Function validateImageCmd

cmd/validate/image.go:56–591

(validate imageValidationFunc)

var newOPAEvaluator = evaluator.NewOPAEvaluator

func validateImageCmd(validate imageValidationFunc) *cobra.Command {
	data := &imageData{
		strict:        true,
		workers:       5,
		filterType:    "include-exclude", // Default to include-exclude filter
		vsaExpiration: 168 * time.Hour,   // 7 days default
	}

	validOutputFormats := applicationsnapshot.OutputFormats

	cmd := &cobra.Command{
		Use:   "image",
		Short: "Validate conformance of container images with the provided policies",

		Long: hd.Doc(`
			Validate conformance of container images with the provided policies

			For each image, validation is performed in stages to determine if the image
			conforms to the provided policies.

			The first validation stage determines if an image has been signed, and the
			signature matches the provided public key. This is akin to the "cosign verify"
			command.

			The second validation stage determines if one or more attestations exist, and
			those attestations have been signed matching the provided public key, similarly
			to the "cosign verify-attestation" command. This stage temporarily stores the
			attestations for usage in the next stage.

			The final stage verifies the attestations conform to rego policies defined in
			the EnterpriseContractPolicy.

			Validation advances each stage as much as possible for each image in order to
			capture all issues in a single execution.
		`),

		Example: hd.Doc(`
			Validate single image with the policy defined in the EnterpriseContractPolicy
			custom resource named "default" in the enterprise-contract-service Kubernetes
			namespace:

			  ec validate image --image registry/name:tag

			Validate multiple images from an ApplicationSnapshot Spec file:

			  ec validate image --images my-app.yaml

			Validate attestation of images from an inline ApplicationSnapshot Spec:

			  ec validate image --images '{"components":[{"containerImage":"<image url>"}]}'

			Use a different public key than the one from the EnterpriseContractPolicy resource:

			  ec validate image --image registry/name:tag --public-key <path/to/public/key>

			Use a different Rekor URL than the one from the EnterpriseContractPolicy resource:

			  ec validate image --image registry/name:tag --rekor-url https://rekor.example.org