5.2 Attest + Conforma
On this page you tighten policy until a known-bad image fails and the signed application image passes. Conforma is the Enterprise Contract CLI ec.
Why this control exists
A signature alone is not a release policy. Conforma evaluates the attestation and signature against rules you can show a customer. Admission later refuses what policy rejects.
Learning objectives
-
Name Conforma /
ecas the policy CLI -
Run a validate against the signed digest when
ecis on the workstation -
State that the ACS image scan on this hub does not block the deploy
Your change
If ec is installed on the workstation used for prep, run validate against the same digest you verified with cosign. During the spoken walk, open the pipeline logs that already show sign and optional policy steps.
Do not say the scan blocks the deploy. On this hub the ACS scan is evidence, not a gate in the PipelineRun success criteria.
Check
# When ec is available on the workstation:
# ec validate image --image IMAGE@sha256:DIGEST ...
cosign verify --allow-insecure-registry \
--rekor-url "https://REKOR_HOST" \
--certificate-identity-regexp ".*" \
--certificate-oidc-issuer "https://kubernetes.default.svc" \
IMAGE@sha256:DIGESTExpect verify to pass. Treat a failing ec policy against an unsigned test image as the contrast when you rehearse offline.