-
Bug
-
Resolution: Done
-
Blocker
-
None
-
ACM 2.14.0
Description of problem:
There are many failures. Make sure you have attempted a build with updated pipelines
Some violations are
✕ [Violation] labels.disallowed_inherited_labels
ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
Reason: The "summary" label should not be inherited from the parent image
Term: summary
Title: Disallowed inherited labels
Description: Check that certain labels on the image have different values than the labels from the parent image. If the label is
inherited from the parent image but not redefined for the image, it will contain an incorrect value for the image. Use the rule
data `disallowed_inherited_labels` key to set the list of labels to check, or the `fbc_disallowed_inherited_labels` key for fbc
images. To exclude this rule add "labels.disallowed_inherited_labels:summary" to the `exclude` section of the policy
configuration.
Solution: Update the image build process to overwrite the inherited labels.
✕ [Violation] slsa_build_scripted_build.image_built_by_trusted_task
ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
Reason: Image
"quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d"
not built by a trusted task: Build Task(s) "build-image-index,buildah-remote-oci-ta" are not trusted
Title: Image built by trusted Task
Description: Verify the digest of the image being validated is reported by a trusted Task in its IMAGE_DIGEST result. To exclude
this rule add "slsa_build_scripted_build.image_built_by_trusted_task" to the `exclude` section of the policy configuration.
Solution: Make sure the build Pipeline definition uses a trusted Task to build images.
✕ [Violation] source_image.exists
ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
Reason: No source image references found
Title: Exists
Description: Verify the source container image exists. To exclude this rule add "source_image.exists" to the `exclude` section
of the policy configuration.
✕ [Violation] tasks.required_tasks_found
ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
Reason: One of "buildah", "buildah-10gb", "buildah-6gb", "buildah-8gb", "buildah-remote", "buildah-oci-ta",
"buildah-remote-oci-ta" tasks is missing
Terms: buildah, buildah-10gb, buildah-6gb, buildah-8gb, buildah-remote, buildah-oci-ta, buildah-remote-oci-ta
Title: All required tasks were included in the pipeline
Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add one or
more of "tasks.required_tasks_found:buildah", "tasks.required_tasks_found:buildah-10gb",
"tasks.required_tasks_found:buildah-6gb", "tasks.required_tasks_found:buildah-8gb", "tasks.required_tasks_found:buildah-remote",
"tasks.required_tasks_found:buildah-oci-ta", "tasks.required_tasks_found:buildah-remote-oci-ta" to the `exclude` section of the
policy configuration.
Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as
https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'.
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
- ...