{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/8a55da05-8de8-49a7-894c-68b57639ab12", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-0b1fc5f9538f9fe3-01\"}" }, "creationTimestamp": "2026-10-02T02:57:00Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "apply-tags", "tekton.dev/task": "apply-tags" }, "name": "buildah-demo-ozufxbwwvs-apply-tags", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "42854", "uid": "8a55da05-8de8-49a7-894c-68b57639ab12" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "IMAGE_DIGEST", "value": "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "apply-tags" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:57:04Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:57:04Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-apply-tags-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6" }, "entryPoint": "apply-tags", "uri": "quay.io/konflux-ci/tekton-catalog/task-apply-tags" } }, "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-0b1fc5f9538f9fe3-01" }, "startTime": "2026-10-02T02:57:00Z", "steps": [ { "container": "step-apply-additional-tags", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "apply-additional-tags", "provenance": {}, "terminated": { "containerID": "cri-o://034c25e4981dc5e44aff2cd6f43caf512eba618adb999599fc4696cb85c34eae", "exitCode": 0, "finishedAt": "2026-10-02T02:57:04Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:03Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Applies additional tags to the built image.", "params": [ { "description": "Image repository and tag reference of the the built image.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest of the built image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": [], "description": "Additional tags that will be applied to the image in the registry.", "name": "ADDITIONAL_TAGS", "type": "array" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--image-url", "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs", "--digest", "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37", "--tags", "--tags-from-image-label", "konflux.additional-tags" ], "command": [ "konflux-build-cli", "image", "apply-tags" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "apply-additional-tags" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-6914d2d0cc", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/46580c5f-c80c-4f28-9ed7-8ed0cbd25cb9", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-ee89788459ee0f4e-01\"}" }, "creationTimestamp": "2026-10-02T02:54:11Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.10.5", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "build-container", "tekton.dev/task": "buildah" }, "name": "buildah-demo-ozufxbwwvs-build-container", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "42364", "uid": "46580c5f-c80c-4f28-9ed7-8ed0cbd25cb9" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "CONTEXT", "value": "." }, { "name": "HERMETIC", "value": "false" }, { "name": "PREFETCH_INPUT", "value": "" }, { "name": "IMAGE_EXPIRES_AFTER", "value": "" }, { "name": "COMMIT_SHA", "value": "1170f583db17b9db20e993f89d6907dab9acc06f" }, { "name": "BUILD_ARGS", "value": [] }, { "name": "BUILD_ARGS_FILE", "value": "" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SOURCE_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "HTTP_PROXY", "value": "" }, { "name": "NO_PROXY", "value": "" }, { "name": "SOURCE_DATE_EPOCH", "value": "" }, { "name": "REWRITE_TIMESTAMP", "value": "false" }, { "name": "OMIT_HISTORY", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "buildah" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-buildah:0.10.5@sha256:28c2d07681152e749aaa8014f62c62a8f51288c3f2da82cbfcfb038bbcf34437" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:56:17Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:56:17Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-build-container-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "28c2d07681152e749aaa8014f62c62a8f51288c3f2da82cbfcfb038bbcf34437" }, "entryPoint": "buildah", "uri": "quay.io/konflux-ci/tekton-catalog/task-buildah" } }, "results": [ { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "SBOM_BLOB_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:57fac83a0110ded7a42be502578fe23843c4e50d66b39cbc44d55f0a317da22e" } ], "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-ee89788459ee0f4e-01" }, "startTime": "2026-10-02T02:54:11Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://ea4cf766ae76678130d3a9041fb5223304b442b5ec09dc3fed4a1ea559ed3db1", "exitCode": 0, "finishedAt": "2026-10-02T02:55:26Z", "reason": "Completed", "startedAt": "2026-10-02T02:54:52Z" }, "terminationReason": "Completed" }, { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://805a880a5d182c20e4535f9ec6e57e54c3407110cc1f44ae7d478cdf3f841a26", "exitCode": 0, "finishedAt": "2026-10-02T02:55:34Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:55:27Z" }, "terminationReason": "Completed" }, { "container": "step-sbom-syft-generate", "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "sbom-syft-generate", "provenance": {}, "terminated": { "containerID": "cri-o://2c9470d8936566e659253fd988634ad652763165d84fc21fc816823bd4011473", "exitCode": 0, "finishedAt": "2026-10-02T02:55:37Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:55:35Z" }, "terminationReason": "Completed" }, { "container": "step-prepare-sboms", "imageID": "quay.io/konflux-ci/mobster@sha256:135eec87fe80d0751a1ea5e8e47b240147b25ee9a41973cae365540d2e2ee473", "name": "prepare-sboms", "provenance": {}, "terminated": { "containerID": "cri-o://b659ffa1b6d00086e80ff7c18b471dfd33911df9273f0a352cef608820956f3d", "exitCode": 0, "finishedAt": "2026-10-02T02:55:51Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:55:37Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://3d4ee22c7b86c3d671f7f0a4ee132ef958e1ea20530718c311cf75154895dc82", "exitCode": 0, "finishedAt": "2026-10-02T02:56:16Z", "message": "[{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1},{\"key\":\"SBOM_BLOB_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:57fac83a0110ded7a42be502578fe23843c4e50d66b39cbc44d55f0a317da22e\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:55:51Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Buildah task builds source code into a container image and pushes the image into container registry using buildah tool.\nIn addition, it generates a SBOM file, injects the SBOM file into final container image and pushes the SBOM file as separate image using cosign tool.\nWhen prefetch-dependencies task is activated it is using its artifacts to run build in hermetic environment.", "params": [ { "description": "Reference of the image buildah will produce.", "name": "IMAGE", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile to build.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "default": "false", "description": "Determines if build will be executed without network access.", "name": "HERMETIC", "type": "string" }, { "default": "", "description": "In case it is not empty, the prefetched content should be made available to the build.", "name": "PREFETCH_INPUT", "type": "string" }, { "default": "", "description": "Delete image tag after specified time. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.", "name": "IMAGE_EXPIRES_AFTER", "type": "string" }, { "default": "", "description": "The image is built from this commit.", "name": "COMMIT_SHA", "type": "string" }, { "default": "repos.d", "description": "Path in the git repository in which yum repository files are stored", "name": "YUM_REPOS_D_SRC", "type": "string" }, { "default": "fetched.repos.d", "description": "Path in source workspace where dynamically-fetched repos are present", "name": "YUM_REPOS_D_FETCHED", "type": "string" }, { "default": "/etc/yum.repos.d", "description": "Target path on the container in which yum repository files should be made available", "name": "YUM_REPOS_D_TARGET", "type": "string" }, { "default": "", "description": "Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.", "name": "TARGET_STAGE", "type": "string" }, { "default": "etc-pki-entitlement", "description": "Name of secret which contains the entitlement certificates", "name": "ENTITLEMENT_SECRET", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" }, { "default": "auto", "description": "Mount /etc/rhsm/ca from the host machine into the build. Valid values are 'always', 'auto' (default), 'never'. Only effective if HERMETIC=false and ACTIVATION_KEY or ENTITLEMENT_SECRET is set.", "name": "RHSM_MOUNT_CA_CERTS", "type": "string" }, { "default": "does-not-exist", "description": "Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET", "name": "ADDITIONAL_SECRET", "type": "string" }, { "default": [], "description": "Array of --build-arg values (\"arg=value\" strings)", "name": "BUILD_ARGS", "type": "array" }, { "default": [], "description": "Array of --env values (\"env=value\" strings)", "name": "ENV_VARS", "type": "array" }, { "default": "", "description": "Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file", "name": "BUILD_ARGS_FILE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "true", "description": "Whether to keep compatibility location at /root/buildinfo/ for ICM injection", "name": "ICM_KEEP_COMPAT_LOCATION", "type": "string" }, { "default": "", "description": "Comma separated list of extra capabilities to add when running 'buildah build'", "name": "ADD_CAPABILITIES", "type": "string" }, { "default": "false", "description": "Squash all new and previous layers added as a part of this build, as per --squash", "name": "SQUASH", "type": "string" }, { "default": "overlay", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "true", "description": "Whether to skip stages in Containerfile that seem unused by subsequent stages", "name": "SKIP_UNUSED_STAGES", "type": "string" }, { "default": [], "description": "Additional key=value labels that should be applied to the image", "name": "LABELS", "type": "array" }, { "default": [], "description": "Additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS", "type": "array" }, { "default": "", "description": "Path to a file with additional key=value annotations that should be applied to the image", "name": "ANNOTATIONS_FILE", "type": "string" }, { "default": "false", "description": "Whether to enable privileged mode, should be used only with remote VMs", "name": "PRIVILEGED_NESTED", "type": "string" }, { "default": "false", "description": "Skip SBOM-related operations. This will likely cause EC policies to fail if enabled", "name": "SKIP_SBOM_GENERATION", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx. Note: the SBOM from the prefetch task - if there is one - must be in the same format.", "name": "SBOM_TYPE", "type": "string" }, { "default": "", "description": "Extra option to customize Syft's default catalogers when generating SBOMs. The value corresponds to Syft's CLI flag --select-catalogers. The details about available catalogers can be found here: https://github.com/anchore/syft/wiki/Package-Cataloger-Selection", "name": "SBOM_SYFT_SELECT_CATALOGERS", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM generation from source code. The scanner of the source code is enabled only for non-hermetic builds and can be disabled if the SBOM_SYFT_SELECT_CATALOGERS can't turn off catalogers that cause false positives on source code scanning.", "name": "SBOM_SOURCE_SCAN_ENABLED", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": [], "description": "Additional base image references to include to the SBOM. Array of image_reference_with_digest strings", "name": "ADDITIONAL_BASE_IMAGES", "type": "array" }, { "default": "", "description": "Mount the current working directory into the build using --volume $PWD:/$WORKINGDIR_MOUNT. Note that the $PWD will be the context directory for the build (see the CONTEXT param).", "name": "WORKINGDIR_MOUNT", "type": "string" }, { "default": "true", "description": "Determines if the image inherits the base image labels.", "name": "INHERIT_BASE_IMAGE_LABELS", "type": "string" }, { "default": "", "description": "HTTP/HTTPS proxy to use for the buildah pull and build operations. Will not be passed through to the container during the build process.", "name": "HTTP_PROXY", "type": "string" }, { "default": "", "description": "Comma