Skip to content

feat(EC-1957): verify base image release signatures #1780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
joejstuart wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feat(EC-1957): verify base image release signatures #1780

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
769d8d6
feat(EC-1957): verify base image release signatures in base_image_reg…
joejstuart Jul 16, 2026
8fb2b7f
refactor(EC-1957): fold deprecation warning into _rule_data_errors
joejstuart Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ This package is responsible for verifying the base (parent) images reported in t
== Rules Included

[#base_image_registries__allowed_registries_provided]
=== link:#base_image_registries__allowed_registries_provided[Allowed base image registry prefixes list was provided]
=== link:#base_image_registries__allowed_registries_provided[Allowed base image registry prefixes list or release public key was provided]

Confirm the `allowed_registry_prefixes` rule data was provided, since it's required by the policy rules in this package.
Confirm that either the `allowed_registry_prefixes` or `release_public_key` rule data was provided, since at least one is required by the policy rules in this package.

*Solution*: Make sure to configure a list of trusted registries as a xref:cli:ROOT:configuration.adoc#_data_sources[data source].
Comment on lines +12 to 16

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Update all base-image documentation to reflect signature and digest paths.

The policy now accepts release_public_key and snapshot digest matches, but these descriptions and labels still direct users toward trusted registry prefixes. This can cause operators to configure the deprecated mechanism or misunderstand failures.

  • antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L12-L16: document release_public_key in the solution, not only registry prefixes.
  • antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L24-L28: rename the rule/title and solution so they cover registry, digest, and signature verification.
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L35-L38: update the minimal ruleset’s permitted-image label.
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L119-L122: update the redhat ruleset’s permitted-image label.
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L345-L348: update the redhat_security ruleset’s permitted-image label.
  • antora/docs/modules/ROOT/partials/release_policy_nav.adoc#L22-L26: update the navigation label consistently.
📍 Affects 3 files
  • antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L12-L16 (this comment)
  • antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc#L24-L28
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L35-L38
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L119-L122
  • antora/docs/modules/ROOT/pages/release_policy.adoc#L345-L348
  • antora/docs/modules/ROOT/partials/release_policy_nav.adoc#L22-L26
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc`
around lines 12 - 16, Update all specified base-image documentation to describe
registry-prefix, snapshot-digest, and release-signature verification. In
antora/docs/modules/ROOT/pages/packages/release_base_image_registries.adoc lines
12-16, include release_public_key in the solution; in lines 24-28, rename the
rule/title and solution to cover all three verification paths. Update the
permitted-image labels in antora/docs/modules/ROOT/pages/release_policy.adoc
lines 35-38, 119-122, and 345-348, and the corresponding navigation label in
antora/docs/modules/ROOT/partials/release_policy_nav.adoc lines 22-26.


Expand All @@ -23,7 +23,7 @@ Confirm the `allowed_registry_prefixes` rule data was provided, since it's requi
[#base_image_registries__base_image_permitted]
=== link:#base_image_registries__base_image_permitted[Base image comes from permitted registry]

Verify that the base images used when building a container image come from a known set of trusted registries to reduce potential supply chain attacks. By default this policy defines trusted registries as registries that are fully maintained by Red Hat and only contain content produced by Red Hat. The list of permitted registries can be customized by setting the `allowed_registry_prefixes` list in the rule data. Base images that are found in the snapshot being validated are also allowed since EC will also validate those images individually.
Verify that the base images used when building a container image are permitted. Images can be permitted in three ways: by matching a registry prefix from `allowed_registry_prefixes` rule data (deprecated), by matching a component digest in the snapshot, or by having a valid release signature verified against the `release_public_key` rule data. The preferred approach is signature-based verification via `release_public_key`. Registry prefix matching is deprecated and will be removed in a future release.

*Solution*: Make sure the image used in each task comes from a trusted registry. The list of trusted registries is a configurable xref:cli:ROOT:configuration.adoc#_data_sources[data source].

