mirror of
https://github.com/kerberos-io/agent.git
synced 2026-11-05 20:20:23 +00:00
Cédric VerstraetenandCopilot App
e3acd64a57
Move container HTTP to8080, remove capabilities/curl, preserve demo UI without mutating assets, patch vulnerable Go dependencies and document migration/runtime contracts. Gate releases on source/final-image security evidence and unresolved policy exceptions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
31 lines
1.0 KiB
Python
31 lines
1.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate BuildKit provenance and retain resolved base-image materials."""
|
|
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
|
|
|
|
def materials(value):
|
|
if isinstance(value, dict):
|
|
if "uri" in value and value["uri"].startswith(("pkg:docker/", "docker-image://")):
|
|
digest = value.get("digest", {}).get("sha256", "")
|
|
if not re.fullmatch(r"[a-f0-9]{64}", digest):
|
|
raise ValueError(f"Missing base-image digest: {value['uri']}")
|
|
yield value
|
|
for child in value.values():
|
|
yield from materials(child)
|
|
elif isinstance(value, list):
|
|
for child in value:
|
|
yield from materials(child)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
directory = Path(sys.argv[1])
|
|
provenance = json.loads((directory / "provenance.json").read_text())
|
|
bases = list(materials(provenance))
|
|
if not bases:
|
|
raise SystemExit("Missing provenance/base-image materials")
|
|
(directory / "base-image-digests.json").write_text(json.dumps(bases, indent=2) + "\n")
|