separated list of hosts or domains which should bypass the HTTP/HTTPS proxy.", "name": "NO_PROXY", "type": "string" }, { "default": "caching-ca-bundle", "description": "The name of the ConfigMap to read proxy CA bundle data from.", "name": "PROXY_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the proxy CA bundle data.", "name": "PROXY_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "", "description": "Defines the single build time for all buildah builds in seconds since UNIX epoch. Conflicts with SOURCE_DATE_EPOCH.", "name": "BUILD_TIMESTAMP", "type": "string" }, { "default": "", "description": "The image is built from this URL.", "name": "SOURCE_URL", "type": "string" }, { "default": "true", "description": "Determines if SBOM will be contextualized.", "name": "CONTEXTUALIZE_SBOM", "type": "string" }, { "default": "true", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "false", "description": "Omit build history information from the resulting image. Improves reproducibility by excluding timestamps and layer metadata.", "name": "OMIT_HISTORY", "type": "string" }, { "default": "", "description": "Timestamp in seconds since Unix epoch for reproducible builds. Sets image created time and SOURCE_DATE_EPOCH build arg. Conflicts with BUILD_TIMESTAMP.", "name": "SOURCE_DATE_EPOCH", "type": "string" }, { "default": "false", "description": "Clamp mtime of all files to at most SOURCE_DATE_EPOCH. Does nothing if SOURCE_DATE_EPOCH is not defined.", "name": "REWRITE_TIMESTAMP", "type": "string" }, { "default": "false", "description": "Don't inject a content-sets.json or a labels.json file. This requires that the canonical Containerfile takes care of this itself.", "name": "SKIP_INJECTIONS", "type": "string" }, { "default": "info", "description": "Log level for the build command.", "name": "LOG_LEVEL", "type": "string" }, { "default": "false", "description": "Allows to use parent images that don't match the build host architecture. This option must be used with caution as it may create incompatible images.", "name": "ALLOW_CROSS_PLATFORM_IMAGES", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "Image reference of the built image", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "1", "memory": "4Gi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "STORAGE_DRIVER", "value": "overlay" }, { "name": "HERMETIC", "value": "false" }, { "name": "SOURCE_CODE_DIR", "value": "source" }, { "name": "CONTEXT", "value": "." }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "IMAGE_EXPIRES_AFTER" }, { "name": "YUM_REPOS_D_SRC", "value": "repos.d" }, { "name": "YUM_REPOS_D_FETCHED", "value": "fetched.repos.d" }, { "name": "YUM_REPOS_D_TARGET", "value": "/etc/yum.repos.d" }, { "name": "TARGET_STAGE" }, { "name": "ADDITIONAL_SECRET", "value": "does-not-exist" }, { "name": "BUILD_ARGS_FILE" }, { "name": "ADD_CAPABILITIES" }, { "name": "SQUASH", "value": "false" }, { "name": "SKIP_UNUSED_STAGES", "value": "true" }, { "name": "PRIVILEGED_NESTED", "value": "false" }, { "name": "SKIP_SBOM_GENERATION", "value": "false" }, { "name": "SBOM_TYPE", "value": "spdx" }, { "name": "SBOM_SYFT_SELECT_CATALOGERS" }, { "name": "SBOM_SOURCE_SCAN_ENABLED", "value": "true" }, { "name": "ANNOTATIONS_FILE" }, { "name": "WORKINGDIR_MOUNT" }, { "name": "INHERIT_BASE_IMAGE_LABELS", "value": "true" }, { "name": "BUILD_TIMESTAMP" }, { "name": "CONTEXTUALIZE_SBOM", "value": "true" }, { "name": "SBOM_SKIP_VALIDATION", "value": "true" }, { "name": "SKIP_INJECTIONS", "value": "false" }, { "name": "ALLOW_CROSS_PLATFORM_IMAGES", "value": "false" }, { "name": "RHSM_MOUNT_CA_CERTS", "value": "auto" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/shared", "name": "shared" } ] }, "steps": [ { "args": [ "--build-args", "--envs", "--labels", "--annotations" ], "computeResources": { "limits": { "cpu": "4600m", "memory": "8Gi" }, "requests": { "cpu": "4600m", "memory": "8Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "COMMIT_SHA", "value": "1170f583db17b9db20e993f89d6907dab9acc06f" }, { "name": "SOURCE_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "BUILDAH_HTTP_PROXY" }, { "name": "BUILDAH_NO_PROXY" }, { "name": "ICM_KEEP_COMPAT_LOCATION", "value": "true" }, { "name": "BUILDAH_OMIT_HISTORY", "value": "false" }, { "name": "BUILDAH_SOURCE_DATE_EPOCH" }, { "name": "BUILDAH_REWRITE_TIMESTAMP", "value": "false" } ], "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "build", "script": "#!/bin/bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nproxy_ca_bundle=/mnt/proxy-ca-bundle/ca-bundle.crt\nupdate_ca_trust=false\n\nif [ -f \"$ca_bundle\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ -f \"$proxy_ca_bundle\" ] \u0026\u0026 [ -n \"${BUILDAH_HTTP_PROXY}\" ]; then\n echo \"[$(date --utc -Ins)] Using mounted proxy CA bundle: $proxy_ca_bundle\"\n cp -vf $proxy_ca_bundle /etc/pki/ca-trust/source/anchors/proxy-ca-bundle.crt\n update_ca_trust=true\nfi\n\nif [ \"$update_ca_trust\" = \"true\" ]; then\n echo \"[$(date --utc -Ins)] Update CA trust\"\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Prepare system (architecture: $(uname -m))\"\n\n# Fixing group permission on /var/lib/containers\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\n# Delete policy settings for Red Hat registries to disable signature verification.\n# TODO: don't do this?\ncontainer_policy=$(\n jq '.transports |= (\n del(.docker.[\"registry.access.redhat.com\"]) |\n del(.docker.[\"registry.redhat.io\"]) |\n if (.docker == {}) then del(.docker) else . end\n )' /etc/containers/policy.json\n)\necho \"Effective container policy:\"\nprintf '%s\\n' \"$container_policy\" | tee /etc/containers/policy.json\n\n# Setting new namespace to run buildah - 2^32-2\necho 'root:1:4294967294' | tee -a /etc/subuid \u003e\u003e /etc/subgid\n\necho \"[$(date --utc -Ins)] Run the build\"\n\nif [ -e \"$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$CONTEXT/$DOCKERFILE\"\nelif [ -e \"$SOURCE_CODE_DIR/$DOCKERFILE\" ]; then\n dockerfile_path=\"$(pwd)/$SOURCE_CODE_DIR/$DOCKERFILE\"\nelse\n echo \"Cannot find Dockerfile $DOCKERFILE\"\n exit 1\nfi\n\nif [ -n \"${ANNOTATIONS_FILE}\" ] \u0026\u0026 [ -f \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\" ]; then\n ANNOTATIONS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${ANNOTATIONS_FILE}\")\nfi\n\nif [ -n \"${BUILD_ARGS_FILE}\" ]; then\n BUILD_ARGS_FILE=$(realpath \"${SOURCE_CODE_DIR}/${BUILD_ARGS_FILE}\")\nfi\n\n# Necessary for newer version of buildah if the host system does not contain up to date version of container-selinux\n# TODO remove the option once all hosts were updated\nsecurity_args=(--security-opts unmask=/proc/interrupts)\n\nif [ \"${PRIVILEGED_NESTED}\" == \"true\" ]; then\n security_args+=(--security-opts label=disable)\n security_args+=(--cap-add all)\n security_args+=(--devices /dev/fuse)\nfi\nif [ -n \"${ADD_CAPABILITIES}\" ]; then\n security_args+=(--cap-add \"${ADD_CAPABILITIES}\")\nfi\n\nif [ -f \"/workspace/source/cachi2/cachi2.env\" ]; then\n prefetch_dir=\"/workspace/source/cachi2\"\n # KBC defaults to ${prefetch_dir}/copy-*\n # Copy to a sibling dir instead in case we don't have write permissions to the prefetch_dir.\n # It's still on the same filesystem, so copying via reflinks should be possible.\n prefetch_dir_copy=\"/workspace/source/prefetch-copy\"\nelse\n prefetch_dir=\"\"\n prefetch_dir_copy=\"\"\nfi\n\nyum_repos_d_sources=()\nif [ -d \"${YUM_REPOS_D_FETCHED}\" ]; then\n yum_repos_d_sources+=(\"${YUM_REPOS_D_FETCHED}\")\nfi\nif [ -d \"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\" ]; then\n yum_repos_d_sources+=(\"${SOURCE_CODE_DIR}/${YUM_REPOS_D_SRC}\")\nfi\n\n# 0. if hermetic=true, skip all subscription related stuff\n# 1. do not enable activation key and entitlement at same time. If both are provided, prefer activation key.\n# 2. Activation-keys will be used when the key 'org' exists in the activation key secret.\n# 3. try to pre-register and mount files to the correct location so that users do no need to modify Dockerfiles.\n# 4. If the Dockerfile contains the string \"subcription-manager register\", add the activation-keys volume\n# to buildah but don't pre-register for backwards compatibility. Mount an empty directory on\n# to \"/etc/pki/entitlement\" to prevent certificates from being included\nrhsm_args=()\nif [ \"${HERMETIC}\" != \"true\" ]; then\n if [ -e /activation-key/org ]; then\n rhsm_args+=(--rhsm-activation-key=/activation-key/activationkey\n --rhsm-org=/activation-key/org\n --rhsm-activation-mount=/activation-key)\n\n if ! grep -E \"^[^#]*subscription-manager.[^#]*register\" \"$dockerfile_path\"; then\n # user is not running registration in the Containerfile: pre-register.\n rhsm_args+=(--rhsm-activation-preregister)\n fi\n elif find /entitlement -name \"*.pem\" \u003e /dev/null; then\n rhsm_args+=(--rhsm-entitlements=/entitlement)\n fi\nfi\nif [ \"${RHSM_MOUNT_CA_CERTS}\" != \"auto\" ]; then\n rhsm_args+=(--rhsm-mount-ca-certs=\"$RHSM_MOUNT_CA_CERTS\")\nfi\n\n# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.\ndeclare IMAGE\n\ncmd=(\n konflux-build-cli image build\n -f \"$dockerfile_path\" -t \"$IMAGE\" --source \"$SOURCE_CODE_DIR\" --context \"$CONTEXT\"\n --secret-dirs \"src=/additional-secret,name=$ADDITIONAL_SECRET,optional=true\"\n --workdir-mount \"$WORKINGDIR_MOUNT\"\n --target \"$TARGET_STAGE\"\n --inherit-labels=\"$INHERIT_BASE_IMAGE_LABELS\"\n --source-date-epoch \"$BUILDAH_SOURCE_DATE_EPOCH\"\n --rewrite-timestamp=\"$BUILDAH_REWRITE_TIMESTAMP\"\n --squash=\"$SQUASH\"\n --omit-history=\"$BUILDAH_OMIT_HISTORY\"\n --image-source \"$SOURCE_URL\"\n --image-revision \"$COMMIT_SHA\"\n --quay-image-expires-after \"$IMAGE_EXPIRES_AFTER\"\n --build-args-file \"$BUILD_ARGS_FILE\"\n --annotations-file \"$ANNOTATIONS_FILE\"\n --legacy-build-timestamp \"$BUILD_TIMESTAMP\"\n --add-legacy-labels\n --include-legacy-buildinfo-path=\"$ICM_KEEP_COMPAT_LOCATION\"\n --skip-injections=\"$SKIP_INJECTIONS\"\n --skip-unused-stages=\"$SKIP_UNUSED_STAGES\"\n --hermetic=\"$HERMETIC\"\n --image-pull-proxy \"$BUILDAH_HTTP_PROXY\"\n --image-pull-noproxy \"$BUILDAH_NO_PROXY\"\n --yum-repos-d-sources \"${yum_repos_d_sources[@]}\"\n --yum-repos-d-target \"$YUM_REPOS_D_TARGET\"\n --prefetch-dir \"$prefetch_dir\"\n --prefetch-dir-copy \"$prefetch_dir_copy\"\n --prefetch-env-mount /cachi2/cachi2.env\n --prefetch-output-mount /cachi2/output\n \"${security_args[@]}\"\n \"${rhsm_args[@]}\"\n --containerfile-json-output /shared/parsed_dockerfile.json\n --resolved-base-images-output /shared/base_images_digests\n --no-cache\n --ulimits nofile=4096:4096\n --src-tls-verify=\"$TLSVERIFY\"\n --dest-tls-verify=\"$TLSVERIFY\"\n --allow-cross-platform-images=\"$ALLOW_CROSS_PLATFORM_IMAGES\"\n \"$@\" # --annotations, --labels, --envs, --build-args\n)\n\necho \"[$(date --utc -Ins)] $(printf '%q ' \"${cmd[@]}\")\"\n\n\"${cmd[@]}\"\n\necho \"[$(date --utc -Ins)] Add metadata\"\n\n# Save the SBOM produced in prefetch so it can be merged into the final SBOM later\nif [ -f \"${prefetch_dir}/output/bom.json\" ]; then\n echo \"Making copy of sbom-prefetch.json\"\n cp \"${prefetch_dir}/output/bom.json\" ./sbom-prefetch.json\nfi\n\nimage_name=$(echo \"${IMAGE##*/}\" | tr ':' '-')\nbuildah push \"$IMAGE\" oci:\"/shared/$image_name.oci:$IMAGE\"\necho \"/shared/$image_name.oci\" \u003e /shared/container_path\n\necho \"[$(date --utc -Ins)] End build\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/entitlement", "name": "etc-pki-entitlement" }, { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/additional-secret", "name": "additional-secret" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/proxy-ca-bundle", "name": "proxy-ca-bundle", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "600m", "memory": "4Gi" }, "requests": { "cpu": "600m", "memory": "4Gi" } }, "env": [ { "name": "HOME", "value": "/root" }, { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "TASKRUN_NAME", "value": "buildah-demo-ozufxbwwvs-build-container" } ], "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "push", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\necho \"[$(date --utc -Ins)] Convert image\"\n\n# While we can build images with the desired format, we will simplify any local\n# and remote build differences by just performing any necessary conversions at\n# push time.