{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-a0zp/snapshot-sample-p599-d499148-fqg44", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-dev-a0zp/results/fffad07f-8570-4bef-bd07-cae84c8cb1fe/records/21b45d9c-c739-4fa1-ab07-e9740f3f59db", "results.tekton.dev/result": "final-finalizer-dev-a0zp/results/fffad07f-8570-4bef-bd07-cae84c8cb1fe", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-07-13T09:23:01Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:23:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-p599", "pipelines.appstudio.openshift.io/type": "final", "release.appstudio.openshift.io/name": "snapshot-sample-p599-d499148-fqg44", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-a0zp", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "final-x9bbs", "tekton.dev/pipelineRunUID": "fffad07f-8570-4bef-bd07-cae84c8cb1fe", "tekton.dev/pipelineTask": "hello-world" }, "name": "final-x9bbs-hello-world", "namespace": "final-finalizer-dev-a0zp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "final-x9bbs", "uid": "fffad07f-8570-4bef-bd07-cae84c8cb1fe" } ], "resourceVersion": "9447", "uid": "21b45d9c-c739-4fa1-ab07-e9740f3f59db" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "final-finalizer-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:23:06Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:23:06Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "final-x9bbs-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-13T09:23:01Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://58b926b037cdf6f18eebdf843d6245e9fa1f781e2429d9201dbdaef2b2eb8fb1", "exitCode": 0, "finishedAt": "2026-07-13T09:23:05Z", "reason": "Completed", "startedAt": "2026-07-13T09:23:05Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-a0zp/snapshot-sample-p599-d499148-c5v9r", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-dev-a0zp/results/5b18d17a-a4f5-4587-ab38-21fe681671b1/records/0453c37d-b212-4d50-bad8-3a5d0bd1f2e2", "results.tekton.dev/result": "final-finalizer-dev-a0zp/results/5b18d17a-a4f5-4587-ab38-21fe681671b1", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-07-13T09:23:01Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:23:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-p599", "pipelines.appstudio.openshift.io/type": "final", "release.appstudio.openshift.io/name": "snapshot-sample-p599-d499148-c5v9r", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-a0zp", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "final-zsljx", "tekton.dev/pipelineRunUID": "5b18d17a-a4f5-4587-ab38-21fe681671b1", "tekton.dev/pipelineTask": "hello-world" }, "name": "final-zsljx-hello-world", "namespace": "final-finalizer-dev-a0zp", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "final-zsljx", "uid": "5b18d17a-a4f5-4587-ab38-21fe681671b1" } ], "resourceVersion": "9696", "uid": "0453c37d-b212-4d50-bad8-3a5d0bd1f2e2" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "final-finalizer-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:23:05Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:23:05Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "final-zsljx-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-13T09:23:01Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://6190618ab71831cfe1b2859265f6440b7ae971768aa86087f7e546694f93a1cc", "exitCode": 0, "finishedAt": "2026-07-13T09:23:04Z", "reason": "Completed", "startedAt": "2026-07-13T09:23:04Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-a0zp/snapshot-sample-p599-d499148-fqg44", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-managed-failure/results/05353193-287f-45cc-aeb4-afe66993dbf0/records/467688e1-567b-4ff5-a061-3ca15f37a004", "results.tekton.dev/result": "final-finalizer-managed-failure/results/05353193-287f-45cc-aeb4-afe66993dbf0", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e, fail" }, "creationTimestamp": "2026-07-13T09:22:55Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:23:17Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-p599", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-p599-d499148-fqg44", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-a0zp", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "failing-pipeline", "tekton.dev/pipelineRun": "managed-8w42c", "tekton.dev/pipelineRunUID": "05353193-287f-45cc-aeb4-afe66993dbf0", "tekton.dev/pipelineTask": "fail-task" }, "name": "managed-8w42c-fail-task", "namespace": "final-finalizer-managed-failure", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8w42c", "uid": "05353193-287f-45cc-aeb4-afe66993dbf0" } ], "resourceVersion": "9551", "uid": "467688e1-567b-4ff5-a061-3ca15f37a004" }, "spec": { "serviceAccountName": "release-service-account", "taskSpec": { "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "fail", "script": "#!/usr/bin/env sh\n\nexit 1\n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:23:00Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:23:00Z", "message": "\"step-fail\" exited with code 1: Error", "reason": "Failed", "status": "False", "type": "Succeeded" } ], "podName": "managed-8w42c-fail-task-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-13T09:22:55Z", "steps": [ { "container": "step-fail", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "fail", "provenance": {}, "terminated": { "containerID": "containerd://bf0465070fa4f846d569faf5c6b15ae89b2f2fb1962642d690609c3d5fa419be", "exitCode": 1, "finishedAt": "2026-07-13T09:22:59Z", "reason": "Error", "startedAt": "2026-07-13T09:22:59Z" }, "terminationReason": "Error" } ], "taskSpec": { "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "fail", "script": "#!/usr/bin/env sh\n\nexit 1\n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "final-finalizer-dev-a0zp/snapshot-sample-p599-d499148-c5v9r", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "final-finalizer-managed-success/results/4b67e0f3-7dc8-4eff-a479-3996b03aae5d/records/6c2a67ce-b5dd-42a4-abb3-0ba83816f394", "results.tekton.dev/result": "final-finalizer-managed-success/results/4b67e0f3-7dc8-4eff-a479-3996b03aae5d", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-07-13T09:22:55Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:23:16Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-p599", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-p599-d499148-c5v9r", "release.appstudio.openshift.io/namespace": "final-finalizer-dev-a0zp", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "managed-bkn5q", "tekton.dev/pipelineRunUID": "4b67e0f3-7dc8-4eff-a479-3996b03aae5d", "tekton.dev/pipelineTask": "hello-world" }, "name": "managed-bkn5q-hello-world", "namespace": "final-finalizer-managed-success", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-bkn5q", "uid": "4b67e0f3-7dc8-4eff-a479-3996b03aae5d" } ], "resourceVersion": "9621", "uid": "6c2a67ce-b5dd-42a4-abb3-0ba83816f394" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "release-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:23:00Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:23:00Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-bkn5q-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-13T09:22:55Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://112579bc1971639a4fa0fe1cce49f3a92d95a817b8b113b4e9811911ca1c3fc4", "exitCode": 0, "finishedAt": "2026-07-13T09:22:59Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:59Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "happy-path-lnsz/snapshot-sample-e32f-d499148-njtft", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "happy-path-managed/results/51b2c42a-2d68-4d24-bfca-b148178f3196/records/1a5fe0eb-f14d-4504-a122-ca18e606da18", "results.tekton.dev/result": "happy-path-managed/results/51b2c42a-2d68-4d24-bfca-b148178f3196", "results.tekton.dev/stored": "true", "tekton.dev/displayName": "Verify Conforma in Konflux", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-07-13T09:21:50Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:22:37Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-e32f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-e32f-d499148-njtft", "release.appstudio.openshift.io/namespace": "happy-path-lnsz", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "e2e", "tekton.dev/pipelineRun": "managed-gb7px", "tekton.dev/pipelineRunUID": "51b2c42a-2d68-4d24-bfca-b148178f3196", "tekton.dev/pipelineTask": "verify-conforma", "tekton.dev/task": "verify-conforma-konflux-ta" }, "name": "managed-gb7px-verify-conforma", "namespace": "happy-path-managed", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-gb7px", "uid": "51b2c42a-2d68-4d24-bfca-b148178f3196" } ], "resourceVersion": "8324", "uid": "1a5fe0eb-f14d-4504-a122-ca18e606da18" }, "spec": { "params": [ { "name": "SNAPSHOT_FILENAME", "value": "51b2c42a-2d68-4d24-bfca-b148178f3196/snapshot_spec.json" }, { "name": "SSL_CERT_DIR", "value": "/var/run/secrets/kubernetes.io/serviceaccount" }, { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"include\":[\"@slsa3\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "STRICT", "value": "true" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "SOURCE_DATA_ARTIFACT", "value": "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:09fd4a4f40559a536b2650e9ddcde1316bbe08fa515a70c577340a96a9aae6ae" }, { "name": "TRUSTED_ARTIFACTS_DEBUG", "value": "" } ], "retries": 2, "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/conforma/tekton-catalog" }, { "name": "revision", "value": "2c1963225e8563194a8dce7f659c71bd866da426" }, { "name": "pathInRepo", "value": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml" } ], "resolver": "git" }, "timeout": "4h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:22:25Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:22:25Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-gb7px-verify-conforma-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "2c1963225e8563194a8dce7f659c71bd866da426" }, "entryPoint": "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml", "uri": "git+https://github.com/conforma/tekton-catalog" } }, "results": [ { "name": "TEST_OUTPUT", "type": "string", "value": "{\"timestamp\":\"1783934543\",\"namespace\":\"\",\"successes\":22,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n" }, { "name": "VSA_GENERATED", "type": "string", "value": "false" } ], "startTime": "2026-07-13T09:21:50Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://7ef1a2137863ceee64293475be62ca960d748a4a21616c06b53a00fa26fb27cd", "exitCode": 0, "finishedAt": "2026-07-13T09:22:11Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:11Z" }, "terminationReason": "Completed" }, { "container": "step-initialize-tuf", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "provenance": {}, "terminated": { "containerID": "containerd://36aa9ff1a3e327c32f299b5ab159d8f50521823006587370a85f316d3b26c2de", "exitCode": 0, "finishedAt": "2026-07-13T09:22:12Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:12Z" }, "terminationReason": "Completed" }, { "container": "step-reduce", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "provenance": {}, "terminated": { "containerID": "containerd://b3496d9283ab3a7d639a3af6b5385491c106653548c28652eb7ca5aa60c53615", "exitCode": 0, "finishedAt": "2026-07-13T09:22:12Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:12Z" }, "terminationReason": "Completed" }, { "container": "step-pin-policy-bundle", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "provenance": {}, "terminated": { "containerID": "containerd://691287614422bcdda7867dfd2611b84e9159a66a56987694eb0bde417dac5e21", "exitCode": 0, "finishedAt": "2026-07-13T09:22:12Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:12Z" }, "terminationReason": "Completed" }, { "container": "step-validate", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "provenance": {}, "terminated": { "containerID": "containerd://7bf44f466814c75ca578aa288bf13f7a576144d72049c883fe5e6ac1e6437e7a", "exitCode": 0, "finishedAt": "2026-07-13T09:22:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:12Z" }, "terminationReason": "Completed" }, { "container": "step-report-json", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "provenance": {}, "terminated": { "containerID": "containerd://4bf2c61e75614531b92e3c11741380881720639998530c2adeb49d54507a62fe", "exitCode": 0, "finishedAt": "2026-07-13T09:22:23Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:23Z" }, "terminationReason": "Completed" }, { "container": "step-summary", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "provenance": {}, "terminated": { "containerID": "containerd://f625adbf40fb2647da31ee44f81459bc5e1d31b2df21bc2ea339ffd1f809adee", "exitCode": 0, "finishedAt": "2026-07-13T09:22:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:24Z" }, "terminationReason": "Completed" }, { "container": "step-version", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version", "provenance": {}, "terminated": { "containerID": "containerd://ba741f99c0628550cb2f9f5536b86264380c3609d22806ca01b23e6b03ae4533", "exitCode": 0, "finishedAt": "2026-07-13T09:22:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:24Z" }, "terminationReason": "Completed" }, { "container": "step-show-config", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config", "provenance": {}, "terminated": { "containerID": "containerd://14323f3da1e53a6000e7351326370f0a21f28ff2ca9b2656e083de793eec259b", "exitCode": 0, "finishedAt": "2026-07-13T09:22:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:24Z" }, "terminationReason": "Completed" }, { "container": "step-detailed-report", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "provenance": {}, "terminated": { "containerID": "containerd://f31dc878a5751263dde194302d79589e26d40544d79fd61694440dedaa10d7de", "exitCode": 0, "finishedAt": "2026-07-13T09:22:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:24Z" }, "terminationReason": "Completed" }, { "container": "step-assert", "imageID": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert", "provenance": {}, "terminated": { "containerID": "containerd://6e015fab747361af1cac916d091b850f4031f5bc9381cfd35dd45ab2e241f5db", "exitCode": 0, "finishedAt": "2026-07-13T09:22:24Z", "message": "[{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"timestamp\\\":\\\"1783934543\\\",\\\"namespace\\\":\\\"\\\",\\\"successes\\\":22,\\\"failures\\\":0,\\\"warnings\\\":0,\\\"result\\\":\\\"SUCCESS\\\"}\\n\",\"type\":1},{\"key\":\"VSA_GENERATED\",\"value\":\"false\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-13T09:22:24Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://dfa5f79b80797a6eb55fb07583ec8fde02d79abc9f01d8bddf2eabd056d6063b", "exitCode": 0, "finishedAt": "2026-07-13T09:22:25Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:25Z" }, "terminationReason": "Skipped" } ], "taskSpec": { "description": "Verify the Conforma policy is met", "params": [ { "description": "The filename of the `Snapshot` that is located within the trusted artifact\n", "name": "SNAPSHOT_FILENAME", "type": "string" }, { "description": "Trusted Artifact to use to obtain the Snapshot to validate.\n", "name": "SOURCE_DATA_ARTIFACT", "type": "string" }, { "default": "enterprise-contract-service/default", "description": "Name of the policy configuration (EnterpriseContractPolicy\nresource) to use. `namespace/name` or `name` syntax supported. If\nnamespace is omitted the namespace where the task runs is used.\nYou can also specify a policy configuration using a git url, e.g.\n`github.com/conforma/config//slsa3`.\n", "name": "POLICY_CONFIGURATION", "type": "string" }, { "default": "", "description": "Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.", "name": "PUBLIC_KEY", "type": "string" }, { "default": "", "description": "Rekor host for transparency log lookups", "name": "REKOR_HOST", "type": "string" }, { "default": "", "description": "Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_IDENTITY", "type": "string" }, { "default": "", "description": "Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.", "name": "CERTIFICATE_OIDC_ISSUER", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.", "name": "CERTIFICATE_IDENTITY_REGEXP", "type": "string" }, { "default": "", "description": "Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.", "name": "CERTIFICATE_OIDC_ISSUER_REGEXP", "type": "string" }, { "default": "false", "description": "Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.", "name": "IGNORE_REKOR", "type": "string" }, { "default": "", "description": "TUF mirror URL. Provide a value when NOT using public sigstore deployment.", "name": "TUF_MIRROR", "type": "string" }, { "default": "", "description": "Path to a directory containing SSL certs to be used when communicating\nwith external services. This is useful when using the integrated registry\nand a local instance of Rekor on a development cluster which may use\ncertificates issued by a not-commonly trusted root CA. In such cases,\n`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple\npaths can be provided by using the `:` separator.\n", "name": "SSL_CERT_DIR", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIGMAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" }, { "default": "true", "description": "Include rule titles and descriptions in the output. Set to `\"false\"` to disable it.", "name": "INFO", "type": "string" }, { "default": "true", "description": "Fail the task if policy fails. Set to `\"false\"` to disable it.", "name": "STRICT", "type": "string" }, { "default": "/tekton/home", "description": "Value for the HOME environment variable.", "name": "HOMEDIR", "type": "string" }, { "default": "now", "description": "Run policy checks with the provided time.", "name": "EFFECTIVE_TIME", "type": "string" }, { "default": "", "description": "Merge additional Rego variables into the policy data. Use syntax \"key=value,key2=value2...\"", "name": "EXTRA_RULE_DATA", "type": "string" }, { "default": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a", "description": "Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@\u003cdigest\u003e. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).", "name": "POLICY_BUNDLE_DIGEST", "type": "string" }, { "default": "4", "description": "Number of parallel workers to use for policy evaluation.\n", "name": "WORKERS", "type": "string" }, { "default": "", "description": "Use the OPA evaluator instead of the default conftest evaluator. Set to \"1\" to enable.", "name": "EC_USE_OPA", "type": "string" }, { "default": "false", "description": "Reduce the Snapshot to only the component whose build caused the Snapshot to be created", "name": "SINGLE_COMPONENT", "type": "string" }, { "default": "unknown", "description": "Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.\n", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "ORAS_OPTIONS", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.", "name": "TRUSTED_ARTIFACTS_DEBUG", "type": "string" }, { "default": "/var/workdir/conforma", "description": "Directory to use to extract trusted artifact archive.", "name": "TRUSTED_ARTIFACTS_EXTRACT_DIR", "type": "string" }, { "default": "1s", "description": "Base duration for exponential backoff calculation (e.g., \"1s\", \"500ms\")", "name": "RETRY_DURATION", "type": "string" }, { "default": "2.0", "description": "Exponential backoff multiplier (e.g., \"2.0\", \"1.5\")", "name": "RETRY_FACTOR", "type": "string" }, { "default": "0.1", "description": "Randomness factor for backoff calculation (0.0-1.0, e.g., \"0.1\", \"0.2\")", "name": "RETRY_JITTER", "type": "string" }, { "default": "3", "description": "Maximum number of retry attempts", "name": "RETRY_MAX_RETRY", "type": "string" }, { "default": "3s", "description": "Maximum wait time between retries (e.g., \"3s\", \"10s\")", "name": "RETRY_MAX_WAIT", "type": "string" }, { "default": "false", "description": "Enable VSA generation", "name": "ENABLE_VSA", "type": "string" }, { "default": "dsse", "description": "Attestation format: dsse (signed envelope) or predicate (raw JSON)", "name": "ATTESTATION_FORMAT", "type": "string" }, { "default": "", "description": "Signing key for format=dsse (k8s:// or file:// URL)", "name": "VSA_SIGNING_KEY", "type": "string" }, { "default": "local@/var/workdir/conforma/vsa", "description": "VSA upload destination", "name": "VSA_UPLOAD", "type": "string" }, { "default": "", "description": "OCI storage URL for trusted artifacts", "name": "ociStorage", "type": "string" } ], "results": [ { "description": "Short summary of the policy evaluation for each image", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Whether VSAs were generated (true/false)", "name": "VSA_GENERATED", "type": "string" }, { "description": "Trusted Artifact URI containing VSA files", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" }, { "name": "HOME", "value": "/tekton/home" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay.io/konflux-ci/release-service-trusted-artifacts@sha256:09fd4a4f40559a536b2650e9ddcde1316bbe08fa515a70c577340a96a9aae6ae=/var/workdir/conforma" ], "computeResources": {}, "env": [ { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": {}, "env": [ { "name": "TUF_MIRROR" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "initialize-tuf", "script": "set -euo pipefail\n\nif [[ -z \"${TUF_MIRROR:-}\" ]]; then\n echo 'TUF_MIRROR parameter not provided. Skipping TUF root initialization.'\n exit\nfi\n\necho 'Initializing TUF root...'\nec sigstore initialize --mirror \"${TUF_MIRROR}\" --root \"${TUF_MIRROR}/root.json\"\necho 'Done!'" }, { "command": [ "reduce-snapshot.sh" ], "computeResources": {}, "env": [ { "name": "SNAPSHOT", "value": "/var/workdir/conforma/51b2c42a-2d68-4d24-bfca-b148178f3196/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "unknown" }, { "name": "CUSTOM_RESOURCE_NAMESPACE" }, { "name": "SNAPSHOT_PATH", "value": "/tekton/home/snapshot.json" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "reduce", "onError": "continue" }, { "command": [ "pin-konflux-policy-bundle.sh" ], "computeResources": {}, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"include\":[\"@slsa3\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "POLICY_BUNDLE_DIGEST", "value": "sha256:6f4d4b9bf0a4f5ca7768ef7c47c56c4b324ca4b1f8f5162b04b341fdb562f17a" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "pin-policy-bundle", "onError": "continue" }, { "computeResources": { "limits": { "memory": "2Gi" }, "requests": { "cpu": "250m", "memory": "2Gi" } }, "env": [ { "name": "POLICY_CONFIGURATION", "value": "{\"description\":\"Red Hat's enterprise requirements\",\"sources\":[{\"name\":\"Default\",\"policy\":[\"oci::quay.io/conforma/release-policy:konflux@sha256:6eb386faaf76de0d7dbc9f9e770a7f5639ebcee88e4ed4f004f8053189b21eae\"],\"data\":[\"oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest@sha256:7612aa06e24e5d8d304e97fd2bde931a6f052f0c1761b766cbcdb20f076c0502\",\"github.com/release-engineering/rhtap-ec-policy.git//data?ref=acaef210b5ddca7a87854b5141556c30efdc2afc\"],\"config\":{\"include\":[\"@slsa3\"]}}],\"configuration\":{\"exclude\":[\"step_image_registries\",\"tasks.required_tasks_found:prefetch-dependencies\"],\"collections\":[\"@slsa3\"]},\"publicKey\":\"k8s://happy-path-managed/cosign-public-key\"}" }, { "name": "PUBLIC_KEY" }, { "name": "CERTIFICATE_IDENTITY" }, { "name": "CERTIFICATE_OIDC_ISSUER" }, { "name": "CERTIFICATE_IDENTITY_REGEXP" }, { "name": "CERTIFICATE_OIDC_ISSUER_REGEXP" }, { "name": "REKOR_HOST" }, { "name": "IGNORE_REKOR", "value": "true" }, { "name": "WORKERS", "value": "4" }, { "name": "INFO", "value": "true" }, { "name": "EFFECTIVE_TIME", "value": "now" }, { "name": "EXTRA_RULE_DATA", "value": "pipeline_intention=release" }, { "name": "RETRY_MAX_WAIT", "value": "3s" }, { "name": "RETRY_MAX_RETRY", "value": "3" }, { "name": "RETRY_DURATION", "value": "1s" }, { "name": "RETRY_FACTOR", "value": "2.0" }, { "name": "RETRY_JITTER", "value": "0.1" }, { "name": "ENABLE_VSA", "value": "false" }, { "name": "ATTESTATION_FORMAT", "value": "dsse" }, { "name": "VSA_SIGNING_KEY" }, { "name": "VSA_UPLOAD", "value": "local@/var/workdir/conforma/vsa" }, { "name": "EC_USE_OPA" }, { "name": "HOMEDIR", "value": "/tekton/home" }, { "name": "SSL_CERT_DIR", "value": "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/var/run/secrets/kubernetes.io/serviceaccount" } ], "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "validate", "onError": "continue", "script": "#!/bin/bash\nset -euo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\n# Use policy override file if pin-policy-bundle produced one\nif [[ -f \"${HOMEDIR}/policy-with-pinned-bundle.yaml\" ]]; then\n POLICY_CONFIGURATION=\"${HOMEDIR}/policy-with-pinned-bundle.yaml\"\nfi\n\ncmd_args=(\n validate\n image\n --images=\"${HOMEDIR}/snapshot.json\"\n --policy=\"${POLICY_CONFIGURATION}\"\n)\n\n# To keep bash logic as thin as possible we deliberately don't sanitize\n# these params. If something is wrong or missing let Conforma handle it.\n\nif [ -n \"${CERTIFICATE_IDENTITY}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ] || \\\n [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ] || \\\n [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n # If *any* of the above are non-empty assume the intention is to\n # try keyless verification\n\n if [ -n \"${CERTIFICATE_IDENTITY}\" ]; then\n cmd_args+=(\n --certificate-identity=\"${CERTIFICATE_IDENTITY}\"\n )\n elif [ -n \"${CERTIFICATE_IDENTITY_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-identity-regexp=\"${CERTIFICATE_IDENTITY_REGEXP}\"\n )\n fi\n\n if [ -n \"${CERTIFICATE_OIDC_ISSUER}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer=\"${CERTIFICATE_OIDC_ISSUER}\"\n )\n elif [ -n \"${CERTIFICATE_OIDC_ISSUER_REGEXP}\" ]; then\n cmd_args+=(\n --certificate-oidc-issuer-regexp=\"${CERTIFICATE_OIDC_ISSUER_REGEXP}\"\n )\n fi\n\n # Force --ignore-rekor to false since we need rekor\n cmd_args+=(\n --ignore-rekor=false\n )\nelse\n # Assume traditional signing secret verification\n cmd_args+=(\n --public-key=\"${PUBLIC_KEY}\"\n --ignore-rekor=\"${IGNORE_REKOR}\"\n )\nfi\n\ncmd_args+=(\n --rekor-url=\"${REKOR_HOST}\"\n --workers=\"${WORKERS}\"\n --info=\"${INFO}\"\n --timeout=0\n --strict=false\n --show-successes=true\n --show-policy-docs-link=true\n --effective-time=\"${EFFECTIVE_TIME}\"\n --extra-rule-data=\"${EXTRA_RULE_DATA}\"\n --retry-max-wait=\"${RETRY_MAX_WAIT}\"\n --retry-max-retry=\"${RETRY_MAX_RETRY}\"\n --retry-duration=\"${RETRY_DURATION}\"\n --retry-factor=\"${RETRY_FACTOR}\"\n --retry-jitter=\"${RETRY_JITTER}\"\n --output=\"text=${HOMEDIR}/text-report.txt?show-successes=false\"\n --output=\"json=${HOMEDIR}/report-json.json\"\n --output=\"appstudio=/tekton/results/TEST_OUTPUT\"\n)\n\n# Add VSA arguments if enabled\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n cmd_args+=(\n --vsa=\"true\"\n --attestation-format=\"${ATTESTATION_FORMAT}\"\n )\n\n\n if [[ \"${ATTESTATION_FORMAT}\" == \"dsse\" ]]; then\n if [[ -z \"${VSA_SIGNING_KEY}\" ]]; then\n echo \"ERROR: VSA_SIGNING_KEY required for format=dsse\" \u003e\u00262\n exit 1\n fi\n cmd_args+=(\n --vsa-signing-key=\"${VSA_SIGNING_KEY}\"\n --vsa-upload=\"${VSA_UPLOAD}\"\n )\n fi\n\n # ec requires --attestation-output-dir to be under /tmp or cwd.\n # Write there first, then copy to the workdir so\n # create-trusted-artifact includes them in the archive.\n VSA_TMP_DIR=\"/tmp/vsa-output\"\n mkdir -p \"$VSA_TMP_DIR\"\n cmd_args+=(\n --attestation-output-dir=\"$VSA_TMP_DIR\"\n )\n\n echo -n \"true\" \u003e /tekton/results/VSA_GENERATED\nelse\n echo -n \"false\" \u003e /tekton/results/VSA_GENERATED\nfi\n\n# Execute Conforma with constructed arguments\nec \"${cmd_args[@]}\"\n\n# Copy VSA output from /tmp to workdir for trusted artifact archival\nif [[ \"${ENABLE_VSA}\" == \"true\" ]]; then\n # Extract local path from VSA_UPLOAD for output directory\n # VSA_UPLOAD format is \"local@/path/to/dir\"\n # Fixme: Because of -o pipefail this will fail the whole task when the grep doesn't match\n VSA_LOCAL_PATH=$(echo \"${VSA_UPLOAD}\" | grep -oE '^local@[^ ]+' | sed 's/^local@//' | head -n1 || true)\n if [[ -n \"$VSA_LOCAL_PATH\" \u0026\u0026 -d \"/tmp/vsa-output\" ]]; then\n mkdir -p \"$VSA_LOCAL_PATH\"\n cp -r /tmp/vsa-output/* \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n # Include raw JSON report for downstream SLSA VSA generation\n cp \"${HOMEDIR}/report-json.json\" \"$VSA_LOCAL_PATH\"/ 2\u003e/dev/null || true\n fi\nfi\n" }, { "args": [ "jq . /tekton/home/report-json.json | awk '{gsub(/^ +/, \"\"); acc += length; if (acc \u003e= 8000) { printf \"\\n\"; acc=length } printf $0 }'" ], "command": [ "sh", "-c" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "report-json", "onError": "continue" }, { "args": [ ".", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "summary", "onError": "continue" }, { "args": [ "version" ], "command": [ "ec" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "version" }, { "args": [ "{policy: .policy, key: .key, \"effective-time\": .[\"effective-time\"]}", "/tekton/home/report-json.json" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "show-config" }, { "args": [ "/tekton/home/text-report.txt" ], "command": [ "cat" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "detailed-report", "onError": "continue" }, { "args": [ "--argjson", "strict", "true", "-e", ".result == \"SUCCESS\" or .result == \"WARNING\" or ($strict | not)\n", "/tekton/results/TEST_OUTPUT" ], "command": [ "jq" ], "computeResources": {}, "image": "quay.io/conforma/cli@sha256:1e2ed4e265b9881385dd57e4770ff1a9d21ca79bf72bff810e4dbd37e884df9c", "name": "assert" }, { "args": [ "create", "--store", "", "/tekton/results/sourceDataArtifact=/var/workdir/conforma" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "when": [ { "input": "false", "operator": "in", "values": [ "true" ] }, { "operator": "notin", "values": [ "", "empty" ] } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" }, { "emptyDir": {}, "name": "workdir" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "tenant-dev-nek7/snapshot-sample-24nf-d499148-27tx5", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pac.test.appstudio.openshift.io/sha": "d49914874789147eb2de9bb6a12cd5d150bfff92", "pac.test.appstudio.openshift.io/url-repository": "https://github.com/redhat-appstudio-qe/dc-metro-map-release", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "tenant-dev-nek7/results/1a97fc06-dedb-4859-ae7b-1c8116526735/records/cc9f1362-e0b0-4c07-a1c0-0d644276e22c", "results.tekton.dev/result": "tenant-dev-nek7/results/1a97fc06-dedb-4859-ae7b-1c8116526735", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "e2e" }, "creationTimestamp": "2026-07-13T09:22:34Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-13T09:23:00Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "app.kubernetes.io/version": "0.1", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-24nf", "pipelines.appstudio.openshift.io/type": "tenant", "release.appstudio.openshift.io/name": "snapshot-sample-24nf-d499148-27tx5", "release.appstudio.openshift.io/namespace": "tenant-dev-nek7", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "simple-pipeline", "tekton.dev/pipelineRun": "tenant-dd59x", "tekton.dev/pipelineRunUID": "1a97fc06-dedb-4859-ae7b-1c8116526735", "tekton.dev/pipelineTask": "hello-world" }, "name": "tenant-dd59x-hello-world", "namespace": "tenant-dev-nek7", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "tenant-dd59x", "uid": "1a97fc06-dedb-4859-ae7b-1c8116526735" } ], "resourceVersion": "8982", "uid": "cc9f1362-e0b0-4c07-a1c0-0d644276e22c" }, "spec": { "params": [ { "name": "MESSAGE", "value": "hello world" } ], "serviceAccountName": "tenant-service-account", "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho $(params.MESSAGE) \n" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-13T09:22:47Z", "conditions": [ { "lastTransitionTime": "2026-07-13T09:22:47Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "tenant-dd59x-hello-world-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-13T09:22:34Z", "steps": [ { "container": "step-echo-message", "imageID": "registry.access.redhat.com/ubi9/ubi@sha256:9460515b85f2a75278f2043438583c1c377c44bf100178bb653a6c8658304ac7", "name": "echo-message", "provenance": {}, "terminated": { "containerID": "containerd://370e6d91a14800bfcd80a5145fe2271e4d289f3e74e404b834c0f017700374e8", "exitCode": 0, "finishedAt": "2026-07-13T09:22:45Z", "reason": "Completed", "startedAt": "2026-07-13T09:22:45Z" }, "terminationReason": "Completed" } ], "taskSpec": { "params": [ { "name": "MESSAGE", "type": "string" } ], "steps": [ { "computeResources": {}, "image": "registry.access.redhat.com/ubi9/ubi:9.4-1214", "name": "echo-message", "script": "#!/usr/bin/env sh\n\necho hello world \n" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }