oci::quay.io/konflux-ci/integration-service-catalog/data-acceptable-bundles:latest@sha256:7b00455045ea3873a72caeb1e7ac7d036bd53963a26409891a4cc9d0d242b9fc"],"config": {"include": ["trusted_task.trusted"]}}],"publicKey": "k8s://chains-e2e-dmwr/golden-image-public-keyszdwvocunj"},"ec-version": "v0.9.25","effective-time": "2026-10-11T01:57:13.2857789Z"}