\npush_format=oci\nif [ \"${BUILDAH_FORMAT}\" == \"docker\" ]; then\n push_format=docker\nfi\n\necho \"[$(date --utc -Ins)] Push image with unique tag\"\n\nbuildah_retries=3\n\n# Push to a unique tag based on the TaskRun name to avoid race conditions\necho \"Pushing to ${IMAGE%:*}:${TASKRUN_NAME}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n \"$IMAGE\" \\\n \"docker://${IMAGE%:*}:${TASKRUN_NAME}\"\nthen\n echo \"Failed to push image to ${IMAGE%:*}:${TASKRUN_NAME}\"\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] Push image with git revision\"\n\n# Push to a tag based on the git revision\necho \"Pushing to ${IMAGE}\"\nif ! retry buildah push \\\n --format=\"$push_format\" \\\n --retry \"$buildah_retries\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --digestfile \"/workspace/source/image-digest\" \"$IMAGE\" \\\n \"docker://$IMAGE\"\nthen\n echo \"Failed to push image to $IMAGE\"\n exit 1\nfi\n\ntee \"/tekton/results/IMAGE_DIGEST\" \u003c \"/workspace/source\"/image-digest\necho -n \"$IMAGE\" | tee \"/tekton/results/IMAGE_URL\"\n{\n echo -n \"${IMAGE}@\"\n cat \"/workspace/source/image-digest\"\n} \u003e \"/tekton/results/IMAGE_REF\"\necho\n\n# detect if keyless signing is required\nSIGNING_CONFIG='{}'\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\nif ! RETRY_STOP_IF_STDERR_MATCHES='configmaps \"cluster-config\" not found' retry kubectl get configmap cluster-config -n konflux-info -o json \u003e\"${KFLX_CONFIG_PATH}\"\nthen\n echo \"Failed to fetch konflux cluster-config, default values will be used\" \u003e\u00262\nelse\n SIGNING_CONFIG=\"$(cat ${KFLX_CONFIG_PATH})\"\nfi\n\n# configmap key -\u003e variable name mapping\ndeclare -A SIGNING_KEY_MAP=(\n [defaultOIDCIssuer]=SIGSTORE_OIDC_ISSUER\n [rekorInternalUrl]=REKOR_URL\n [fulcioInternalUrl]=SIGSTORE_FULCIO_URL\n [tufInternalUrl]=TUF_URL\n)\n\n# fallback keys when internal URL is not available\ndeclare -A SIGNING_FALLBACK_MAP=(\n [rekorInternalUrl]=rekorExternalUrl\n [fulcioInternalUrl]=fulcioExternalUrl\n [tufInternalUrl]=tufExternalUrl\n)\n\nmissing=\"\"\nconfigured=0\nfor key in \"${!SIGNING_KEY_MAP[@]}\"; do\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${key} // empty\")\n if [ -z \"${val}\" ] \u0026\u0026 [ -n \"${SIGNING_FALLBACK_MAP[$key]+x}\" ]; then\n fallback_key=\"${SIGNING_FALLBACK_MAP[$key]}\"\n val=$(echo \"${SIGNING_CONFIG}\" | jq -r \".data.${fallback_key} // empty\")\n if [ -n \"${val}\" ]; then\n echo \"Using fallback ${fallback_key} instead of ${key}\"\n fi\n fi\n if [ -z \"${val}\" ]; then\n missing=\"${missing:+${missing}, }${key}\"\n else\n declare \"${SIGNING_KEY_MAP[$key]}=${val}\"\n configured=$((configured + 1))\n fi\ndone\n\nif [ \"${configured}\" -eq \"${#SIGNING_KEY_MAP[@]}\" ]; then\n echo \"Keyless signing is enabled\"\n\n # Save signing config for upload-sbom step\n for key in \"${!SIGNING_KEY_MAP[@]}\"; do\n envvar=\"${SIGNING_KEY_MAP[$key]}\"\n printf '%s=%q\\n' \"${envvar}\" \"${!envvar}\"\n done \u003e /shared/signing-config.env\n\n echo \"Using Rekor URL: ${REKOR_URL}\"\n echo \"Using Fulcio URL: ${SIGSTORE_FULCIO_URL}\"\n echo \"Using OIDC issuer: ${SIGSTORE_OIDC_ISSUER}\"\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${IMAGE_REF}\" \u003e /tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n echo \"[$(date --utc -Ins)] Sign image\"\n echo \"Signing image ${IMAGE_REF} using keyless signing\"\n if ! retry cosign sign -y \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign image\" \u003e\u00262\n exit 1\n fi\nelif [ \"${configured}\" -eq 0 ]; then\n echo \"Keyless signing is disabled (none of ${missing} are configured in the konflux-info/cluster-config configmap)\"\nelse\n echo \"ERROR: Incomplete keyless signing configuration in konflux-info/cluster-config configmap. Missing: ${missing}\" \u003e\u00262\n exit 1\nfi\n\necho \"[$(date --utc -Ins)] End push\"\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "1100m", "memory": "4Gi" }, "requests": { "cpu": "1100m", "memory": "4Gi" } }, "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "sbom-syft-generate", "script": "#!/bin/bash\nset -euo pipefail\necho \"[$(date --utc -Ins)] Generate SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\ncase $SBOM_TYPE in\n cyclonedx)\n syft_sbom_type=cyclonedx-json@1.5 ;;\n spdx)\n syft_sbom_type=spdx-json@2.3 ;;\n *)\n echo \"Invalid SBOM type: $SBOM_TYPE. Valid: cyclonedx, spdx\" \u003e\u00262\n exit 1\n ;;\nesac\n\nOCI_DIR=\"$(cat /shared/container_path)\"\n\nsyft_oci_args=(\n oci-dir:\"${OCI_DIR}\"\n --output \"$syft_sbom_type=/workspace/source/sbom-image.json\"\n)\nsyft_source_args=(\n dir:\"/workspace/source/$SOURCE_CODE_DIR/$CONTEXT\"\n --output \"$syft_sbom_type=/workspace/source/sbom-source.json\"\n)\n\nif [ \"${SBOM_SYFT_SELECT_CATALOGERS}\" != \"\" ]; then\n syft_oci_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\n syft_source_args+=(--select-catalogers \"${SBOM_SYFT_SELECT_CATALOGERS}\")\nfi\n\necho \"Running syft on the image\"\nsyft \"${syft_oci_args[@]}\"\nif [[ \"${HERMETIC}\" == \"false\" \u0026\u0026 \"${SBOM_SOURCE_SCAN_ENABLED}\" == \"true\" ]]; then\n echo \"Running syft on the source code\"\n syft \"${syft_source_args[@]}\"\nelse\n echo \"Skipping syft on source code.\"\nfi\n\necho \"[$(date --utc -Ins)] End sbom-syft-generate\"\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/var/lib/containers", "name": "varlibcontainers" }, { "mountPath": "/shared", "name": "shared" }, { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ], "workingDir": "/workspace/source/source" }, { "args": [ "--additional-base-images" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15", "name": "prepare-sboms", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Prepare SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\n# Convert Tekton array params into Mobster params\nADDITIONAL_BASE_IMAGES=()\nwhile [[ $# -gt 0 ]]; do\n case $1 in\n --additional-base-images)\n shift\n while [[ $# -gt 0 \u0026\u0026 $1 != --* ]]; do ADDITIONAL_BASE_IMAGES+=(\"$1\"); shift; done\n ;;\n *)\n echo \"unexpected argument: $1\" \u003e\u00262\n exit 2\n ;;\n esac\ndone\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\n\necho \"[$(date --utc -Ins)] Generate SBOM with mobster\"\n\nmobster_args=(\n generate\n --output sbom.json\n)\n\n# Validation is a flag for `generate`, not `oci-image`, so we need to\n# handle it before the oci-image arguments\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-image\n --from-syft \"/workspace/source/sbom-image.json\"\n --image-pullspec \"$IMAGE_URL\"\n --image-digest \"$IMAGE_DIGEST\"\n --parsed-dockerfile-path \"/shared/parsed_dockerfile.json\"\n --base-image-digest-file \"/shared/base_images_digests\"\n)\n\nif [ -f \"/workspace/source/sbom-source.json\" ]; then\n mobster_args+=(--from-syft \"/workspace/source/sbom-source.json\")\nfi\n\nif [ -f \"/workspace/source/sbom-prefetch.json\" ]; then\n mobster_args+=(--from-hermeto \"/workspace/source/sbom-prefetch.json\")\nfi\n\nif [ -n \"${TARGET_STAGE}\" ]; then\n mobster_args+=(--dockerfile-target \"${TARGET_STAGE}\")\nfi\n\nfor ADDITIONAL_BASE_IMAGE in \"${ADDITIONAL_BASE_IMAGES[@]}\"; do\n mobster_args+=(--additional-base-image \"$ADDITIONAL_BASE_IMAGE\")\ndone\n\nif [ \"${CONTEXTUALIZE_SBOM}\" == \"true\" ] \u0026\u0026 [ \"${HERMETIC}\" == \"false\" ]; then\n mobster_args+=(--contextualize)\nfi\n\nif [ -f \"/shared/prefetch-arch\" ]; then\n mobster_args+=(--arch \"$(cat /shared/prefetch-arch)\")\nfi\n\nmobster \"${mobster_args[@]}\"\n\necho \"[$(date --utc -Ins)] End prepare-sboms\"\n", "securityContext": { "runAsUser": 0 }, "workingDir": "/workspace/source" }, { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "upload-sbom", "script": "#!/bin/bash\nset -euo pipefail\n\necho \"[$(date --utc -Ins)] Upload SBOM\"\n\nif [ \"${SKIP_SBOM_GENERATION}\" = \"true\" ]; then\n echo \"Skipping SBOM generation\"\n exit 0\nfi\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom sbom.json --type \"$SBOM_TYPE\" \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum sbom.json | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n\nif [ -f \"/shared/signing-config.env\" ]; then\n # shellcheck source=/dev/null\n source /shared/signing-config.env\n\n echo \"Initializing TUF root from ${TUF_URL}\"\n if ! retry cosign initialize --root \"${TUF_URL}/root.json\" --mirror \"${TUF_URL}\"\n then\n echo \"Failed to initialize TUF root\" \u003e\u00262\n exit 1\n fi\n\n # env var consumed by cosign\n SIGSTORE_ID_TOKEN=\"$(cat /var/run/sigstore/cosign/oidc-token)\"\n export SIGSTORE_ID_TOKEN\n\n IMAGE_REF=\"$(cat \"/tekton/results/IMAGE_REF\")\"\n\n ATT_SBOM_TYPE=\"${SBOM_TYPE}\"\n if [ \"${ATT_SBOM_TYPE}\" = \"spdx\" ]; then\n # for format cossistency with cyclonedx format, we want to use spdxjson instad of spdx\n # spdx export data as rawstring, we want structured json as cyclonedx\n ATT_SBOM_TYPE=\"spdxjson\"\n fi\n\n echo \"[$(date --utc -Ins)] Sign SBOM\"\n echo \"Signing and attaching SBOM to ${IMAGE_REF} using keyless signing\"\n if ! retry cosign attest -y --type \"${ATT_SBOM_TYPE}\" --predicate sbom.json \\\n --rekor-url=\"${REKOR_URL}\" \\\n --fulcio-url=\"${SIGSTORE_FULCIO_URL}\" \\\n --oidc-issuer=\"${SIGSTORE_OIDC_ISSUER}\" \\\n \"${IMAGE_REF}\"\n then\n echo \"Failed to sign SBOM\" \u003e\u00262\n exit 1\n fi\nfi\n\necho\necho \"[$(date --utc -Ins)] End upload-sbom\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/var/run/sigstore/cosign", "name": "oidc-token", "readOnly": true } ], "workingDir": "/workspace/source" } ], "volumes": [ { "emptyDir": {}, "name": "varlibcontainers" }, { "emptyDir": {}, "name": "shared" }, { "name": "etc-pki-entitlement", "secret": { "optional": true, "secretName": "etc-pki-entitlement" } }, { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "name": "additional-secret", "secret": { "optional": true, "secretName": "does-not-exist" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "caching-ca-bundle", "optional": true }, "name": "proxy-ca-bundle" }, { "name": "oidc-token", "projected": { "sources": [ { "serviceAccountToken": { "audience": "sigstore", "expirationSeconds": 600, "path": "oidc-token" } } ] } } ], "workspaces": [ { "description": "Workspace containing the source code to build.", "name": "source" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/8ebb74d1-1bcb-4d28-a0d4-7680848c38e2", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-365b0b665cd49fb3-01\"}" }, "creationTimestamp": "2026-10-02T02:56:18Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3.1", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index" }, "name": "buildah-demo-ozufxbwwvs-build-image-index", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "42774", "uid": "8ebb74d1-1bcb-4d28-a0d4-7680848c38e2" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "build-image-index" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:57:00Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:57:00Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-build-image-index-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c" }, "entryPoint": "build-image-index", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" } ], "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-365b0b665cd49fb3-01" }, "startTime": "2026-10-02T02:56:18Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "build", "provenance": {}, "terminated": { "containerID": "cri-o://dddf0bc1f861e80864f7ece25ca05b9d2c1b7a44d975001413ec33adf012a95c", "exitCode": 0, "finishedAt": "2026-10-02T02:56:57Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:56:54Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:135eec87fe80d0751a1ea5e8e47b240147b25ee9a41973cae365540d2e2ee473", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://d116ea0e61197d14620c2105a1819fa8a42b878b62e788890d431fc1be42df3b", "exitCode": 0, "finishedAt": "2026-10-02T02:56:57Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:56:57Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "cri-o://f8ab80b6c88563047a381afbb9bb0e7ae92c4f3206d21f2eaf82e94e080c20b5", "exitCode": 