Expand All @@ -43,3 +43,15 @@ Verify the expected information was provided about which base images were used d
* FAILURE message: `Base images information is missing`
* Code: `base_image_registries.base_image_info_found`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/base_image_registries/base_image_registries.rego#L49[Source, window="_blank"]

[#base_image_registries__registry_prefix_deprecated]
=== link:#base_image_registries__registry_prefix_deprecated[Registry prefix matching is deprecated]

Using `allowed_registry_prefixes` to permit base images is deprecated. Configure `release_public_key` to verify base image release signatures instead, which provides stronger cryptographic assurance than registry prefix matching.

*Solution*: Set the `release_public_key` in rule data to enable signature-based base image verification. The key can be an inline PEM-encoded public key or a k8s:// reference to a secret containing the key.

* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `allowed_registry_prefixes is configured without release_public_key. Migrate to signature-based verification by setting release_public_key in rule data.`
* Code: `base_image_registries.registry_prefix_deprecated`
* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/base_image_registries/base_image_registries.rego#L99[Source, window="_blank"]
13 changes: 8 additions & 5 deletions antora/docs/modules/ROOT/pages/release_policy.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,10 @@ Rules included:
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_type[Attestation type: Known attestation type found]
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Attestation type: Known attestation types provided]
* xref:packages/release_attestation_type.adoc#attestation_type__pipelinerun_attestation_found[Attestation type: PipelineRun attestation found]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list or release public key was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_permitted[Base image checks: Base image comes from permitted registry]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_info_found[Base image checks: Base images provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__registry_prefix_deprecated[Base image checks: Registry prefix matching is deprecated]
* xref:packages/release_cve.adoc#cve__cve_blockers[CVE checks: Blocking CVE check]
* xref:packages/release_cve.adoc#cve__unpatched_cve_blockers[CVE checks: Blocking unpatched CVE check]
* xref:packages/release_cve.adoc#cve__cve_results_found[CVE checks: CVE scan results found]
Expand Down Expand Up @@ -75,7 +76,7 @@ Rules included:

* xref:packages/release_maven_repos.adoc#maven_repos__policy_data_missing[All maven artifacts have known repository URLs: Policy data validation]
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Attestation type: Known attestation types provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list or release public key was provided]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__disallowed_platform_patterns_pattern[Buildah build task: disallowed_platform_patterns format]
* xref:packages/release_cve.adoc#cve__rule_data_provided[CVE checks: Rule data provided]
* xref:packages/release_external_parameters.adoc#external_parameters__pipeline_run_params_provided[External parameters: PipelineRun params provided]
Expand Down Expand Up @@ -115,9 +116,10 @@ Rules included:
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_type[Attestation type: Known attestation type found]
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Attestation type: Known attestation types provided]
* xref:packages/release_attestation_type.adoc#attestation_type__pipelinerun_attestation_found[Attestation type: PipelineRun attestation found]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list or release public key was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_permitted[Base image checks: Base image comes from permitted registry]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_info_found[Base image checks: Base images provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__registry_prefix_deprecated[Base image checks: Registry prefix matching is deprecated]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__add_capabilities_param[Buildah build task: ADD_CAPABILITIES parameter]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__platform_param[Buildah build task: PLATFORM parameter]
Expand Down Expand Up @@ -340,9 +342,10 @@ Rules included:
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_type[Attestation type: Known attestation type found]
* xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Attestation type: Known attestation types provided]
* xref:packages/release_attestation_type.adoc#attestation_type__pipelinerun_attestation_found[Attestation type: PipelineRun attestation found]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Base image checks: Allowed base image registry prefixes list or release public key was provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_permitted[Base image checks: Base image comes from permitted registry]
* xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_info_found[Base image checks: Base images provided]
* xref:packages/release_base_image_registries.adoc#base_image_registries__registry_prefix_deprecated[Base image checks: Registry prefix matching is deprecated]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__add_capabilities_param[Buildah build task: ADD_CAPABILITIES parameter]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah build task: Buildah task uses a local Dockerfile]
* xref:packages/release_buildah_build_task.adoc#buildah_build_task__privileged_nested_param[Buildah build task: PRIVILEGED_NESTED parameter]
Expand All @@ -356,8 +359,8 @@ Rules included:
* xref:packages/release_git_branch.adoc#git_branch__git_branch[Git branch checks: Builds have a trusted target branch]
* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_extensions[GitHub Certificate Checks: GitHub Workflow Certificate Extensions]
* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_name[GitHub Certificate Checks: GitHub Workflow Name]
* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_ref[GitHub Certificate Checks: GitHub Workflow Repository]
* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_repository[GitHub Certificate Checks: GitHub Workflow Repository]
* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_ref[GitHub Certificate Checks: GitHub Workflow Repository]
Comment on lines 362 to +363

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Correct the workflow-reference label.

The github_certificate__gh_workflow_ref link is displayed as “GitHub Workflow Repository”; it should say “GitHub Workflow Ref” so the navigation matches its target.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@antora/docs/modules/ROOT/pages/release_policy.adoc` around lines 362 - 363,
Update the visible label for the xref targeting
github_certificate__gh_workflow_ref to “GitHub Certificate Checks: GitHub
Workflow Ref”; leave the github_certificate__gh_workflow_repository link label
unchanged.

* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_trigger[GitHub Certificate Checks: GitHub Workflow Trigger]
* xref:packages/release_github_certificate.adoc#github_certificate__rule_data_provided[GitHub Certificate Checks: Rule data provided]
* xref:packages/release_hermetic_task.adoc#hermetic_task__hermetic[Hermetic task: Task called with hermetic param set]
Expand Down
3 changes: 2 additions & 1 deletion antora/docs/modules/ROOT/partials/release_policy_nav.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,10 @@
**** xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Known attestation types provided]
**** xref:packages/release_attestation_type.adoc#attestation_type__pipelinerun_attestation_found[PipelineRun attestation found]
*** xref:packages/release_base_image_registries.adoc[Base image checks]
**** xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Allowed base image registry prefixes list was provided]
**** xref:packages/release_base_image_registries.adoc#base_image_registries__allowed_registries_provided[Allowed base image registry prefixes list or release public key was provided]
**** xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_permitted[Base image comes from permitted registry]
**** xref:packages/release_base_image_registries.adoc#base_image_registries__base_image_info_found[Base images provided]
**** xref:packages/release_base_image_registries.adoc#base_image_registries__registry_prefix_deprecated[Registry prefix matching is deprecated]
*** xref:packages/release_buildah_build_task.adoc[Buildah build task]
**** xref:packages/release_buildah_build_task.adoc#buildah_build_task__add_capabilities_param[ADD_CAPABILITIES parameter]
**** xref:packages/release_buildah_build_task.adoc#buildah_build_task__buildah_uses_local_dockerfile[Buildah task uses a local Dockerfile]
Expand Down
7 changes: 7 additions & 0 deletions example/data/rule_data.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,13 @@ rule_data:
- docker.io/
- registry.access.redhat.com

# Usage: https://conforma.dev/docs/policy/packages/release_base_image_registries.html#base_image_registries__base_image_permitted
# Verify base image release signatures. Accepts an inline PEM-encoded public key
# or a k8s:// reference to a secret (e.g., "k8s://my-namespace/my-secret").
# When set, base images with a valid release signature are permitted regardless
# of allowed_registry_prefixes.
release_public_key: "k8s://openshift-pipelines/release-signing-key"

# Usage: https://conforma.dev/docs/policy/packages/task_step_image_registries.html
allowed_step_image_registry_prefixes:
- localhost:5000/
Expand Down
63 changes: 51 additions & 12 deletions policy/release/base_image_registries/base_image_registries.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,14 @@
import data.lib.sbom

# METADATA
# title: Base image comes from permitted registry
# title: Base image is permitted
# description: >-
# Verify that the base images used when building a container image come from a known
# set of trusted registries to reduce potential supply chain attacks. By default this
# policy defines trusted registries as registries that are fully maintained by Red
# Hat and only contain content produced by Red Hat. The list of permitted registries
# can be customized by setting the `allowed_registry_prefixes` list in the rule data.
# Base images that are found in the snapshot being validated are also allowed since EC
# will also validate those images individually.
# Verify that the base images used when building a container image are permitted.
# Images can be permitted in three ways: by having a valid release signature
# verified against the `release_public_key` rule data (preferred), by matching
# a component digest in the snapshot, or by matching a registry prefix from
# `allowed_registry_prefixes` rule data (deprecated). Registry prefix matching
# is deprecated and will be removed in a future release.
# custom:
# short_name: base_image_permitted
# failure_msg: Base image %q is from a disallowed registry
Expand Down Expand Up @@ -74,10 +73,11 @@
}

# METADATA
# title: Allowed base image registry prefixes list was provided
# title: Allowed base image registry prefixes list or release public key was provided
# description: >-
# Confirm the `allowed_registry_prefixes` rule data was provided, since it's
# required by the policy rules in this package.
# Confirm that either the `allowed_registry_prefixes` or `release_public_key`
# rule data was provided, since at least one is required by the policy rules
# in this package.
# custom:
# short_name: allowed_registries_provided
# failure_msg: "%s"
Expand Down Expand Up @@ -105,6 +105,22 @@
img := image.parse(component.containerImage)
}
image.parse(image_ref).digest in allowed_digests
} else if {
key := rule_data.get(_release_key_rule_data_key)
is_string(key)
key != ""

@fullsend-ai-review fullsend-ai-review Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] configurability

ignore_rekor is hardcoded to false in ec.sigstore.verify_image options. This enforces Rekor transparency log verification, which is the correct security default, but prevents use in air-gapped environments where Rekor is unreachable.

Suggested fix: Consider adding an optional release_signature_ignore_rekor rule data key in a follow-up to allow operators to disable Rekor verification when needed, similar to how sigstore.opts exposes this setting globally.

info := ec.sigstore.verify_image(image_ref, {"public_key": key, "ignore_rekor": false})
not _has_sig_errors(info)
}

_has_sig_errors(info) if {
some _ in info.errors
}

_release_public_key_provided if {
key := rule_data.get(_release_key_rule_data_key)
is_string(key)
key != ""
}

_cyclonedx_base_images := [_cyclonedx_image_ref(component) |
Expand Down Expand Up @@ -170,8 +186,8 @@
image_ref := sbom.image_ref_from_purl(purl)
}

# Verify allowed_registry_prefixes is a non-empty list of strings
_rule_data_errors contains error if {

@fullsend-ai-review fullsend-ai-review Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] validation

When release_public_key is provided, allowed_registry_prefixes schema validation is skipped entirely. If both are configured and the prefixes are malformed, the configuration error is silently ignored.

Suggested fix: Consider validating allowed_registry_prefixes regardless of release_public_key presence, to surface configuration errors even for deprecated fields during the migration period.

not _release_public_key_provided
some e in j.validate_schema(
rule_data.get(_rule_data_key),
{
Expand All @@ -188,4 +204,27 @@
}
}

_rule_data_errors contains error if {
prefixes := rule_data.get(_rule_data_key)
count(prefixes) > 0
not _release_public_key_provided
error := {
"message": "allowed_registry_prefixes is configured without release_public_key. Migrate to signature-based verification by setting release_public_key in rule data.",

Check failure on line 212 in policy/release/base_image_registries/base_image_registries.rego

View workflow job for this annotation

GitHub Actions / all-tests-and-checks 

Line too long. To learn more, see: https://www.openpolicyagent.org/projects/regal/rules/style/line-length
"severity": "warning",
}
}

_rule_data_errors contains error if {
val := rule_data.get(_release_key_rule_data_key)
val != []
not is_string(val)
Comment on lines +217 to +220

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reject an explicitly empty-array release key.

release_public_key: [] bypasses this check because val != [] is false, despite being a present non-string value. Distinguish an absent key from a present value, then validate every present value as a string; add a regression case for [].

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@policy/release/base_image_registries/base_image_registries.rego` around lines
235 - 238, Update the _rule_data_errors rule to distinguish an absent release
key from a present value before type validation, so an explicitly provided empty
array is rejected as a non-string while a missing key remains allowed. Validate
every present release key value with the existing string check, and add a
regression case covering release_public_key: [].

msg := sprintf(
"Rule data %s has unexpected format: expected a string, got %s",
[_release_key_rule_data_key, type_name(val)],
)
error := {"message": msg, "severity": "failure"}
}

_rule_data_key := "allowed_registry_prefixes"

_release_key_rule_data_key := "release_public_key"
Loading
Loading