docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update SSC attestations policy description

This commit is contained in:
Felipe Cruz Martinez 2024-01-19 10:51:14 +01:00 committed by GitHub
parent e10a69a3ea
commit da905e892c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
content/scout/policy/_index.md
View File

@ -165,25 +165,17 @@ The **Supply chain attestations** policy requires that your artifacts have
[provenance](../../build/attestations/slsa-provenance.md) attestations. [provenance](../../build/attestations/slsa-provenance.md) attestations.
This policy is unfulfilled if an artifact lacks either an SBOM attestation or a This policy is unfulfilled if an artifact lacks either an SBOM attestation or a
provenance attestation, or if the provenance attestation lacks information provenance attestation with max mode. To ensure compliance,
about the Git repository and base images being used. To ensure compliance,
update your build command to attach these attestations at build-time: update your build command to attach these attestations at build-time:
```console ```console
$ docker buildx build --provenance=true --sbom=true -t <IMAGE> --push . $ docker buildx build --provenance=true --sbom=true -t <IMAGE> --push .
``` ```
BuildKit automatically detects the Git repository and base images when this For more information about
information is available in the build context. For more information about
building with attestations, see building with attestations, see
[Attestations](../../build/attestations/_index.md). [Attestations](../../build/attestations/_index.md).
> **Note**
>
> Docker Scout is currently unable to discern the difference between using
> `scratch` as a base image and having no base image provenance. As a result,
> images based on `scratch` always fail the Supply chain attestations policy.
### Quality gates passed ### Quality gates passed
The Quality gates passed policy builds on the [SonarQube The Quality gates passed policy builds on the [SonarQube