0, "finishedAt": "2026-10-02T02:56:59Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:56:57Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" }, { "name": "SBOM_SKIP_VALIDATION", "value": "false" } ], "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" ], "computeResources": { "limits": { "memory": "4Gi" }, "requests": { "cpu": "250m", "memory": "4Gi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"buildah-demo-ozufxbwwvs-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/mobster:1.2.1-1782136886@sha256:1374bc35c71781987cce00ef5efe2be42923f83def19b60a570e947189b90d15", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "512Mi" }, "requests": { "cpu": "100m", "memory": "512Mi" } }, "image": "quay.io/konflux-ci/task-runner:2.0.0@sha256:4b01fbf98fa7155f5c21443c285f88853864ae7cc66981cf6b543fc6ba16b81b", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-6914d2d0cc", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/ebf15144-1a0b-409a-a22d-662183664a3d", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/categories": "Git", "tekton.dev/displayName": "git clone", "tekton.dev/pipelines.minVersion": "0.21.0", "tekton.dev/platforms": "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64", "tekton.dev/tags": "git", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-61213a8be55b4833-01\"}" }, "creationTimestamp": "2026-10-02T02:53:34Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.2.4", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "clone-repository", "tekton.dev/task": "git-clone" }, "name": "buildah-demo-ozufxbwwvs-clone-repository", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "40943", "uid": "ebf15144-1a0b-409a-a22d-662183664a3d" }, "spec": { "params": [ { "name": "url", "value": "https://github.com/conforma/golden-container.git" }, { "name": "revision", "value": "" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "git-clone" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-git-clone:0.2.4@sha256:bb787553da840e226ea72147a7ccbe8553f887efef2ca24664c9ba2052018adf" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "output", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:53:57Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:53:57Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-clone-repository-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "bb787553da840e226ea72147a7ccbe8553f887efef2ca24664c9ba2052018adf" }, "entryPoint": "git-clone", "uri": "quay.io/konflux-ci/tekton-catalog/task-git-clone" } }, "results": [ { "name": "CHAINS-GIT_COMMIT", "type": "string", "value": "1170f583db17b9db20e993f89d6907dab9acc06f" }, { "name": "CHAINS-GIT_URL", "type": "string", "value": "https://github.com/conforma/golden-container.git" }, { "name": "commit", "type": "string", "value": "1170f583db17b9db20e993f89d6907dab9acc06f" }, { "name": "commit-timestamp", "type": "string", "value": "1743528558" }, { "name": "short-commit", "type": "string", "value": "1170f58" }, { "name": "url", "type": "string", "value": "https://github.com/conforma/golden-container.git" } ], "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-61213a8be55b4833-01" }, "startTime": "2026-10-02T02:53:34Z", "steps": [ { "container": "step-clone", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:9182d2fc89ba8b0352ed81526fe0b84abb4a9f405b75db7afc0e8790136801dc", "name": "clone", "provenance": {}, "terminated": { "containerID": "cri-o://5a361f7a77a7d037945cd4c2767a9c75dd835702aa509ff4c42164e356a2b88f", "exitCode": 0, "finishedAt": "2026-10-02T02:53:57Z", "message": "[{\"key\":\"CHAINS-GIT_COMMIT\",\"value\":\"1170f583db17b9db20e993f89d6907dab9acc06f\",\"type\":1},{\"key\":\"CHAINS-GIT_URL\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1},{\"key\":\"commit\",\"value\":\"1170f583db17b9db20e993f89d6907dab9acc06f\",\"type\":1},{\"key\":\"commit-timestamp\",\"value\":\"1743528558\",\"type\":1},{\"key\":\"short-commit\",\"value\":\"1170f58\",\"type\":1},{\"key\":\"url\",\"value\":\"https://github.com/conforma/golden-container.git\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:53:54Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "The git-clone Task will clone a repo from the provided url into the output Workspace. By default the repo will be cloned into the root of your Workspace.", "params": [ { "description": "Repository URL to clone from.", "name": "url", "type": "string" }, { "default": "", "description": "Revision to checkout. (branch, tag, sha, ref, etc...)", "name": "revision", "type": "string" }, { "default": "", "description": "Refspec to fetch before checking out revision.", "name": "refspec", "type": "string" }, { "default": "true", "description": "Initialize and fetch git submodules.", "name": "submodules", "type": "string" }, { "default": "", "description": "Comma-separated list of specific submodule paths to initialize and fetch. Only submodules in the specified directories and their subdirectories will be fetched. Empty string fetches all submodules. Parameter \"submodules\" must be set to \"true\" to make this parameter applicable.", "name": "submodulePaths", "type": "string" }, { "default": "1", "description": "Perform a shallow clone, fetching only the most recent N commits.", "name": "depth", "type": "string" }, { "default": "7", "description": "Minimum length of the short commit SHA. Git may return a longer prefix if needed for uniqueness.", "name": "shortCommitLength", "type": "string" }, { "default": "true", "description": "Set the `http.sslVerify` global git config. Setting this to `false` is not advised unless you are sure that you trust your git remote.", "name": "sslVerify", "type": "string" }, { "default": "source", "description": "Subdirectory inside the `output` Workspace to clone the repo into.", "name": "subdirectory", "type": "string" }, { "default": "", "description": "Define the directory patterns to match or exclude when performing a sparse checkout.", "name": "sparseCheckoutDirectories", "type": "string" }, { "default": "true", "description": "Clean out the contents of the destination directory if it already exists before cloning.", "name": "deleteExisting", "type": "string" }, { "default": "", "description": "HTTP proxy server for non-SSL requests.", "name": "httpProxy", "type": "string" }, { "default": "", "description": "HTTPS proxy server for SSL requests.", "name": "httpsProxy", "type": "string" }, { "default": "info", "description": "Log level for the git-clone command.", "name": "logLevel", "type": "string" }, { "default": "", "description": "Opt out of proxying HTTP/HTTPS requests.", "name": "noProxy", "type": "string" }, { "default": "true", "description": "Check symlinks in the repo. If they're pointing outside of the repo, the build will fail.\n", "name": "enableSymlinkCheck", "type": "string" }, { "default": "", "description": "CSV list of path patterns to exclude from the symlink check. Symlinks whose paths match\nare not checked. Patterns are relative to the checkout directory and must not start with '/'.\nUse '*' and '?' as wildcards ('*' matches across '/').\nQuote patterns containing commas using CSV double quotes.\n", "name": "symlinkCheckIgnorePattern", "type": "string" }, { "default": "false", "description": "Fetch all tags for the repo.", "name": "fetchTags", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "false", "description": "Set to \"true\" to merge the targetBranch into the checked-out revision.", "name": "mergeTargetBranch", "type": "string" }, { "default": "main", "description": "The target branch to merge into the revision (if mergeTargetBranch is true).", "name": "targetBranch", "type": "string" }, { "default": "", "description": "URL of the repository to fetch the target branch from when mergeTargetBranch is true.\nIf empty, uses the same repository (origin). This allows merging a branch from a different repository.\n", "name": "mergeSourceRepoUrl", "type": "string" }, { "default": "", "description": "Perform a shallow fetch of the target branch, fetching only the most recent N commits.\nIf empty, fetches the full history of the target branch.\n", "name": "mergeSourceDepth", "type": "string" } ], "results": [ { "description": "The precise commit SHA that was fetched by this Task.", "name": "commit", "type": "string" }, { "description": "Abbreviated commit SHA for the checkout. At least params.shortCommitLength characters; longer if Git requires more for uniqueness.", "name": "short-commit", "type": "string" }, { "description": "The precise URL that was fetched by this Task.", "name": "url", "type": "string" }, { "description": "The commit timestamp of the checkout", "name": "commit-timestamp", "type": "string" }, { "description": "The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_URL", "type": "string" }, { "description": "The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.", "name": "CHAINS-GIT_COMMIT", "type": "string" }, { "description": "The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).", "name": "merged_sha", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "350m", "memory": "2Gi" } }, "env": [ { "name": "KBC_GIT_CLONE_URL", "value": "https://github.com/conforma/golden-container.git" }, { "name": "KBC_GIT_CLONE_REVISION" }, { "name": "KBC_GIT_CLONE_REFSPEC" }, { "name": "KBC_GIT_CLONE_SUBMODULES", "value": "true" }, { "name": "KBC_GIT_CLONE_SUBMODULE_PATHS" }, { "name": "KBC_GIT_CLONE_DEPTH", "value": "1" }, { "name": "KBC_GIT_CLONE_SHORT_COMMIT_LENGTH", "value": "7" }, { "name": "KBC_GIT_CLONE_SSL_VERIFY", "value": "true" }, { "name": "KBC_GIT_CLONE_SUBDIRECTORY", "value": "source" }, { "name": "KBC_GIT_CLONE_SPARSE_CHECKOUT_DIRECTORIES" }, { "name": "KBC_GIT_CLONE_DELETE_EXISTING", "value": "true" }, { "name": "KBC_GIT_CLONE_ENABLE_SYMLINK_CHECK", "value": "true" }, { "name": "KBC_GIT_CLONE_SYMLINK_CHECK_IGNORE_PATTERN" }, { "name": "KBC_GIT_CLONE_FETCH_TAGS", "value": "false" }, { "name": "KBC_GIT_CLONE_MERGE_TARGET_BRANCH", "value": "false" }, { "name": "KBC_GIT_CLONE_TARGET_BRANCH", "value": "main" }, { "name": "KBC_GIT_CLONE_MERGE_SOURCE_REPO_URL" }, { "name": "KBC_GIT_CLONE_MERGE_SOURCE_DEPTH" }, { "name": "KBC_GIT_CLONE_OUTPUT_DIR", "value": "/workspace/output" }, { "name": "KBC_GIT_CLONE_BASIC_AUTH_DIRECTORY" }, { "name": "KBC_GIT_CLONE_SSH_DIRECTORY" }, { "name": "PARAM_HTTP_PROXY" }, { "name": "PARAM_HTTPS_PROXY" }, { "name": "PARAM_NO_PROXY" }, { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:fddbb4c2edb01a3f0065321f84cf2e4d8e483b4149e3d6f78dd0c46e85e35aef", "name": "clone", "script": "#!/usr/bin/env bash\nset -euo pipefail\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf \"$ca_bundle\" /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\ntest -z \"${PARAM_HTTP_PROXY}\" || export HTTP_PROXY=\"${PARAM_HTTP_PROXY}\"\ntest -z \"${PARAM_HTTPS_PROXY}\" || export HTTPS_PROXY=\"${PARAM_HTTPS_PROXY}\"\ntest -z \"${PARAM_NO_PROXY}\" || export NO_PROXY=\"${PARAM_NO_PROXY}\"\n\nRESULT_FILE=\"$(mktemp)\"\nkonflux-build-cli git-clone \u003e \"${RESULT_FILE}\"\n\nprintf \"%s\" \"$(jq -r '.commit' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/commit\"\nprintf \"%s\" \"$(jq -r '.shortCommit' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/short-commit\"\nprintf \"%s\" \"$(jq -r '.url' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/url\"\nprintf \"%s\" \"$(jq -r '.commitTimestamp' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/commit-timestamp\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_URL\"' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/CHAINS-GIT_URL\"\nprintf \"%s\" \"$(jq -r '.\"CHAINS-GIT_COMMIT\"' \"${RESULT_FILE}\")\" \u003e \"/tekton/results/CHAINS-GIT_COMMIT\"\n\nMERGED_SHA=$(jq -r '.mergedSha // empty' \"${RESULT_FILE}\")\nif [ -n \"${MERGED_SHA}\" ]; then\n printf \"%s\" \"${MERGED_SHA}\" \u003e \"/tekton/results/merged_sha\"\nfi\n", "securityContext": { "runAsUser": 0 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The git repo will be cloned onto the volume backing this Workspace.", "name": "output" }, { "description": "A .ssh directory with private key, known_hosts, config, etc. Copied to\nthe user's home before git commands are executed. Used to authenticate\nwith the git remote when performing the clone. Binding a Secret to this\nWorkspace is strongly recommended over other volume types.\n", "name": "ssh-directory", "optional": true }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before any git commands are run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto use ssh-directory over basic-auth whenever possible and to bind a\nSecret to this Workspace over other volume types.\n", "name": "basic-auth", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/87487188-1723-4a2b-a5c8-cc125dd43daf", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-1a493f593e740e0d-01\"}" }, "creationTimestamp": "2026-10-02T02:53:19Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.4.2", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "init", "tekton.dev/task": "init" }, "name": "buildah-demo-ozufxbwwvs-init", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "40670", "uid": "87487188-1723-4a2b-a5c8-cc125dd43daf" }, "spec": { "params": [ { "name": "enable-cache-proxy", "value": "false" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "init" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:53:33Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:53:33Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-init-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db" }, "entryPoint": "init", "uri": "quay.io/konflux-ci/tekton-catalog/task-init" } }, "results": [ { "name": "http-proxy", "type": "string", "value": "" }, { "name": "no-proxy", "type": "string", "value": "" } ], "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-1a493f593e740e0d-01" }, "startTime": "2026-10-02T02:53:19Z", "steps": [ { "container": "step-init", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:25fa4c4eeec8509c3486d24d3d215fc4c8280b1b0ca9cc8f4f7569f3a9523a25", "name": "init", "provenance": {}, "terminated": { "containerID": "cri-o://cb28cda5c45cd61c9c36dd59c0f46083d1e78fe4c26aac6d96ac6c4f794f8004", "exitCode": 0, "finishedAt": "2026-10-02T02:53:32Z", "message": "[{\"key\":\"http-proxy\",\"value\":\"\",\"type\":1},{\"key\":\"no-proxy\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:53:32Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Initialize Pipeline Task, enables configuration for cache-proxy if required during the PipelineRun.", "params": [ { "default": "false", "description": "Enable cache proxy configuration", "name": "enable-cache-proxy", "type": "string" } ], "results": [ { "description": "HTTP proxy URL for cache proxy (when enable-cache-proxy is true)", "name": "http-proxy", "type": "string" }, { "description": "NO_PROXY value for cache proxy (when enable-cache-proxy is true)", "name": "no-proxy", "type": "string" } ], "steps": [ { "args": [ "--enable", "false" ], "command": [ "konflux-build-cli", "config", "cache-proxy" ], "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" }, { "name": "DEFAULT_HTTP_PROXY", "value": "squid.caching.svc.cluster.local:3128" }, { "name": "DEFAULT_NO_PROXY", "value": "brew.registry.redhat.io,docker.io,gcr.io,ghcr.io,images.paas.redhat.com,mirror.gcr.io,nvcr.io,quay.io,registry-proxy.engineering.redhat.com,registry.access.redhat.com,registry.ci.openshift.org,registry.fedoraproject.org,registry.redhat.io,registry.stage.redhat.io,vault.habana.ai" }, { "name": "HTTP_PROXY_RESULTS_PATH", "value": "/tekton/results/http-proxy" }, { "name": "NO_PROXY_RESULTS_PATH", "value": "/tekton/results/no-proxy" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "init" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-6914d2d0cc", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/eca40f40-bc50-4231-8fcc-a907fa666327", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-630532f401bc1402-01\"}" }, "creationTimestamp": "2026-10-02T02:53:58Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.10.1", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "prefetch-dependencies", "tekton.dev/task": "prefetch-dependencies" }, "name": "buildah-demo-ozufxbwwvs-prefetch-dependencies", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "41102", "uid": "eca40f40-bc50-4231-8fcc-a907fa666327" }, "spec": { "params": [ { "name": "input", "value": "" }, { "name": "enable-package-registry-proxy", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "prefetch-dependencies" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies:0.10.1@sha256:f10302a7ecde2ac3bf266144db0ec5253ae2cb3cf768b0205df06b0f631396f3" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "source", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:54:11Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:54:11Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-prefetch-dependencies-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "f10302a7ecde2ac3bf266144db0ec5253ae2cb3cf768b0205df06b0f631396f3" }, "entryPoint": "prefetch-dependencies", "uri": "quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies" } }, "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-630532f401bc1402-01" }, "startTime": "2026-10-02T02:53:58Z", "steps": [ { "container": "step-prefetch-dependencies", "imageID": "quay.io/konflux-ci/hermeto@sha256:43596c6351cdf7188b09fd4dcf5c6b3bb8b57ea557e84a1aa624f60e74c624ce", "name": "prefetch-dependencies", "provenance": {}, "terminated": { "containerID": "cri-o://eeb8052f63bf024803cb3daf185b1e3a10c10187732c1d4d2d9de64e89f64f76", "exitCode": 0, "finishedAt": "2026-10-02T02:54:10Z", "reason": "Completed", "startedAt": "2026-10-02T02:54:10Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Task that prefetches project dependencies for hermetic build.", "params": [ { "description": "Configures project packages that will have their dependencies prefetched.", "name": "input", "type": "string" }, { "default": "debug", "description": "Set the logging level (debug, info, warn, error, fatal).", "name": "log-level", "type": "string" }, { "default": "", "description": "Pass configuration to the prefetch tool.\nNote this needs to be passed as a YAML-formatted config dump, not as a file path!\n", "name": "config-file-content", "type": "string" }, { "default": "spdx", "description": "Select the SBOM format to generate. Valid values: spdx, cyclonedx.", "name": "sbom-type", "type": "string" }, { "default": "strict", "description": "Control how input requirement violations are handled: strict (errors) or permissive (warnings).", "name": "mode", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "service-ca.crt", "description": "The name of the key in the ConfigMap that contains the service CA bundle data. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "openshift-service-ca.crt", "description": "The name of the ConfigMap to read service CA bundle data from. Used to verify TLS connections to in-cluster services such as the package registry proxy.", "name": "SERVICE_CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "true", "description": "Use the package registry proxy when prefetching dependencies", "name": "enable-package-registry-proxy", "type": "string" }, { "default": "", "description": "Python package index URL to use when prefetching pip dependencies. Used as a fallback when requirements.txt does not specify --index-url. When empty (default), the standard PyPI index is used.", "name": "pip-index-url", "type": "string" }, { "default": "activation-key", "description": "Name of secret which contains subscription activation key", "name": "ACTIVATION_KEY", "type": "string" } ], "stepTemplate": { "computeResources": {}, "imagePullPolicy": "IfNotPresent" }, "steps": [ { "computeResources": { "limits": { "cpu": "1", "memory": "3Gi" }, "requests": { "cpu": "1", "memory": "3Gi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "debug" }, { "name": "KBC_PD_INPUT" }, { "name": "KBC_PD_SOURCE_DIR", "value": "/workspace/source/source" }, { "name": "KBC_PD_OUTPUT_DIR", "value": "/workspace/source/cachi2/output" }, { "name": "KBC_PD_SBOM_FORMAT", "value": "spdx" }, { "name": "KBC_PD_MODE", "value": "strict" }, { "name": "KBC_PD_OUTPUT_DIR_MOUNT_POINT", "value": "/cachi2/output" }, { "name": "KBC_PD_ENV_FILES", "value": "/workspace/source/cachi2/cachi2.env /workspace/source/cachi2/prefetch.env /workspace/source/cachi2/prefetch-env.json" }, { "name": "KBC_PD_GIT_AUTH_DIRECTORY" }, { "name": "WORKSPACE_NETRC_PATH" }, { "name": "CONFIG_FILE_CONTENT" }, { "name": "KBC_PD_ENABLE_PACKAGE_REGISTRY_PROXY", "value": "true" }, { "name": "PIP_INDEX_URL" } ], "image": "quay.io/konflux-ci/hermeto:0.61.0@sha256:43596c6351cdf7188b09fd4dcf5c6b3bb8b57ea557e84a1aa624f60e74c624ce", "name": "prefetch-dependencies", "script": "#!/bin/bash\n\nif [ -n \"${WORKSPACE_NETRC_PATH}\" ]; then\n export NETRC=\"${WORKSPACE_NETRC_PATH}/.netrc\"\nfi\n\nCA_BUNDLE_PATH=/mnt/trusted-ca/ca-bundle.crt\nSERVICE_CA_BUNDLE_PATH=/mnt/service-ca/ca-bundle.crt\nUPDATE_CA_TRUST=false\n\nif [ -f \"$CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted CA bundle: $CA_BUNDLE_PATH\"\n cp -vf \"$CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/ca-bundle.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ -f \"$SERVICE_CA_BUNDLE_PATH\" ]; then\n echo \"Using mounted service CA bundle: $SERVICE_CA_BUNDLE_PATH\"\n cp -vf \"$SERVICE_CA_BUNDLE_PATH\" /etc/pki/ca-trust/source/anchors/service-ca.crt\n UPDATE_CA_TRUST=true\nfi\n\nif [ \"$UPDATE_CA_TRUST\" = \"true\" ]; then\n update-ca-trust\n # requests ignores the system CA store. Set REQUESTS_CA_BUNDLE explicitly.\n export REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\nfi\n\nif [ -e /activation-key/org ] \u0026\u0026 [ -e /activation-key/activationkey ]; then\n export KBC_PD_RHSM_ORG=/activation-key/org\n export KBC_PD_RHSM_ACTIVATION_KEY=/activation-key/activationkey\nfi\n\nif [ -n \"${CONFIG_FILE_CONTENT}\" ]; then\n echo \"${CONFIG_FILE_CONTENT}\" \u003e /mnt/config/config.yaml\n export KBC_PD_CONFIG_FILE=/mnt/config/config.yaml\nfi\n\nif [ -z \"${PIP_INDEX_URL}\" ]; then\n unset PIP_INDEX_URL\nfi\n\nkonflux-build-cli prefetch-dependencies\n", "volumeMounts": [ { "mountPath": "/activation-key", "name": "activation-key" }, { "mountPath": "/mnt/config", "name": "config" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true }, { "mountPath": "/mnt/service-ca", "name": "service-ca", "readOnly": true } ], "when": [ { "operator": "notin", "values": [ "" ] } ] } ], "volumes": [ { "name": "activation-key", "secret": { "optional": true, "secretName": "activation-key" } }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "configMap": { "items": [ { "key": "service-ca.crt", "path": "ca-bundle.crt" } ], "name": "openshift-service-ca.crt", "optional": true }, "name": "service-ca" }, { "emptyDir": {}, "name": "config" } ], "workspaces": [ { "description": "Workspace with the source code, prefetch artifacts will be stored on the workspace as well", "name": "source" }, { "description": "A Workspace containing a .gitconfig and .git-credentials file or username and password.\nThese will be copied to the user's home before prefetch is run. Any\nother files in this Workspace are ignored. It is strongly recommended\nto bind a Secret to this Workspace over other volume types.\n", "name": "git-basic-auth", "optional": true }, { "description": "Workspace containing a .netrc file. Prefetch will use the credentials in this file when\nperforming http(s) requests.\n", "name": "netrc", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/affinity-assistant": "affinity-assistant-6914d2d0cc", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa/records/ac6d3898-cb11-4007-8269-e62786cd28a2", "results.tekton.dev/result": "chains-e2e-kscf/results/293215b4-2e52-4f8b-94c9-152ca6929baa", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, appstudio", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-149f2513523d085f0e89b518c82be667-d7cd00451cbf0894-01\"}" }, "creationTimestamp": "2026-10-02T02:57:00Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.3.1", "build.appstudio.redhat.com/build_type": "docker", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "pipelines.openshift.io/runtime": "generic", "pipelines.openshift.io/strategy": "docker", "pipelines.openshift.io/used-by": "build-cloud", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "docker-build", "tekton.dev/pipelineRun": "buildah-demo-ozufxbwwvs", "tekton.dev/pipelineRunUID": "293215b4-2e52-4f8b-94c9-152ca6929baa", "tekton.dev/pipelineTask": "push-dockerfile", "tekton.dev/task": "push-dockerfile" }, "name": "buildah-demo-ozufxbwwvs-push-dockerfile", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "buildah-demo-ozufxbwwvs", "uid": "293215b4-2e52-4f8b-94c9-152ca6929baa" } ], "resourceVersion": "42917", "uid": "ac6d3898-cb11-4007-8269-e62786cd28a2" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs" }, { "name": "IMAGE_DIGEST", "value": "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37" }, { "name": "DOCKERFILE", "value": "Containerfile" }, { "name": "CONTEXT", "value": "." } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "push-dockerfile" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile:0.3.1@sha256:0b11148d49d2fd94c9f148828d752ca526380fefcb88772127e683538ab5e248" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s", "workspaces": [ { "name": "workspace", "persistentVolumeClaim": { "claimName": "app-studio-default-workspace" } } ] }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:57:10Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:57:10Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "buildah-demo-ozufxbwwvs-push-dockerfile-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "0b11148d49d2fd94c9f148828d752ca526380fefcb88772127e683538ab5e248" }, "entryPoint": "push-dockerfile", "uri": "quay.io/konflux-ci/tekton-catalog/task-push-dockerfile" } }, "results": [ { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/test-images@sha256:bd1b2833be0aad742daafaafc2befe87e7a609920c0dd9c1b7728493c5095a6c" } ], "spanContext": { "traceparent": "00-149f2513523d085f0e89b518c82be667-d7cd00451cbf0894-01" }, "startTime": "2026-10-02T02:57:00Z", "steps": [ { "container": "step-push", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "push", "provenance": {}, "terminated": { "containerID": "cri-o://56111200acb5c387c6dee76a899d1d2ec19862ed4f9c5db7ed3730dd55d462a3", "exitCode": 0, "finishedAt": "2026-10-02T02:57:10Z", "message": "[{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/test-images@sha256:bd1b2833be0aad742daafaafc2befe87e7a609920c0dd9c1b7728493c5095a6c\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:09Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Discover Dockerfile from source code and push it to registry as an OCI artifact.", "params": [ { "description": "The built binary image. The Dockerfile is pushed to the same image repository alongside.", "name": "IMAGE", "type": "string" }, { "description": "The built binary image digest, which is used to construct the tag of Dockerfile image.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "./Dockerfile", "description": "Path to the Dockerfile.", "name": "DOCKERFILE", "type": "string" }, { "default": ".", "description": "Path to the directory to use as context.", "name": "CONTEXT", "type": "string" }, { "default": ".dockerfile", "description": "Suffix of the Dockerfile image tag.", "name": "TAG_SUFFIX", "type": "string" }, { "default": "application/vnd.konflux.dockerfile", "description": "Artifact type of the Dockerfile image.", "name": "ARTIFACT_TYPE", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "info", "description": "Log level to use in the task. See golang logrus docs for available levels.", "name": "LOG_LEVEL", "type": "string" } ], "results": [ { "description": "Digest-pinned image reference to the Dockerfile image.", "name": "IMAGE_REF", "type": "string" } ], "stepTemplate": { "computeResources": {}, "imagePullPolicy": "IfNotPresent", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, "steps": [ { "args": [ "--source", "source", "--context", ".", "--containerfile", "Containerfile", "--image-url", "quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs", "--image-digest", "sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37", "--artifact-type", "application/vnd.konflux.dockerfile", "--tag-suffix", ".dockerfile", "--result-path-image-ref", "/tekton/results/IMAGE_REF", "--alternative-filename", "Dockerfile" ], "command": [ "konflux-build-cli", "image", "push-containerfile" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "KBC_LOG_LEVEL", "value": "info" } ], "image": "quay.io/konflux-ci/konflux-build-cli@sha256:0415613f955ef8f7c6fc821a6738dcf062d9a3582441042b87a2391c375d7f54", "name": "push", "workingDir": "/workspace/workspace" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "Workspace containing the source code from where the Dockerfile is discovered.", "name": "workspace" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/e30bd93c-b617-4fd3-b0b7-2b5e24ada440/records/85a64fa2-385f-4b4f-987b-41922c5bc27e", "results.tekton.dev/result": "chains-e2e-kscf/results/e30bd93c-b617-4fd3-b0b7-2b5e24ada440", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-70f1a9f33f41ee270fd74630937c1d63-9d1659b13e4d9dc1-01\"}" }, "creationTimestamp": "2026-10-02T02:57:13Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-2czvc", "tekton.dev/pipelineRunUID": "e30bd93c-b617-4fd3-b0b7-2b5e24ada440", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-2czvc-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-2czvc", "uid": "e30bd93c-b617-4fd3-b0b7-2b5e24ada440" } ], "resourceVersion": "43306", "uid": "85a64fa2-385f-4b4f-987b-41922c5bc27e" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:57:36Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:57:36Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-e55e2a5ab1ae8d4e156b48d22d043e87-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909855\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" } ], "spanContext": { "traceparent": "00-70f1a9f33f41ee270fd74630937c1d63-9d1659b13e4d9dc1-01" }, "startTime": "2026-10-02T02:57:14Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://cd35523f05c03a4519c7d1dff57e89f550ba76c16f945876aef895b1d08d1479", "exitCode": 0, "finishedAt": "2026-10-02T02:57:28Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:28Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://ed3d8e2e648f318fdcd2434dbf4388684fdb899d3245ea1a18e607bfd2d2f750", "exitCode": 0, "finishedAt": "2026-10-02T02:57:28Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:28Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://c1c258cfc3f858f0c24da7a8e580984d1125b12c0ef09bfd63e775cfc49fdd05", "exitCode": 0, "finishedAt": "2026-10-02T02:57:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:28Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://052d07c053f544f70352e15d2d79b6acae48a9ee79d4d79a8fa4f58cae19b430", "exitCode": 0, "finishedAt": "2026-10-02T02:57:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:35Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://1138eabf5e10bd07b50165293b7658daa69f664333003f96e2f927c67cd757da", "exitCode": 0, "finishedAt": "2026-10-02T02:57:35Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:35Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://0c804998556515f70687da500c67f12d689a9bbcfbee86586420424d51ebc349", "exitCode": 0, "finishedAt": "2026-10-02T02:57:36Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:36Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://f34147ad4fe9dbf371a70727c560b08d08b9fe395a3a981a53fa34932015f5d3", "exitCode": 0, "finishedAt": "2026-10-02T02:57:36Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:36Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://2ff071c97b05ed5f6200b41b82982b19d21d686bccb27a398b1d4d6ec1002dfe", "exitCode": 0, "finishedAt": "2026-10-02T02:57:36Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:36Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://478231d223f5c035f28e24b1498db562dc813423e0425fe5a08a66b0523998fb", "exitCode": 0, "finishedAt": "2026-10-02T02:57:36Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909855\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:36Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/1c45e93c-e8b3-4e7c-a2ce-ef071af5e4fb/records/e356358d-8887-4c2f-879d-01416191cc1e", "results.tekton.dev/result": "chains-e2e-kscf/results/1c45e93c-e8b3-4e7c-a2ce-ef071af5e4fb", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-1322227b2f1c6e3528bb196cec16c5fc-9d0a684462c1f707-01\"}" }, "creationTimestamp": "2026-10-02T02:58:40Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-79fb9", "tekton.dev/pipelineRunUID": "1c45e93c-e8b3-4e7c-a2ce-ef071af5e4fb", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-79fb9-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-79fb9", "uid": "1c45e93c-e8b3-4e7c-a2ce-ef071af5e4fb" } ], "resourceVersion": "44649", "uid": "e356358d-8887-4c2f-879d-01416191cc1e" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keyjiukmdzcey" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:59:06Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:59:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-8ae8980657f67f1a7fb238538fc4b263-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909945\",\"namespace\":\"\",\"successes\":84,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" } ], "spanContext": { "traceparent": "00-1322227b2f1c6e3528bb196cec16c5fc-9d0a684462c1f707-01" }, "startTime": "2026-10-02T02:58:41Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://b4b9ed0e71154858fe5038dc47fc8198fce44d3c99127098e4ea4c1905bf5dc5", "exitCode": 0, "finishedAt": "2026-10-02T02:58:53Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:53Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://f6d4eec5ed309ccb60fd75b92b6d8cbae5607945a7190b80b21e84bdaf3e830c", "exitCode": 0, "finishedAt": "2026-10-02T02:58:53Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:53Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://aa236f603b387466e29d2f30ca5e6708478d041c4a5ad18ac639032d296e8d58", "exitCode": 0, "finishedAt": "2026-10-02T02:59:05Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:53Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://782aab9d669a9c5a949eaed19984d0244577f71f88c395a6b524e2f844cf37d8", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://09ae1b6e0ddb9f6d51f0b6c4effd543facfeb67d5560febfe0542b3c2a5318be", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://e48bbd88fbfacc0803baf113f144b3a204dd77ddd32a520cdcfc70337e7f23b0", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://2c9eb4a8399f6b7c014f3afb751282b25c1cf3d1ce1769d5b6a2d8633ab50e1b", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://affd344f454cb7358e2f38ad3fdb4ecedb264baf300261f781f059a0a8873d18", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://fbab8115863ac845e45a8767b323d68fbf6c5409442cca8dc1b37dfa3f0b92e1", "exitCode": 0, "finishedAt": "2026-10-02T02:59:06Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909945\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":84,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:06Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}},{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keyjiukmdzcey" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/8dc5b30f-06a1-487d-b0ba-0203b77991ec/records/568cb013-9fc7-4533-916f-4c88151ab978", "results.tekton.dev/result": "chains-e2e-kscf/results/8dc5b30f-06a1-487d-b0ba-0203b77991ec", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-b629a24f7f10b6c6b022bae0dfb9ce9f-5a59c475511a6950-01\"}" }, "creationTimestamp": "2026-10-02T02:59:48Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-9rt2r", "tekton.dev/pipelineRunUID": "8dc5b30f-06a1-487d-b0ba-0203b77991ec", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-9rt2r-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-9rt2r", "uid": "8dc5b30f-06a1-487d-b0ba-0203b77991ec" } ], "resourceVersion": "45525", "uid": "568cb013-9fc7-4533-916f-4c88151ab978" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/unpinned-task-bundle-public-keytmnzunvtli" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T03:00:04Z", "conditions": [ { "lastTransitionTime": "2026-10-02T03:00:04Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-1db4df0a6e5433cd29d4ad1b603fc0d8-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790910003\",\"namespace\":\"\",\"successes\":3,\"failures\":0,\"warnings\":16,\"result\":\"WARNING\"}\n" } ], "spanContext": { "traceparent": "00-b629a24f7f10b6c6b022bae0dfb9ce9f-5a59c475511a6950-01" }, "startTime": "2026-10-02T02:59:48Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://392c338a8b74d7456951f850aac941333373afdb54c95e9b4e78093e90a7f333", "exitCode": 0, "finishedAt": "2026-10-02T02:59:54Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:54Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://1cfa57989e8837e4dfc6f81ecb547c4a8b72f51888d6253b0f7d5e4d73fc61ed", "exitCode": 0, "finishedAt": "2026-10-02T02:59:54Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:54Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://b17ed52d6010e9e2438b30e2fe1b27cf6bc1bc457f9efd4d17077509bd5f03c7", "exitCode": 0, "finishedAt": "2026-10-02T03:00:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:54Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://19a3e300f51cb52820bdc985de0f56f17d5854b28559db9851cefb4dc425c859", "exitCode": 