Enterprise Contract Seadog Enterprise Contract Documentation
Home Blog Contribute
Documentation
User GuideCLI ReferenceTekton TasksConfigurationPolicies
  • About
      • Introduction
      • Getting started
        • Configuration
      • How-to guides
        • Using Cosign
        • Command line EC
        • Reproducing a Konflux EC report locally
        • Using custom configuration
        • Using custom data
        • Hitchhiker’s Guide to EC
      • EC & SLSA
      • Glossary
  • CLI Reference
      • Home
      • Configuration
      • Policy Input
      • Signing
      • Troubleshooting
      • Command Reference
        • ec
        • ec fetch
        • ec fetch policy
        • ec init
        • ec init policies
        • ec inspect
        • ec inspect policy
        • ec inspect policy-data
        • ec opa
        • ec opa bench
        • ec opa build
        • ec opa capabilities
        • ec opa check
        • ec opa deps
        • ec opa eval
        • ec opa exec
        • ec opa fmt
        • ec opa inspect
        • ec opa parse
        • ec opa run
        • ec opa sign
        • ec opa test
        • ec opa version
        • ec sigstore
        • ec sigstore initialize
        • ec test
        • ec track
        • ec track bundle
        • ec validate
        • ec validate image
        • ec validate input
        • ec validate policy
        • ec version
      • Tekton Tasks
        • verify-enterprise-contract
      • Rego Reference
        • ec.oci.blob
        • ec.oci.image_files
        • ec.oci.image_manifest
        • ec.purl.is_valid
        • ec.purl.parse
        • ec.sigstore.verify_attestation
        • ec.sigstore.verify_image
  • Configuration Reference
      • About Enterprise Contract Configuration
      • Reference
  • Policies
      • About Enterprise Contract
      • Release Policy
        • Rule Collections
          • github
          • minimal
          • policy_data
          • redhat
          • rhtap-jenkins
          • slsa3
        • Release Rules
          • Attestation type
            • Deprecated policy attestation format
            • Known attestation type found
            • Known attestation types provided
            • PipelineRun attestation found
          • Base image checks
            • Allowed base image registry prefixes list was provided
            • Base image comes from permitted registry
            • Base images provided
          • Buildah build task
            • ADD_CAPABILITIES parameter
            • Buildah task uses a local Dockerfile
            • PLATFORM parameter
            • PRIVILEGED_NESTED parameter
            • disallowed_platform_patterns format
          • CVE checks
            • Blocking CVE check
            • Blocking unpatched CVE check
            • CVE scan results found
            • Deprecated CVE result name
            • Non-blocking CVE check
            • Non-blocking unpatched CVE check
            • Rule data provided
          • External parameters
            • Pipeline run params
            • PipelineRun params provided
            • Restrict shared volumes
          • GitHub Certificate Checks
            • GitHub Workflow Certificate Extensions
            • GitHub Workflow Name
            • GitHub Workflow Repository
            • GitHub Workflow Repository
            • GitHub Workflow Trigger
            • Rule data provided
          • Hermetic build task
            • Build task called with hermetic param set
          • Java dependency checks
            • Java builds have no foreign dependencies
            • Trusted Java dependency source list was provided
          • Labels
            • Deprecated labels
            • Disallowed inherited labels
            • Inaccessible image config
            • Inaccessible image manifest
            • Inaccessible parent image config
            • Inaccessible parent image manifest
            • Optional labels
            • Required labels
            • Rule data provided
          • OLM
            • ClusterServiceVersion semver format
            • Feature annotations have expected value
            • Images referenced by OLM bundle are from allowed registries
            • Required OLM feature annotations list provided
            • Subscription annotation has expected value
            • Unable to access images in the input snapshot
            • Unmapped images in OLM bundle
            • Unpinned images in OLM bundle
            • Unpinned images in input snapshot
          • Provenance Materials
            • Git clone source matches materials provenance
            • Git clone task found
          • Quay expiration
            • Expires label
          • RHTAP GitHub
            • RHTAP GitHub SLSA Provenance Attestation Found
          • RHTAP GitLab
            • RHTAP GitLab SLSA Provenance Attestation Found
          • RHTAP Jenkins
            • RHTAP Jenkins SLSA Invocation ID present
            • RHTAP Jenkins SLSA Provenance Attestation Found
          • RPM Repos
            • All rpms have known repo ids
            • Known repo id list provided
          • RPM Signature
            • Allowed RPM signature key
            • Result format
            • Rule data provided
          • SBOM
            • Disallowed packages list is provided
            • Found
          • SBOM CycloneDX
            • Allowed
            • Allowed package external references
            • Allowed package sources
            • Disallowed package attributes
            • Disallowed package external references
            • Valid
          • SLSA - Build - Build Service
            • Allowed builder IDs provided
            • SLSA Builder ID found
            • SLSA Builder ID is known and accepted
          • SLSA - Build - Scripted Build
            • Build task contains steps
            • Build task set image digest and url task results
            • Image built by trusted Task
            • Provenance subject matches build task image result
          • SLSA - Provenance - Available
            • Allowed predicate types provided
            • Expected attestation predicate type found
          • SLSA - Source - Version Controlled
            • Material uri is a git repo
            • Materials have uri and digest
            • Materials include git commit shas
          • SLSA - Verification model - Source
            • Expected source code reference
            • Rule data provided
            • Source code reference provided
            • Source reference
          • SPDX SBOM
            • Allowed
            • Allowed package external references
            • Contains files
            • Contains packages
            • Disallowed package external references
            • Matches image
            • Valid
          • Schedule related checks
            • Date Restriction
            • Rule data provided
            • Weekday Restriction
          • Source image
            • Exists
            • Signed
          • Task bundle checks
            • A trusted Tekton bundles list was provided
            • Task bundle references not empty
            • Task bundle references pinned to digest
            • Task bundles are in trusted tasks list
            • Task bundles are latest versions
            • Tasks defined using bundle references
          • Tasks
            • All required tasks are from trusted tasks
            • All required tasks were included in the pipeline
            • Data provided
            • Future required tasks were found
            • Pinned Task references
            • Pipeline run includes at least one task
            • Required tasks list for pipeline was provided
            • Required tasks list was provided
            • Successful pipeline tasks
            • Task version unsupported
          • Test
            • Image digest is present in IMAGES_PROCESSED result
            • No informative tests failed
            • No tests erred
            • No tests failed
            • No tests produced warnings
            • No tests were skipped
            • No unsupported test result values found
            • Rule data provided
            • Test data found in task results
            • Test data includes results key
          • Trusted Task checks
            • Data format
            • Task references are pinned
            • Task tracking data was provided
            • Tasks are trusted
            • Tasks using the latest versions
            • Trusted Artifact produced in pipeline
            • Trusted parameters
          • rpm-ostree Task
            • Builder image parameter
            • Rule data
      • Pipeline Policy
        • Pipeline definition Task bundle policies
          • Missing required data
          • Task bundle is not trusted
          • Task bundle is out of date
          • Task bundle reference is empty
          • Task bundle was not used or is not defined
          • Unpinned task bundle reference
        • Pipeline definition sanity checks
          • Pipeline definition has expected kind
        • Required tasks
          • Missing future required task
          • Missing required task
          • Pipeline contains tasks
          • Required task list is present in rule data
          • Required tasks found in pipeline definition
      • Build Task Policy
        • Tekton task build type label checks
          • Build task has build type label
          • Build task has label
      • Task Policy
        • Tekton Task Step image policies
          • Step images are valid
        • Tekton Task Step image registry policies
          • Permitted step image registry prefix list provided
          • Step images come from permitted registry
        • Tekton Task annotations
          • Task definition uses expires-on annotation in RFC3339 format
        • Tekton Task result
          • Required result defined
          • Rule data provided
        • Tekton task kind checks
          • Kind field is present in task definition
          • Task definition has expected kind
        • Trusted Artifacts Conventions
          • Parameter
          • Result
          • Workspace
      • Trusted Tasks
      • Trusting Tasks
      • Policy Bundles
      • Policy Authoring
      • Task Authoring
  • User Guide
  • Introduction
Edit this Page

Enterprise Contract User Guide

This documentation will describe how to use Enterprise Contract, particularly with Konflux CI.

See also the Konflux-CI Documentation.

Contents

  • Getting started

    • Configuration

  • How-to guides

    • Using Cosign

    • Command line EC

    • Reproducing a Konflux EC report locally

    • Using custom configuration

    • Using custom data

    • Hitchhiker’s Guide to EC

  • EC & SLSA

  • Glossary

This page was built using the Antora default UI.

The source code for this UI is licensed under the terms of the MPL-2.0 license.