Enterprise Contract (Conforma)

echo $CHAINS_IMAGE

  ec validate image \
  --image $CHAINS_IMAGE \
  --public-key k8s://openshift-pipelines/signing-secrets \
  --rekor-url $SIGSTORE_REKOR_URL \
  --policy '{
    "sources": [{
      "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"],
      "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"],
      "config": {
        "include": [
          "attestation_type",
          "slsa_provenance_available",
          "slsa_source_version_controlled"
        ]
      }
    }]
  }' \
  --output yaml \
  --show-successes \
  --info

  ec validate image \
  --image $CHAINS_IMAGE \
  --public-key k8s://openshift-pipelines/signing-secrets \
  --rekor-url $SIGSTORE_REKOR_URL \
  --policy '{
    "sources": [{
      "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"],
      "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"],
      "config": {
        "include": [
          "@slsa3"
        ]
      }
    }]
  }' \
  --info

    ec validate image \
  --image $CHAINS_IMAGE \
  --public-key k8s://openshift-pipelines/signing-secrets \
  --rekor-url $SIGSTORE_REKOR_URL \
  --policy '{
    "sources": [{
      "policy": ["oci::quay.io/enterprise-contract/ec-release-policy:latest"],
      "data": ["git::https://github.com/enterprise-contract/ec-policies//example/data"],
      "config": {
        "include": [
          "@slsa3"
        ],
        "exclude": [
          "slsa_source_correlated.source_code_reference_provided"
        ]
      }
    }]
  }' --info

cat > release-approval-predicate.json <<'EOF'
{
  "release": {
    "approved": true,
    "approvalDate": "2025-11-08T12:00:00Z",
    "approver": "Jane Smith",
    "approverEmail": "jane.smith@example.com"
  },
  "serviceNowTickets": [
    {
      "ticketId": "CHG0012345",
      "url": "https://servicenow.example.com/nav_to.do?uri=change_request.do?sys_id=abc123",
      "type": "Change Request",
      "status": "Approved",
      "approvalDate": "2025-11-07T15:30:00Z"
    },
    {
      "ticketId": "RITM0067890",
      "url": "https://servicenow.example.com/nav_to.do?uri=sc_req_item.do?sys_id=def456",
      "type": "Requested Item",
      "status": "Closed Complete",
      "completionDate": "2025-11-08T09:00:00Z"
    }
  ],
  "metadata": {
    "processVersion": "1.0",
    "complianceFramework": "ADS-Scholars Release Policy",
    "notes": "Standard release approval process completed"
  }
}
EOF

cosign attest \
  --key k8s://openshift-pipelines/signing-secrets \
  --type https://redhat.com/ads-scholars/v1 \
  --predicate release-approval-predicate.json \
  $CHAINS_IMAGE

cosign verify-attestation \
--type https://redhat.com/ads-scholars/v1 \
--key k8s://openshift-pipelines/signing-secrets \
$CHAINS_IMAGE |  jq -r '.payload' | base64 -d | jq .

cat > release-approval-policy.rego <<'EOF'
package redhat.release_approval

import rego.v1

# METADATA
# title: Release Approval Attestation Check
# description: >-
#   Verify that the image has a valid release approval attestation
#   with ServiceNow ticket approvals.
# custom:
#   short_name: release_approval_present
#   failure_msg: Release approval attestation is missing or invalid
#   solution: >-
#     Ensure the release approval process is completed and the attestation
#     is created with valid ServiceNow ticket references before deployment.
#   collections:
#     - release_approval

# Helper to get all attestations of our custom type
release_approval_attestations contains att if {
    some att in input.attestations
    att.statement.predicateType == "https://redhat.com/ads-scholars/v1"
}


# METADATA
# title: Release Approval Attestation Exists
# description: >-
#   At least one release approval attestation must be present.
# custom:
#   short_name: attestation_exists
deny contains result if {
    count(release_approval_attestations) == 0
    result := {
        "code": "redhat.release_approval.attestation_exists",
        "msg": "No release approval attestation found for image",
        "effective_on": "2025-01-01T00:00:00Z",
    }
}

# METADATA
# title: Release Must Be Approved
# description: >-
#   The release approval attestation must indicate that the release
#   has been approved.
# custom:
#   short_name: release_approved
deny contains result if {
    some att in release_approval_attestations
    approved := object.get(att, ["statement", "predicate", "release", "approved"], false)
    approved != true
    result := {
        "code": "redhat.release_approval.release_approved",
        "msg": "Release is not approved in the attestation",
        "effective_on": "2025-01-01T00:00:00Z",
    }
}

# METADATA
# title: ServiceNow Tickets Present
# description: >-
#   The release approval attestation must contain at least one
#   ServiceNow ticket reference.
# custom:
#   short_name: servicenow_tickets_present
deny contains result if {
    some att in release_approval_attestations
    tickets := object.get(att, ["statement", "predicate", "serviceNowTickets"], [])
    count(tickets) == 0
    result := {
        "code": "redhat.release_approval.servicenow_tickets_present",
        "msg": sprintf(
            "No ServiceNow tickets found in release approval attestation (found %d tickets)",
            [count(tickets)]
        ),
        "effective_on": "2025-01-01T00:00:00Z",
    }
}

# METADATA
# title: All ServiceNow Tickets Are Approved or Complete
# description: >-
#   All ServiceNow tickets referenced in the attestation must be
#   in an approved or completed state.
# custom:
#   short_name: servicenow_tickets_approved
deny contains result if {
    some att in release_approval_attestations
    tickets := object.get(att, ["statement", "predicate", "serviceNowTickets"], [])

    some ticket in tickets
    status := object.get(ticket, "status", "Unknown")
    not ticket_is_approved(status)

    ticket_id := object.get(ticket, "ticketId", "Unknown")
    result := {
        "code": "redhat.release_approval.servicenow_tickets_approved",
        "msg": sprintf(
            "ServiceNow ticket %s has invalid status: %s (expected 'Approved' or 'Closed Complete')",
            [ticket_id, status]
        ),
        "effective_on": "2025-01-01T00:00:00Z",
    }
}

# Helper function to check if a ticket status indicates approval
ticket_is_approved(status) if {
    status == "Approved"
}

ticket_is_approved(status) if {
    status == "Closed Complete"
}

# METADATA
# title: Approver Information Present
# description: >-
#   The release approval attestation must include approver information.
# custom:
#   short_name: approver_info_present
deny contains result if {
    some att in release_approval_attestations
    release := object.get(att, ["statement", "predicate", "release"], {})

    # Check if approver name is missing or empty
    approver := object.get(release, "approver", "")
    approver == ""

    result := {
        "code": "redhat.release_approval.approver_info_present",
        "msg": "Release approval attestation missing approver information",
        "effective_on": "2025-01-01T00:00:00Z",
    }
}

# Optional: Warning for old approvals (e.g., older than 30 days)
# METADATA
# title: Release Approval Not Too Old
# description: >-
#   The release approval should not be older than 30 days to ensure
#   current compliance with release policies.
# custom:
#   short_name: approval_freshness
warn contains result if {
    some att in release_approval_attestations
    approval_date_str := object.get(att, ["statement", "predicate", "release", "approvalDate"], "")
    approval_date_str != ""

    # Parse the approval date
    approval_time := time.parse_rfc3339_ns(approval_date_str)
    current_time := time.now_ns()

    # Calculate age in days (nanoseconds to days)
    age_days := (current_time - approval_time) / (1000000000 * 60 * 60 * 24)

    age_days > 30

    result := {
        "code": "redhat.release_approval.approval_freshness",
        "msg": sprintf(
            "Release approval is %d days old (older than 30 days)",
            [floor(age_days)]
        ),
        "effective_on": "2025-01-01T00:00:00Z",
    }
}
EOF

cat > local-policy.yaml <<EOF
sources:
  - policy:
      - ./
EOF