0, "finishedAt": "2026-10-02T03:00:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:03Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://88e737be5f635d75aa0a79bf474f07f03d16919f8454f29c440ecd95d27c8abe", "exitCode": 0, "finishedAt": "2026-10-02T03:00:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:03Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://c6330653ffb8f0835c74b00b7209f0ca9fc121f9bdf2c5d576f8db98c88910a8", "exitCode": 0, "finishedAt": "2026-10-02T03:00:03Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:03Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://23066ba191b831869c9bfd80ef258e302d9561960761ef71f16b3b6556f4e573", "exitCode": 0, "finishedAt": "2026-10-02T03:00:04Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:03Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://ac02b78553f98d8027de30acabe31ea6726bd3f38d2156d8b52244abbfc431ee", "exitCode": 0, "finishedAt": "2026-10-02T03:00:04Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:04Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://662bcfd1b4423a98c985e64c42cd412ac0f69ef0b32db5db540412d2472e4f53", "exitCode": 0, "finishedAt": "2026-10-02T03:00:04Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790910003\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":0,\\\"warnings\\\":16,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T03:00:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/enterprise-contract-tests:e2e-test-unpinned-task-bundle\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/unpinned-task-bundle-public-keytmnzunvtli" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/efcf8905-ab2b-4e84-a1fd-4952e0a37f42/records/049db871-c739-44d4-b8ed-7f660dfd58d2", "results.tekton.dev/result": "chains-e2e-kscf/results/efcf8905-ab2b-4e84-a1fd-4952e0a37f42", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-dbfd506500b5d2697ed6a371c753c58a-94a5876ede73a85a-01\"}" }, "creationTimestamp": "2026-10-02T02:59:33Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-js6jk", "tekton.dev/pipelineRunUID": "efcf8905-ab2b-4e84-a1fd-4952e0a37f42", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-js6jk-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-js6jk", "uid": "efcf8905-ab2b-4e84-a1fd-4952e0a37f42" } ], "resourceVersion": "45204", "uid": "049db871-c739-44d4-b8ed-7f660dfd58d2" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keycovrvweafm" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:59:47Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:59:47Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-9ae86b58b5fb7ba71435a7bb9635e09f-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909986\",\"namespace\":\"\",\"successes\":3,\"failures\":11,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-dbfd506500b5d2697ed6a371c753c58a-94a5876ede73a85a-01" }, "startTime": "2026-10-02T02:59:33Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://46c01894da24e6296c479c92a36a6614cb0ef69edbc0403d05beb7a047b48d16", "exitCode": 0, "finishedAt": "2026-10-02T02:59:38Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:38Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://7176b68990b23593ba7236df559faf2266fa5e28e4b5b16a9a418c606217ae77", "exitCode": 0, "finishedAt": "2026-10-02T02:59:38Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:38Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://cc3ef144b11f7136caa3992bd2694bdd96e2a06eeb2b1d37500198fd2d484405", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:38Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://899389f46d85722857dd9f3b70c2555b54b415ba53f14caae87d07949d577d1e", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:46Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://f8c3c20ed2c6ab4a2d11df48ac2393ec616434e5a8b68fb1dfe17d7f4662985b", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:46Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://22d4b114b11ce3ee5fe9b5d99fd15c5e0689f6d0b379e3bf29b20c36034982da", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:46Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://66aa07c5e45cb1211189ed5812f4a504a147258ce61ddfa858f4cae702382a2c", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:46Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://23b226d7aba16f2b8c3b2d46f4e711cb1f953015c6e5515c1266365a23c5d5a0", "exitCode": 0, "finishedAt": "2026-10-02T02:59:46Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:46Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://8d93a5aa92f0dbb71c2f0d78dc2057bb2927d4dd920b288fc0c755b11d732209", "exitCode": 1, "finishedAt": "2026-10-02T02:59:47Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909986\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":3,\\\"failures\\\":11,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-10-02T02:59:47Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:e2e-test-unacceptable-task\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keycovrvweafm" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/08eb875b-3cfb-41f6-9f78-8832b1ea7d4b/records/47d095c0-7502-42ea-961d-29e19089dba0", "results.tekton.dev/result": "chains-e2e-kscf/results/08eb875b-3cfb-41f6-9f78-8832b1ea7d4b", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-40fc110b0325812f37796c2f28d8db4a-b34946e0a8b2a582-01\"}" }, "creationTimestamp": "2026-10-02T02:58:13Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-kthf9", "tekton.dev/pipelineRunUID": "08eb875b-3cfb-41f6-9f78-8832b1ea7d4b", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-kthf9-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-kthf9", "uid": "08eb875b-3cfb-41f6-9f78-8832b1ea7d4b" } ], "resourceVersion": "44068", "uid": "47d095c0-7502-42ea-961d-29e19089dba0" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/dummy-public-key-hvgklogllz" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:58:24Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:58:24Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-edb94238f08140911099504c70f6f84b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909902\",\"namespace\":\"\",\"successes\":0,\"failures\":2,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-40fc110b0325812f37796c2f28d8db4a-b34946e0a8b2a582-01" }, "startTime": "2026-10-02T02:58:13Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://bf706e326915ba3bba1508f6454b1a3182524b2de3e50fdad63bc02f737d066a", "exitCode": 0, "finishedAt": "2026-10-02T02:58:18Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:18Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://9d906134aae0b43ed74b326c57f8fdc96695459ea5740cad9154fbd2b17e997a", "exitCode": 0, "finishedAt": "2026-10-02T02:58:18Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:18Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://9647f87e7727a566575142aa9a2d86493eb2fe5043e0792ca51ce8deeba17f43", "exitCode": 0, "finishedAt": "2026-10-02T02:58:22Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:18Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://3de52be0028b638d69bc8746431ada02678a4f45567f34a62e3c56f82bbd928b", "exitCode": 0, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://b50bf279ab7d7af6ce38841efec085e8f8a9e72dde1a64af646ed15320ba0a62", "exitCode": 0, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://d1322830d23ad3a5edafb2b4ff1550fddf28a6537e07cbb307c89edd5f6d5174", "exitCode": 0, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://d8351bda32aaf5c8c65a412488ed0f59363e1dc2a6e062d6f27508219e238cfc", "exitCode": 0, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://163a1dbc35a2b29819e871c672e6f73b407a67d6ad801ea84fef6c261f01aecb", "exitCode": 0, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://04b41323165a8e0aaf0b3ea13417e4da0af4852961a2f7b3fc353418590fc2bd", "exitCode": 1, "finishedAt": "2026-10-02T02:58:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909902\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":2,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-10-02T02:58:23Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/dummy-public-key-hvgklogllz" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/7b44062f-d5c9-475c-9dd5-7c047e82a073/records/105a9077-69c0-496a-8406-6ac41f23a886", "results.tekton.dev/result": "chains-e2e-kscf/results/7b44062f-d5c9-475c-9dd5-7c047e82a073", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-880097fe0daf286df464fea80240aa8a-dfe8a652f86de461-01\"}" }, "creationTimestamp": "2026-10-02T02:57:53Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-r6vp9", "tekton.dev/pipelineRunUID": "7b44062f-d5c9-475c-9dd5-7c047e82a073", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-r6vp9-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-r6vp9", "uid": "7b44062f-d5c9-475c-9dd5-7c047e82a073" } ], "resourceVersion": "43806", "uid": "105a9077-69c0-496a-8406-6ac41f23a886" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:58:12Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:58:12Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-90cbdc983eef30afd819642048f8a8fd-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909890\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-880097fe0daf286df464fea80240aa8a-dfe8a652f86de461-01" }, "startTime": "2026-10-02T02:57:53Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://1a27a30e609b357505cecec2c760ee51dccee9dd46e06ed524c72ebc90711820", "exitCode": 0, "finishedAt": "2026-10-02T02:57:59Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:59Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://7e1c58d320c470040d0e157b3eb57d42eded3bbae054c1da2c46305e4b20f6f9", "exitCode": 0, "finishedAt": "2026-10-02T02:57:59Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:59Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://d639a8084bbe634debd3e1a898e2ccf49bad869dce8d0daf31e5f44c2c4682b2", "exitCode": 0, "finishedAt": "2026-10-02T02:58:10Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:59Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://12d5cd38702c77339d7069616cb1b7431dd7ac16e7b843b9f936c785c61f3e40", "exitCode": 0, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://8c41f52295f015a02b0105d8467dc083cc44fec80bbe98437d2c0348b15e2bbb", "exitCode": 0, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://c0144b898b068c1ec463ffbab2de71cdcb8fb5b3b820458b2bda05b7b1bd4bb9", "exitCode": 0, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://1df972c8b0016df8dce3208136844bd9b5819e5a15a3dae0f2291d353da4820b", "exitCode": 0, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://b4c37aefd22e2587a5879ef1d185e24bbfa7add44552268deb2eebabadc988a2", "exitCode": 0, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://5fc5e5961638d8209f5c558d07a94cd945c482c16e7e999c3c2a55d35efbf0c3", "exitCode": 1, "finishedAt": "2026-10-02T02:58:11Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909890\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-10-02T02:58:11Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/00804cd9-6bd9-4334-b70f-295e1d283212/records/c1b51025-f653-4fe0-97d9-9d4a64b4593f", "results.tekton.dev/result": "chains-e2e-kscf/results/00804cd9-6bd9-4334-b70f-295e1d283212", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-8815dba10c8652450cc3f84594d4d1e6-d5eff9aac2f7ed09-01\"}" }, "creationTimestamp": "2026-10-02T02:57:38Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-s75g7", "tekton.dev/pipelineRunUID": "00804cd9-6bd9-4334-b70f-295e1d283212", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-s75g7-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-s75g7", "uid": "00804cd9-6bd9-4334-b70f-295e1d283212" } ], "resourceVersion": "43538", "uid": "c1b51025-f653-4fe0-97d9-9d4a64b4593f" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "false" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:57:51Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:57:51Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-8ebfbddc5b9e72cab170d3a1867c1660-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909870\",\"namespace\":\"\",\"successes\":5,\"failures\":1,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-8815dba10c8652450cc3f84594d4d1e6-d5eff9aac2f7ed09-01" }, "startTime": "2026-10-02T02:57:38Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://80f9950a65027e26ebf2baf01fe7120c3bdb8ea9ffa89a5724a7ed0ddd787ac8", "exitCode": 0, "finishedAt": "2026-10-02T02:57:42Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:42Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://10115e620dbb888a91d3e2a3c43ab37c5e753d1d7f9e0df80c0239c931e37ffa", "exitCode": 0, "finishedAt": "2026-10-02T02:57:43Z", "reason": "Completed", "startedAt": "2026-10-02T02:57:43Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://f1d257620f39483423e2da5c85ae46d30a2fbaeb8685665064ce78a7bc1f55fa", "exitCode": 0, "finishedAt": "2026-10-02T02:57:50Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:43Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://1d72b99cc794b77e6990b2cff1956cbc1ac7f181022ab7e6f9d62f6011b583c6", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://27e581a37364cf66786c98e7123ee7b13af8d482c346631c841be96c08e0f7f4", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://6094c831c3ec16b659880fda8881b93146f590586965a5257b0418764bbcbeb2", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://87d09b1b35ba6f181d4c0be8cbcc75d7affa0912c22a444a52aa6103b7ea54df", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://c2e63d2785dca24119d5fd7c50e8b5e0c2628cec677ce3166edcbd5e64dfb6fe", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://27bd0336a7c7a4529deecb253d41365b72a87690ab1fa3895cfc6809790916c4", "exitCode": 0, "finishedAt": "2026-10-02T02:57:51Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909870\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":5,\\\"failures\\\":1,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:57:51Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/redhat-appstudio-qe/test-images:buildah-demo-ozufxbwwvs@sha256:07a062b3183dcb3f99bd762a2c7514a6209a906ecbeb7bc874cb59a6ca2a3e37\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "false", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/e1a03dfb-b673-47a6-bfec-36e9e2d0232a/records/68a7c190-c40c-49cd-974c-b20e9a440dff", "results.tekton.dev/result": "chains-e2e-kscf/results/e1a03dfb-b673-47a6-bfec-36e9e2d0232a", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-db80a197185dba90c311da4febca7a84-b3ebc80b4d424580-01\"}" }, "creationTimestamp": "2026-10-02T02:59:08Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-sh8sp", "tekton.dev/pipelineRunUID": "e1a03dfb-b673-47a6-bfec-36e9e2d0232a", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-sh8sp-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-sh8sp", "uid": "e1a03dfb-b673-47a6-bfec-36e9e2d0232a" } ], "resourceVersion": "44964", "uid": "68a7c190-c40c-49cd-974c-b20e9a440dff" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keylpsxoyzzui" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:59:32Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:59:32Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-fe0cceb6f0109f6a7a4fc85da5a26bcb-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909970\",\"namespace\":\"\",\"successes\":447,\"failures\":0,\"warnings\":9,\"result\":\"WARNING\"}\n" } ], "spanContext": { "traceparent": "00-db80a197185dba90c311da4febca7a84-b3ebc80b4d424580-01" }, "startTime": "2026-10-02T02:59:08Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://bebea04b8505044a7438be2bb32b9bdaab70663d9264965318eb1749cfa56408", "exitCode": 0, "finishedAt": "2026-10-02T02:59:12Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:12Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://c8894653ae025f1b818fc61cd0e473b225e2e7945b878ede90ac37af696b4fff", "exitCode": 0, "finishedAt": "2026-10-02T02:59:12Z", "reason": "Completed", "startedAt": "2026-10-02T02:59:12Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://8fb55513f2dec667a166236e58cc4aaead12c3e1b64f5fc2ba6dd5138dff995e", "exitCode": 0, "finishedAt": "2026-10-02T02:59:30Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:12Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://c7c5942679b5a6e04b7559cdb3c351bc951fa725dfd6bb5ac0392cf19ae8db2c", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://ce632620ec7a49a88127a9355c626bf4a0e21f545348d094f308d718cf4b851d", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://f62251a0146aa1ddb37a207c1815ac1724d35376a1d437d35237c88051258a12", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://1c88eab5e08baff243a90eb764f26802541230a26151d2f8e4794fa2a760453d", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://75dfb0ca6f26ab201330c0ad25f17523dec49c4e37f4fdee9a47a4634230e6d2", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://f423d84d65f3a633c12b6c7b3e98d8cb5616a99e01912a44bd7d5f796a21614e", "exitCode": 0, "finishedAt": "2026-10-02T02:59:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909970\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":447,\\\"failures\\\":0,\\\"warnings\\\":9,\\\"result\\\":\\\"WARNING\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:59:31Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/golden-image-public-keylpsxoyzzui" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "kueue.konflux-ci.dev/requests-konflux-ci-dev-token": "1", "pipeline.tekton.dev/release": "7289f7d7e1ee24cbc84a58b9f763e3869db8ab2e", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "chains-e2e-kscf/results/e66a3449-d7a0-4e07-8f57-8faebb8e4ca7/records/f6c1c15e-0816-4695-8a54-b7ae376270a5", "results.tekton.dev/result": "chains-e2e-kscf/results/e66a3449-d7a0-4e07-8f57-8faebb8e4ca7", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Enterprise Contract", "tekton.dev/pipelines.minVersion": "0.19", "tekton.dev/tags": "ec, chains, signature, conftest", "tekton.dev/taskrunSpanContext": "{\"traceparent\":\"00-d58be5e8d62487681b22892b36fe063a-24e8bb0a9cc187af-01\"}" }, "creationTimestamp": "2026-10-02T02:58:25Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "", "kueue.x-k8s.io/priority-class": "konflux-default", "kueue.x-k8s.io/queue-name": "pipelines-queue", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "verify-enterprise-contract-run", "tekton.dev/pipelineRun": "verify-enterprise-contract-run-t9ntj", "tekton.dev/pipelineRunUID": "e66a3449-d7a0-4e07-8f57-8faebb8e4ca7", "tekton.dev/pipelineTask": "verify-enterprise-contract", "tekton.dev/task": "verify-enterprise-contract" }, "name": "verify-enterprise-contract-run-t9ntj-verify-enterprise-contract", "namespace": "chains-e2e-kscf", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "verify-enterprise-contract-run-t9ntj", "uid": "e66a3449-d7a0-4e07-8f57-8faebb8e4ca7" } ], "resourceVersion": "44306", "uid": "f6c1c15e-0816-4695-8a54-b7ae376270a5" }, "spec": { "params": [ { "name": "IMAGES", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "STRICT", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "IGNORE_REKOR", "value": "true" } ], "podTemplate": { "nodeSelector": { "konflux-ci.dev/workload": "konflux-tenants" }, "tolerations": [ { "effect": "NoSchedule", "key": "konflux-ci.dev/workload", "operator": "Equal", "value": "konflux-tenants" } ] }, "serviceAccountName": "konflux-integration-runner", "taskRef": { "params": [ { "name": "name", "value": "verify-enterprise-contract" }, { "name": "bundle", "value": "quay.io/conforma/tekton-task:kf-b345847182602d9a5ce9e957fa76fe02575c8018@sha256:7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "2h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-10-02T02:58:40Z", "conditions": [ { "lastTransitionTime": "2026-10-02T02:58:40Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "verify-enterprise-contract-79ca714d6d4124f2fc15be459db18e6b-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "alpha", "enableParamEnum": true, "enableProvenanceInStatus": true, "enableTerminationMessageCompression": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "7df8d121c09999d0376e189c1eb8a8263078aab697aa5ee966512f581427a6ce" }, "entryPoint": "verify-enterprise-contract", "uri": "quay.io/conforma/tekton-task" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1790909918\",\"namespace\":\"\",\"successes\":0,\"failures\":6,\"warnings\":0,\"result\":\"FAILURE\"}\n" } ], "spanContext": { "traceparent": "00-d58be5e8d62487681b22892b36fe063a-24e8bb0a9cc187af-01" }, "startTime": "2026-10-02T02:58:25Z", "steps": [ { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "cri-o://92fbff924d5c5c70bc5722a611f1ecac9a3280875c093079cbc4ce4dc62a3812", "exitCode": 0, "finishedAt": "2026-10-02T02:58:31Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:31Z" }, "terminationReason": "Skipped" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "provenance": {}, "terminated": { "containerID": "cri-o://ed723ced88f56d012f044415b9434cdf334b8721aff22220edc42267c41bdfd7", "exitCode": 0, "finishedAt": "2026-10-02T02:58:31Z", "reason": "Completed", "startedAt": "2026-10-02T02:58:31Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "provenance": {}, "terminated": { "containerID": "cri-o://1b748c8e3821edd3f18f7cc980d90911a9aee34cfb52e87d9c686ff4db7677ac", "exitCode": 0, "finishedAt": "2026-10-02T02:58:38Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:31Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "provenance": {}, "terminated": { "containerID": "cri-o://9acafc0247d0da59e0884f9a25ca690593ea8d2fc6abcaa41f2350ad08e049dc", "exitCode": 0, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "provenance": {}, "terminated": { "containerID": "cri-o://58249ec89f27e5fb7e96735575ff3de4fd3254982dbd1ffb60439deb048cc37e", "exitCode": 0, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version", "provenance": {}, "terminated": { "containerID": "cri-o://22790947dbf500087a6cc4fdbcccb2b8d5b7fb658b78d40bec61216cb41de01f", "exitCode": 0, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config", "provenance": {}, "terminated": { "containerID": "cri-o://7251ec1b73e9e752139f2747040057e181882d1c7a5ffb1c674d8c7a6d9475ee", "exitCode": 0, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "cri-o://6dfcac8636e75731ffc0710aa71446b86292cc9e5ea40c19f5ea82dc70f27515", "exitCode": 0, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert", "provenance": {}, "terminated": { "containerID": "cri-o://5ee520dd444031618d62427dded8c20c7ff838aaecec36195544712e191ae075", "exitCode": 1, "finishedAt": "2026-10-02T02:58:39Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1790909918\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":0,\\\"failures\\\":6,\\\"warnings\\\":0,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1}]", "reason": "Error", "startedAt": "2026-10-02T02:58:39Z" }, "terminationReason": "Error" } ], "taskSpec": { "description": "Verify the enterprise contract is met", "params": [ { "description": "Spec section of an ApplicationSnapshot resource. Not all fields of the\nresource are required. A minimal example:\n\n```json\n {\n \"components\": [\n {\n \"containerImage\": \"quay.io/example/repo:latest\"\n }\n ]\n }\n```\n\nEach `containerImage` in the `components` array is validated.\n", "name": "IMAGES", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "1", "description": "Number of parallel workers to use for policy evaluation.", "name": "WORKERS", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "HOME", "value": "/tekton/home" } ] }, "steps": [ { "args": [ "sigstore", "initialize", "--mirror", "", "--root", "/root.json" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "initialize-tuf", "when": [ { "operator": "notin", "values": [ "" ] } ] }, { "command": [ "reduce-snapshot.sh" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "SNAPSHOT", "value": "{\"components\":[{\"name\":\"\",\"containerImage\":\"quay.io/konflux-ci/ec-golden-image:latest\",\"source\":{}}],\"artifacts\":{}}" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "reduce", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "1800m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "ec-policy" }, { "name": "PUBLIC_KEY", "value": "k8s://chains-e2e-kscf/cosign-public-key" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "1" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n\n# Execute Conforma with constructed arguments\nexec ec \"${cmd_args[@]}\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/conforma/cli@sha256:2f5bed7fd51f678ea960aaf5bed033412b7d207a83bb1b02b108be5ca71a058d", "name": "assert" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ], "workspaces": [ { "description": "The workspace where the snapshot spec json file resides", "name": "data", "optional": true } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }