{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-zuto/snapshot-sample-pc48-d499148-qqntp", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc/records/a57e9145-d0ec-4319-9a6e-aa92c5a0340e", "results.tekton.dev/result": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-12T17:10:00Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-pc48", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-pc48-d499148-qqntp", "release.appstudio.openshift.io/namespace": "happy-path-zuto", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-5zzvt", "tekton.dev/pipelineRunUID": "98bfb347-a167-4f49-8893-c2baa246d5cc", "tekton.dev/pipelineTask": "collect-data", "tekton.dev/task": "collect-data" }, "name": "managed-5zzvt-collect-data", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-5zzvt", "uid": "98bfb347-a167-4f49-8893-c2baa246d5cc" } ], "resourceVersion": "11367", "uid": "a57e9145-d0ec-4319-9a6e-aa92c5a0340e" }, "spec": { "params": [ { "name": "release", "value": "happy-path-zuto/snapshot-sample-pc48-d499148-qqntp" }, { "name": "releasePlan", "value": "happy-path-zuto/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "happy-path-managed/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "happy-path-zuto/snapshot-sample-pc48" }, { "name": "subdirectory", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc" }, { "name": "ociStorage", "value": "quay.io/konflux-ci/release-service-trusted-artifacts" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "development" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-data/collect-data.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-12T17:10:50Z", "conditions": [ { "lastTransitionTime": "2026-08-12T17:10:50Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-5zzvt-collect-data-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "acbaf0738b24edf5947e9f66fa42cb905a77f00b" }, "entryPoint": "tasks/managed/collect-data/collect-data.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "data", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/data.json" }, { "name": "release", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/release.json" }, { "name": "releasePipelineMetadata", "type": "string", "value": "{\"org\":\"konflux-ci\",\"repo\":\"release-service-catalog\",\"revision\":\"development\",\"pathinrepo\":\"pipelines/managed/e2e/e2e.yaml\",\"sha\":\"acbaf0738b24edf5947e9f66fa42cb905a77f00b\"}\n" }, { "name": "releasePlan", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json" }, { "name": "releasePlanAdmission", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json" }, { "name": "releaseServiceConfig", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/release_service_config.json" }, { "name": "resultsDir", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/results" }, { "name": "singleComponentMode", "type": "string", "value": "false" }, { "name": "snapshotBuildId", "type": "string", "value": "" }, { "name": "snapshotName", "type": "string", "value": "snapshot-sample-pc48" }, { "name": "snapshotNamespace", "type": "string", "value": "happy-path-zuto" }, { "name": "snapshotSpec", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json" }, { "name": "subdirectory", "type": "string", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc" }, { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54" } ], "startTime": "2026-08-12T17:10:01Z", "steps": [ { "container": "step-collect-data", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "provenance": {}, "terminated": { "containerID": "containerd://db285cffef6677542e67d0c581be05aa00016a0834645a784589def86aa52458", "exitCode": 0, "finishedAt": "2026-08-12T17:10:45Z", "message": "[{\"key\":\"data\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"development\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/e2e/e2e.yaml\\\",\\\"sha\\\":\\\"acbaf0738b24edf5947e9f66fa42cb905a77f00b\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-pc48\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"happy-path-zuto\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:10:43Z" }, "terminationReason": "Completed" }, { "container": "step-check-data-key-sources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "provenance": {}, "terminated": { "containerID": "containerd://1c206081bfb2467c67136f9a69efc9409386a20bda34db2eb317d9e05325af9d", "exitCode": 0, "finishedAt": "2026-08-12T17:10:45Z", "message": "[{\"key\":\"data\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"development\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/e2e/e2e.yaml\\\",\\\"sha\\\":\\\"acbaf0738b24edf5947e9f66fa42cb905a77f00b\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-pc48\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"happy-path-zuto\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:10:45Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://026c502d5b8f9250fc3f4bcf1451e1fc32ae25d34f2114c7f09cb0edac5c6837", "exitCode": 0, "finishedAt": "2026-08-12T17:10:49Z", "message": "[{\"key\":\"data\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"development\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/e2e/e2e.yaml\\\",\\\"sha\\\":\\\"acbaf0738b24edf5947e9f66fa42cb905a77f00b\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-pc48\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"happy-path-zuto\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json\",\"type\":1},{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"98bfb347-a167-4f49-8893-c2baa246d5cc\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:10:46Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect the information added to the data field of the release resources.\n\nThe purpose of this task is to collect all the data and supply it to the other task in the pipeline by creating\na json file called `data.json` in the workspace.\n\nThis task also stores the passed resources as json files in a workspace.\n\nThe parameters to this task are lowercase instead of camelCase because they are passed from the operator, and the\noperator passes them as lowercase.\n\nA task result is returned for each resource with the relative path to the stored JSON for it in the workspace.\n\nFinally, the task checks that the keys from the correct resource (a key that should come from the\nReleasePlanAdmission should not be present in the Release data section).", "params": [ { "description": "The namespaced name of the Release", "name": "release", "type": "string" }, { "description": "The namespaced name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "The namespaced name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "The namespaced name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "The namespaced name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "", "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The relative path in the workspace to the stored release json", "name": "release", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlan json", "name": "releasePlan", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlanAdmission json", "name": "releasePlanAdmission", "type": "string" }, { "description": "The relative path in the workspace to the stored releaseServiceConfig json", "name": "releaseServiceConfig", "type": "string" }, { "description": "The relative path in the workspace to the stored snapshotSpec json", "name": "snapshotSpec", "type": "string" }, { "description": "The relative path in the workspace to the stored data json", "name": "data", "type": "string" }, { "description": "The relative path in the workspace to the results directory", "name": "resultsDir", "type": "string" }, { "description": "single component mode", "name": "singleComponentMode", "type": "string" }, { "description": "name of Snapshot resource", "name": "snapshotName", "type": "string" }, { "description": "namespace where Snapshot is located", "name": "snapshotNamespace", "type": "string" }, { "description": "Build Id where Snapshot originated", "name": "snapshotBuildId", "type": "string" }, { "description": "json object containing git resolver metadata about the running release pipeline", "name": "releasePipelineMetadata", "type": "string" }, { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" }, { "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "RELEASE", "value": "happy-path-zuto/snapshot-sample-pc48-d499148-qqntp" }, { "name": "RELEASE_PLAN", "value": "happy-path-zuto/source-releaseplan" }, { "name": "RELEASE_PLAN_ADMISSION", "value": "happy-path-managed/demo" }, { "name": "RELEASE_SERVICE_CONFIG", "value": "release-service/release-service-config" }, { "name": "SNAPSHOT", "value": "happy-path-zuto/snapshot-sample-pc48" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "script": "#!/usr/bin/env bash\nset -eo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nset -x\necho -n \"98bfb347-a167-4f49-8893-c2baa246d5cc\" \u003e \"/tekton/results/subdirectory\"\n\nRESULTS_DIR_PATH=\"results\"\nif [ -n \"98bfb347-a167-4f49-8893-c2baa246d5cc\" ]; then\n mkdir -p \"/var/workdir/release/98bfb347-a167-4f49-8893-c2baa246d5cc\"\n RESULTS_DIR_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/results\"\nfi\n\nmkdir -p \"/var/workdir/release/$RESULTS_DIR_PATH\"\necho -n \"$RESULTS_DIR_PATH\" \u003e \"/tekton/results/resultsDir\"\n\nRELEASE_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/release.json\"\necho -n \"$RELEASE_PATH\" \u003e \"/tekton/results/release\"\nget-resource \"release\" \"${RELEASE}\" | tee \"/var/workdir/release/$RELEASE_PATH\"\n\nRELEASEPLAN_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json\"\necho -n \"$RELEASEPLAN_PATH\" \u003e \"/tekton/results/releasePlan\"\nget-resource \"releaseplan\" \"${RELEASE_PLAN}\" | tee \"/var/workdir/release/$RELEASEPLAN_PATH\"\n\nRELEASEPLANADMISSION_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\"\necho -n \"$RELEASEPLANADMISSION_PATH\" \u003e \"/tekton/results/releasePlanAdmission\"\nget-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n | tee \"/var/workdir/release/$RELEASEPLANADMISSION_PATH\"\n\nRELEASESERVICECONFIG_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/release_service_config.json\"\necho -n \"$RELEASESERVICECONFIG_PATH\" \u003e \"/tekton/results/releaseServiceConfig\"\nget-resource \"releaseserviceconfig\" \"${RELEASE_SERVICE_CONFIG}\" \\\n | tee \"/var/workdir/release/$RELEASESERVICECONFIG_PATH\"\n\necho -e \"\\nFetching Snapshot Spec\"\nSNAPSHOTSPEC_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json\"\necho -n \"$SNAPSHOTSPEC_PATH\" \u003e \"/tekton/results/snapshotSpec\"\n# Empty-string componentGroup is treated as unset; fall back to .application, then drop it.\nget-resource \"snapshot\" \"${SNAPSHOT}\" \"{.spec}\" \\\n | jq '(if (.componentGroup == null or .componentGroup == \"\")\n then .componentGroup = .application else . end)\n | del(.application)' \\\n | tee \"/var/workdir/release/$SNAPSHOTSPEC_PATH\"\nlabels=$(get-resource \"snapshot\" \"${SNAPSHOT}\" \"{.metadata.labels}\")\nBUILD_ID=$(jq -r '.\"appstudio.openshift.io/build-pipelinerun\" // \"\"' \u003c\u003c\u003c \"${labels}\")\necho -n \"${BUILD_ID}\" | tee \"/tekton/results/snapshotBuildId\"\n\necho -e \"\\nGenerating collectors data\"\ncollectors_status=$(get-resource \"release\" \"${RELEASE}\" \"{.status.collectors}\")\necho \"***collectors status\"\necho \"${collectors_status}\"\necho \"***\"\n\ncollectors_result=$(jq -c '\n def deepmerge(a; b):\n reduce b[] as $item (a;\n reduce ($item | keys_unsorted[]) as $key (.;\n $item[$key] as $val | ($val | type) as $type | .[$key] = if ($type == \"object\") then\n deepmerge({}; [if .[$key] == null then {} else .[$key] end, $val])\n elif ($type == \"array\") then\n (.[$key] + $val | unique)\n else\n $val\n end)\n );\n\n # Ensure we safely handle missing collectors\n (.? // {}) as $collectors |\n\n # Flatten and combine the managed and tenant sections\n [($collectors.managed? // {} | to_entries | map(.value)) +\n ($collectors.tenant? // {} | to_entries | map(.value))] |\n flatten |\n deepmerge({}; .)\n' \u003c\u003c\u003c \"${collectors_status}\")\necho \"***collectors\"\njq \u003c\u003c\u003c \"$collectors_result\"\necho \"***\"\n\necho -e \"\\nFetching merged data json\"\nrelease_result=$(get-resource \"release\" \"${RELEASE}\" \"{.spec.data}\")\n\nrelease_plan_result=$(get-resource \"releaseplan\" \"${RELEASE_PLAN}\" \"{.spec.data}\")\n\nrelease_plan_admission_result=$(get-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n \"{.spec.data}\")\n\n# Merge collectors and Release keys. Release has higher priority\nmerged_output=$(merge-json \"$collectors_result\" \"$release_result\")\n\n# Merge now with ReleasePlan keys. ReleasePlan has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_result\")\n\n# Finally merge with ReleasePlanAdmission keys. ReleasePlanAdmission has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_admission_result\")\n\nDATA_PATH=\"98bfb347-a167-4f49-8893-c2baa246d5cc/data.json\"\necho -n \"$DATA_PATH\" \u003e \"/tekton/results/data\"\necho \"$merged_output\" | tee \"/var/workdir/release/$DATA_PATH\"\n\n# get pipeline ref info\npipelineref=$(jq -c '.spec.pipeline.pipelineRef' \\\n \"/var/workdir/release/98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\")\nresolver=$(jq -r '.resolver // \"\"' \u003c\u003c\u003c \"${pipelineref}\")\nif [ \"${resolver}\" == \"git\" ] ; then\n url=$(jq -r '.params[] | select(.name==\"url\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n revision=$(jq -r '.params[] | select(.name==\"revision\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n pathinrepo=$(jq -r '.params[] | select(.name==\"pathInRepo\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n orgrepo=\"${url#*/*/*/}\"\n org=$(echo \"${orgrepo}\" | cut -f1 -d/)\n repo=$(echo \"${orgrepo}\" | cut -f2 -d/ | cut -d. -f1)\n\n sha=$(curl -s \"https://api.github.com/repos/${org}/${repo}/commits/${revision}\" | jq -r '.sha // \"\"')\n\nfi\n\norg=\"${org:-unknown}\"\nrepo=\"${repo:-unknown}\"\nrevision=\"${revision:-unknown}\"\npathinrepo=\"${pathinrepo:-unknown}\"\nsha=\"${sha:-unknown}\"\n\necho \"\"\necho \"Release Pipeline Ref Info:\"\necho \"--------------------------\"\n\njson=$(jq -n -c \\\n --arg org \"${org}\" \\\n --arg repo \"${repo}\" \\\n --arg revision \"${revision}\" \\\n --arg pathinrepo \"${pathinrepo}\" \\\n --arg sha \"${sha}\" \\\n '$ARGS.named')\n\necho \"${json}\" \u003e \"/tekton/results/releasePipelineMetadata\"\n# pretty print for log message\njq . \u003c\u003c\u003c \"$json\"\n\nSINGLE_COMPONENT_MODE=$(jq -r '.singleComponentMode // \"false\"' \"/var/workdir/release/$DATA_PATH\")\nSNAPSHOT_NAME=$(echo \"${SNAPSHOT}\" | cut -f2 -d/)\nSNAPSHOT_NAMESPACE=$(echo \"${SNAPSHOT}\" | cut -f1 -d/)\n\necho -n \"${SINGLE_COMPONENT_MODE}\" | tee \"/tekton/results/singleComponentMode\"\necho -n \"${SNAPSHOT_NAME}\" | tee \"/tekton/results/snapshotName\"\necho -n \"${SNAPSHOT_NAMESPACE}\" | tee \"/tekton/results/snapshotNamespace\"\n" }, { "computeResources": { "limits": { "memory": "32Mi" }, "requests": { "cpu": "10m", "memory": "32Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "script": "#!/usr/bin/env bash\nset -ex\n\nDISALLOWED_KEYS_JSON='{\n \"Release\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlan\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlanAdmission\": [\n ]\n}'\n\nRC=0\n\ncheck_source () { # Expected arguments are [CRD from DISALLOWED_KEYS_JSON, file]\n for KEY in $(jq -r \".$1[]\" \u003c\u003c\u003c \"$DISALLOWED_KEYS_JSON\") ; do\n if [[ $(jq \".spec.data.$KEY\" \"$2\") != \"null\" ]] ; then\n echo \"Found disallowed key: $KEY in resource $1\"\n RC=1\n fi\n done\n}\n\ncheck_source \"Release\" \"/var/workdir/release/98bfb347-a167-4f49-8893-c2baa246d5cc/release.json\"\ncheck_source \"ReleasePlan\" \"/var/workdir/release/98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan.json\"\ncheck_source \"ReleasePlanAdmission\" \\\n \"/var/workdir/release/98bfb347-a167-4f49-8893-c2baa246d5cc/release_plan_admission.json\"\n\nexit $RC\n" }, { "args": [ "create", "--store", "quay.io/konflux-ci/release-service-trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-zuto/snapshot-sample-pc48-d499148-qqntp", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc/records/7b7f13f5-3b57-499f-a852-b8bd2a241e38", "results.tekton.dev/result": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-12T17:10:50Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-pc48", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-pc48-d499148-qqntp", "release.appstudio.openshift.io/namespace": "happy-path-zuto", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-5zzvt", "tekton.dev/pipelineRunUID": "98bfb347-a167-4f49-8893-c2baa246d5cc", "tekton.dev/pipelineTask": "collect-signing-params", "tekton.dev/task": "collect-signing-params" }, "name": "managed-5zzvt-collect-signing-params", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-5zzvt", "uid": "98bfb347-a167-4f49-8893-c2baa246d5cc" } ], "resourceVersion": "11669", "uid": "7b7f13f5-3b57-499f-a852-b8bd2a241e38" }, "spec": { "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "development" }, { "name": "pathInRepo", "value": "tasks/managed/collect-signing-params/collect-signing-params.yaml" } ], "resolver": "git" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-12T17:11:27Z", "conditions": [ { "lastTransitionTime": "2026-08-12T17:11:27Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-5zzvt-collect-signing-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "acbaf0738b24edf5947e9f66fa42cb905a77f00b" }, "entryPoint": "tasks/managed/collect-signing-params/collect-signing-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "buildIdentityRegexp", "type": "string", "value": "" }, { "name": "defaultOIDCIssuer", "type": "string", "value": "" }, { "name": "enableKeylessSigning", "type": "string", "value": "" }, { "name": "fulcioExternalUrl", "type": "string", "value": "" }, { "name": "fulcioUrl", "type": "string", "value": "" }, { "name": "rekorExternalUrl", "type": "string", "value": "" }, { "name": "rekorUrl", "type": "string", "value": "" }, { "name": "tektonChainsIdentity", "type": "string", "value": "" }, { "name": "tufExternalUrl", "type": "string", "value": "" }, { "name": "tufUrl", "type": "string", "value": "" } ], "startTime": "2026-08-12T17:10:50Z", "steps": [ { "container": "step-collect-signing-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "provenance": {}, "terminated": { "containerID": "containerd://3b3a47f0750dd33dc542321a9293e6033292b9f6cd9655146c92de5ffc6928bf", "exitCode": 0, "finishedAt": "2026-08-12T17:11:23Z", "message": "[{\"key\":\"buildIdentityRegexp\",\"value\":\"\",\"type\":1},{\"key\":\"defaultOIDCIssuer\",\"value\":\"\",\"type\":1},{\"key\":\"enableKeylessSigning\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tektonChainsIdentity\",\"value\":\"\",\"type\":1},{\"key\":\"tufExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tufUrl\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:11:17Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect Konflux configuration parameters related to\nkeyless signing using cosign. The task attempts to read the \"cluster-config\"\nConfigMap in the \"konflux-info\" namespace to extract signing parameters.\n\nIn case the ConfigMap is not found, the task will output empty strings for all parameters,\nallowing the pipeline to continue without signing parameters.", "params": [ { "default": "cluster-config", "description": "The name of the ConfigMap to read signing parameters from", "name": "configMapName", "type": "string" }, { "default": "konflux-info", "description": "The namespace where the ConfigMap is located", "name": "configMapNamespace", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "A flag indicating whether keyless signing should be enabled, based on the presence of signing parameters.\n", "name": "enableKeylessSigning", "type": "string" }, { "description": "A default OIDC issuer URL to be used for signing.\n", "name": "defaultOIDCIssuer", "type": "string" }, { "description": "The external URL of the Rekor transparency log.\n", "name": "rekorExternalUrl", "type": "string" }, { "description": "The internal URL of the Rekor transparency log.\n", "name": "rekorUrl", "type": "string" }, { "description": "The external URL of the Fulcio certificate authority.\n", "name": "fulcioExternalUrl", "type": "string" }, { "description": "The URL of the Fulcio certificate authority.\n", "name": "fulcioUrl", "type": "string" }, { "description": "The external URL of the TUF repository.\n", "name": "tufExternalUrl", "type": "string" }, { "description": "The URL of the TUF repository.\n", "name": "tufUrl", "type": "string" }, { "description": "A regular expression to extract build identity from the OIDC token claims, if applicable.\n", "name": "buildIdentityRegexp", "type": "string" }, { "description": "The identity used in the certificate, generated by fulcio.\n", "name": "tektonChainsIdentity", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "50m", "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "script": "#!/usr/bin/env bash\necho \"Getting cluster-config ConfigMap\"\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\n\n# Attempt to fetch the ConfigMap with retries, capture exit code\nif retry 3 kubectl get configmap \"cluster-config\" -n \"konflux-info\" -o json \u003e \\\n\"$KFLX_CONFIG_PATH\" 2\u003e/dev/null; then\n echo \"ConfigMap found, extracting signing parameters\"\n\n # Extract signing parameters from ConfigMap data, defaulting to empty string if not found\n enableKeylessSigning=$(jq -r '.data.enableKeylessSigning // \"\"' \"$KFLX_CONFIG_PATH\")\n defaultOIDCIssuer=$(jq -r '.data.defaultOIDCIssuer // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorExternalUrl=$(jq -r '.data.rekorExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorInternalUrl=$(jq -r '.data.rekorInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioExternalUrl=$(jq -r '.data.fulcioExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioInternalUrl=$(jq -r '.data.fulcioInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufExternalUrl=$(jq -r '.data.tufExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufInternalUrl=$(jq -r '.data.tufInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n buildIdentityRegexp=$(jq -r '.data.buildIdentityRegexp // \"\"' \"$KFLX_CONFIG_PATH\")\n tektonChainsIdentity=$(jq -r '.data.tektonChainsIdentity // \"\"' \"$KFLX_CONFIG_PATH\")\nelse\n echo \"ConfigMap not found, using default empty values\"\n\n # Set all parameters to empty strings when ConfigMap doesn't exist\n enableKeylessSigning=\"false\"\n defaultOIDCIssuer=\"\"\n rekorExternalUrl=\"\"\n rekorInternalUrl=\"\"\n fulcioExternalUrl=\"\"\n fulcioInternalUrl=\"\"\n tufExternalUrl=\"\"\n tufInternalUrl=\"\"\n buildIdentityRegexp=\"\"\n tektonChainsIdentity=\"\"\nfi\n\n# Write the values to the respective result paths and print them\necho -n \"$enableKeylessSigning\" | tee \"/tekton/results/enableKeylessSigning\"\necho -n \"$defaultOIDCIssuer\" | tee \"/tekton/results/defaultOIDCIssuer\"\necho -n \"$rekorExternalUrl\" | tee \"/tekton/results/rekorExternalUrl\"\nprefer_internal_or_external() {\n local internal=\"$1\"\n local external=\"$2\"\n local result_path=\"$3\"\n\n if [ -n \"$internal\" ]; then\n echo -n \"$internal\" | tee \"$result_path\"\n else\n echo -n \"$external\" | tee \"$result_path\"\n fi\n}\n\nprefer_internal_or_external \"$rekorInternalUrl\" \"$rekorExternalUrl\" \"/tekton/results/rekorUrl\"\necho -n \"$fulcioExternalUrl\" | tee \"/tekton/results/fulcioExternalUrl\"\nprefer_internal_or_external \"$fulcioInternalUrl\" \"$fulcioExternalUrl\" \"/tekton/results/fulcioUrl\"\necho -n \"$tufExternalUrl\" | tee \"/tekton/results/tufExternalUrl\"\nprefer_internal_or_external \"$tufInternalUrl\" \"$tufExternalUrl\" \"/tekton/results/tufUrl\"\necho -n \"$buildIdentityRegexp\" | tee \"/tekton/results/buildIdentityRegexp\"\necho -n \"$tektonChainsIdentity\" | tee \"/tekton/results/tektonChainsIdentity\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-zuto/snapshot-sample-pc48-d499148-qqntp", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc/records/25fdab75-ef7d-419e-b230-25e6510ae4eb", "results.tekton.dev/result": "happy-path-managed/results/98bfb347-a167-4f49-8893-c2baa246d5cc", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Conforma in Konflux", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-12T17:11:27Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-pc48", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-pc48-d499148-qqntp", "release.appstudio.openshift.io/namespace": "happy-path-zuto", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-5zzvt", "tekton.dev/pipelineRunUID": "98bfb347-a167-4f49-8893-c2baa246d5cc", "tekton.dev/pipelineTask": "verify-conforma", "tekton.dev/task": "verify-conforma-konflux-ta" }, "name": "managed-5zzvt-verify-conforma", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-5zzvt", "uid": "98bfb347-a167-4f49-8893-c2baa246d5cc" } ], "resourceVersion": "13107", "uid": "25fdab75-ef7d-419e-b230-25e6510ae4eb" }, "spec": { "params": [ { "name": "SNAPSHOT_FILENAME", "value": "98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "STRICT", "value": "true" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "SOURCE_DATA_ARTIFACT", "value": "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54" }, { "name": "TRUSTED_ARTIFACTS_DEBUG", "value": "" }, { "name": "CERTIFICATE_IDENTITY", "value": "" }, { "name": "CERTIFICATE_OIDC_ISSUER", "value": "" }, { "name": "TUF_MIRROR", "value": "" }, { "name": "REKOR_HOST", "value": "" } ], "retries": 2, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/conforma/tekton-catalog" }, { "name": "revision", "value": "2c1963225e8563194a8dce7f659c71bd866da426" }, { "name": "pathInRepo", "value": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml" } ], "resolver": "git" }, "timeout": "4h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-12T17:14:16Z", "conditions": [ { "lastTransitionTime": "2026-08-12T17:14:16Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "managed-5zzvt-verify-conforma-pod-retry2", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "2c1963225e8563194a8dce7f659c71bd866da426" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1786554853\",\"namespace\":\"\",\"successes\":126,\"failures\":19,\"warnings\":7,\"result\":\"FAILURE\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "retriesStatus": [ { "artifacts": {}, "completionTime": "2026-08-12T17:12:34Z", "conditions": [ { "lastTransitionTime": "2026-08-12T17:12:34Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "managed-5zzvt-verify-conforma-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "2c1963225e8563194a8dce7f659c71bd866da426" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1786554751\",\"namespace\":\"\",\"successes\":126,\"failures\":19,\"warnings\":7,\"result\":\"FAILURE\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "startTime": "2026-08-12T17:11:28Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://c02918393cc8e4b90a80d119571971e27d118ef3583f34e2798c310811fbb4f8", "exitCode": 0, "finishedAt": "2026-08-12T17:11:50Z", "reason": "Completed", "startedAt": "2026-08-12T17:11:49Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://e99e77f9cac09e8b96f383de0dff6e7082c06ab473b85c1dcac8527c0885064c", "exitCode": 0, "finishedAt": "2026-08-12T17:11:51Z", "reason": "Completed", "startedAt": "2026-08-12T17:11:51Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://7d8dc893b57dd1e3bc83766871207c9cb70a73d3614b167563db3a75c7d75c54", "exitCode": 0, "finishedAt": "2026-08-12T17:11:51Z", "reason": "Completed", "startedAt": "2026-08-12T17:11:51Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://a29bcabf5056963df42cccb64561656c4ad545a1965071a33d29c4d92c54e7c4", "exitCode": 0, "finishedAt": "2026-08-12T17:11:51Z", "reason": "Completed", "startedAt": "2026-08-12T17:11:51Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://d045781efced73d814b39543dd40db2401d0879bf06e23c4a9170b728cc9055a", "exitCode": 0, "finishedAt": "2026-08-12T17:12:31Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:11:51Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://81a5ea79379d5b604c7b464173a257792302f4369d55e790285ac334e5115cf3", "exitCode": 0, "finishedAt": "2026-08-12T17:12:32Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:32Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://3f4804e88751f1f50d32e1a3385acdd97d62bb7e74af7cdc11d014144748fc49", "exitCode": 0, "finishedAt": "2026-08-12T17:12:32Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:32Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://522aa492a46b35da939bc2591050eb93b14cb851947744ad80715f1a2840bd90", "exitCode": 0, "finishedAt": "2026-08-12T17:12:32Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:32Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://519ae1689c91c3d2d48789f5e7c6d6e1dcb2aa6059a6cacd9ec82896f17a6658", "exitCode": 0, "finishedAt": "2026-08-12T17:12:32Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:32Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://ad6a3d58536a341fd3fd71c54b87c1d3f1b09013a08a90e3742b0e91a3ba1c3c", "exitCode": 0, "finishedAt": "2026-08-12T17:12:33Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:33Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://ae8c52fb3ec90a725166365a019864ff59f917d4c7e93e077725543d27474b7c", "exitCode": 1, "finishedAt": "2026-08-12T17:12:33Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554751\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Error", "startedAt": "2026-08-12T17:12:33Z" }, "terminationReason": "Error" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://ef0566b9a3869eeab1d7c9607b8f9c33ced6c7c7e363783739c9ca54f733653b", "exitCode": 1, "finishedAt": "2026-08-12T17:12:33Z", "reason": "Error", "startedAt": "2026-08-12T17:12:33Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } }, { "artifacts": {}, "completionTime": "2026-08-12T17:13:25Z", "conditions": [ { "lastTransitionTime": "2026-08-12T17:13:25Z", "message": "\"step-assert\" exited with code 1: Error", "reason": "StepFailed", "status": "False", "type": "Succeeded" } ], "podName": "managed-5zzvt-verify-conforma-pod-retry1", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "2c1963225e8563194a8dce7f659c71bd866da426" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1786554803\",\"namespace\":\"\",\"successes\":126,\"failures\":19,\"warnings\":7,\"result\":\"FAILURE\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "startTime": "2026-08-12T17:12:34Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://3614b18be7a3e95711bf5d0571d66316a19dd14956a84b4c6a3a6d16117feb52", "exitCode": 0, "finishedAt": "2026-08-12T17:12:43Z", "reason": "Completed", "startedAt": "2026-08-12T17:12:42Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://66ca502757a0b7fd16e4468ec59284f53114514a71b93c663f2c30a55a8454c1", "exitCode": 0, "finishedAt": "2026-08-12T17:12:43Z", "reason": "Completed", "startedAt": "2026-08-12T17:12:43Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://4a69391387167554d20e523b07e9a1f6202bb958fbb3ef8d773a40175e4f108a", "exitCode": 0, "finishedAt": "2026-08-12T17:12:44Z", "reason": "Completed", "startedAt": "2026-08-12T17:12:44Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://86cc74bbcd37b49af3250c8659fb60dca3a3eac91527e1ca7a1df572a1898257", "exitCode": 0, "finishedAt": "2026-08-12T17:12:44Z", "reason": "Completed", "startedAt": "2026-08-12T17:12:44Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://90db5be864ad2e63c5874be5441ffd5540220fff4d9b3ddb036c9b857456f97d", "exitCode": 0, "finishedAt": "2026-08-12T17:13:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:12:44Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://0248177abd4d9aa12a24bf97acae61ec83d456aa9341774900d076dc5781308c", "exitCode": 0, "finishedAt": "2026-08-12T17:13:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:23Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://81939b20ed1a65cf2389137e0a2f6c903ca53114973bdf3a892279a1fc4a91bf", "exitCode": 0, "finishedAt": "2026-08-12T17:13:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:24Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://e33529d06d66e3bd67dd6a9dcbdbde22b7682108bcf2980f6540588f09148315", "exitCode": 0, "finishedAt": "2026-08-12T17:13:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:24Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://f5d69f8a7e902e4061fdbaa108d5c1d702d13e1b54e3210fb96b27399172c036", "exitCode": 0, "finishedAt": "2026-08-12T17:13:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:24Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://afa15ae11e6a68e1322d6c48071d2ca8935aba41d63cbca0e4077656b7570018", "exitCode": 0, "finishedAt": "2026-08-12T17:13:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:24Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://bd9a02364292c58f9883ebbe0e6a4567bc9c8dbfbd192fd75305c4ec54ac6c88", "exitCode": 1, "finishedAt": "2026-08-12T17:13:25Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554803\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Error", "startedAt": "2026-08-12T17:13:25Z" }, "terminationReason": "Error" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://45596872c88290107efc7c78356f978be98756155bfb3ff626dc98e1229f1174", "exitCode": 1, "finishedAt": "2026-08-12T17:13:25Z", "reason": "Error", "startedAt": "2026-08-12T17:13:25Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } ], "startTime": "2026-08-12T17:13:25Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://f2862da485c2c3fa608cb39b01466367b1ea625f23db85e9605bdf3eecabfe8c", "exitCode": 0, "finishedAt": "2026-08-12T17:13:33Z", "reason": "Completed", "startedAt": "2026-08-12T17:13:32Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://0f06dcd297510cc34b94a4168ffe57859d41c38237f18a75d8f7858b8d2ca70e", "exitCode": 0, "finishedAt": "2026-08-12T17:13:34Z", "reason": "Completed", "startedAt": "2026-08-12T17:13:34Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://342482247c4b31561b90c70d6080e2aaf99e7f07050882446b98ec18a201e1e9", "exitCode": 0, "finishedAt": "2026-08-12T17:13:34Z", "reason": "Completed", "startedAt": "2026-08-12T17:13:34Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://a64f7f9ed52fcd4a84f62ae4ba37bd0ece4e4b73514f6d1db8009a880d9cadfa", "exitCode": 0, "finishedAt": "2026-08-12T17:13:34Z", "reason": "Completed", "startedAt": "2026-08-12T17:13:34Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://3a7903aa5ab712732cca6b37aba1b6e1448bc9f8a4608b485393a9606b512f49", "exitCode": 0, "finishedAt": "2026-08-12T17:14:13Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:13:34Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://339afcdc1f4e5d29af55d4814118206a94cde80d0bf1a4dbfc9277eb78dff2fd", "exitCode": 0, "finishedAt": "2026-08-12T17:14:14Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:14:14Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://87927efbd1846ff26d9b7101be82b526f81393ecf661db40d84ccbd8025d6a30", "exitCode": 0, "finishedAt": "2026-08-12T17:14:14Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:14:14Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://904245e7dec2cad239c9140c68f582d6794598ad21e9fa3274d970136c46c511", "exitCode": 0, "finishedAt": "2026-08-12T17:14:14Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:14:14Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://86130f99087ef40e92e5f4bb23dfbd7a7e773e077a93828d7bbf6a14b1df8b08", "exitCode": 0, "finishedAt": "2026-08-12T17:14:14Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:14:14Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://2e73a8886c78b29723421c3ca9f22eeab0bd2658c443924d80b75eb7678ea811", "exitCode": 0, "finishedAt": "2026-08-12T17:14:15Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-12T17:14:15Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://d2e4ac7736e15ad56681956bcccc00ac64b13a2f0556d5e6ea52e7e6c31414c2", "exitCode": 1, "finishedAt": "2026-08-12T17:14:15Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1786554853\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":126,\\\"failures\\\":19,\\\"warnings\\\":7,\\\"result\\\":\\\"FAILURE\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Error", "startedAt": "2026-08-12T17:14:15Z" }, "terminationReason": "Error" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://9b92077aef47696fdd651408357079a3841d19ae07a06111196f79b883729427", "exitCode": 1, "finishedAt": "2026-08-12T17:14:15Z", "reason": "Error", "startedAt": "2026-08-12T17:14:15Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:04c5b2afcddc29fe3cf28268e935b17cf7aa4669fa47b58a57c2277611234b54=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/98bfb347-a167-4f49-8893-c2baa246d5cc/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:latest@sha256:ee5c3a020c9545eca738ed87198af0b235463069b2d72c5dba609364a83321d2\"],\"data\":[\"github.com/konflux-ci/konflux-operator-trusted-sources//data?ref=8eaa4f44c2bf67e6e2b20c5777b0d73e978c632b\"],\"config\":{\"exclude\":[\"hermetic_task\",\"source_image\",\"rpm_repos\"],\"include\":[\"@redhat\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }