Develocity Provenance Governor

kubectl --namespace develocity-provenance-governor apply -f manifest.yaml

kubectl rollout status deployment/api \
  --timeout=90s \
  --namespace develocity-provenance-governor

kubectl logs deployment/api \
  --namespace develocity-provenance-governor | grep -i license

Develocity license enabled, with license [...]
Started ProvenanceGovernor in ...

kubectl --namespace develocity-provenance-governor apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api.127.0.0.1.nip.io
spec:
  rules:
    - host: api.127.0.0.1.nip.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-http
                port:
                  number: 80
EOF

kubectl get ingress api.127.0.0.1.nip.io --namespace develocity-provenance-governor

NAME   CLASS     HOSTS                  ADDRESS      PORTS   AGE
http   traefik   api.127.0.0.1.nip.io   172.18.0.3   80      15s

curl api.127.0.0.1.nip.io -i

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 0
Expires: 0
Pragma: no-cache
Referrer-Policy: no-referrer
Www-Authenticate: Basic realm="Realm"
...

kubectl create secret generic secrets --namespace develocity-provenance-governor || true
kubectl create configmap properties --namespace develocity-provenance-governor || true
kubectl create configmap policies --namespace develocity-provenance-governor || true

kubectl edit secret secrets --namespace develocity-provenance-governor

stringData:
  develocity.instances.MY_INSTANCE.access-key: my-access-key-for-develocity

kubectl edit configmap properties --namespace develocity-provenance-governor

data:
  develocity.instances.MY_INSTANCE.uri: https://develocity.example.com

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s
kubectl logs deployment/api --namespace develocity-provenance-governor | grep -i "Develocity support enabled"

Develocity support enabled, for instance [MY_INSTANCE:https://develocity.example.com]

kubectl edit secret secrets --namespace develocity-provenance-governor

stringData:
  artifactory.instances.MY_ARTIFACTORY.access-token: my-access-token-for-artifactory

kubectl edit configmap properties --namespace develocity-provenance-governor

data:
  artifactory.instances.MY_ARTIFACTORY.uri: https://artifactory.example.com

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s
kubectl logs deployment/api --namespace develocity-provenance-governor | grep -i "Artifactory support enabled"

Artifactory support enabled, for instance [MY_ARTIFACTORY:https://artifactory.example.com]

Waiting for deployment "api" rollout to finish: 1 old replicas are pending termination...
error: timed out waiting for the condition

kubectl get pods --namespace develocity-provenance-governor

kubectl logs api-<POD_ID> --namespace develocity-provenance-governor

***************************
APPLICATION FAILED TO START
***************************

Failed to bind properties under 'artifactory.instances.INSTANCE_NAME_GOES_HERE' ... Reason: java.lang.IllegalArgumentException: uri must not be null

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s

develocity.instances.<instance-name>.uri=https://develocity.example.com (1)

develocity.instances.<instance-name>.access-key=************ (your access key here)

artifactory.instances.<instance-name>.uri=https://artifactory.example.com (1)

artifactory.instances.<instance-name>.access-token=************ (your access token here)

s3.instances.<instance-name>.region=us-east-1 (1)
s3.instances.<instance-name>.bucket-name=dpg-bucket-01 (2)

apiVersion: policy.gradle.com/v1
kind: AccessControl
metadata:
  name: admin
spec:
  identityMatchingStrategy: (1)
    withBasicIdentity:
      - withName: "admin" (2)

    withOidc:
      - withIssuerUri: https://my-oidc-issuer.example.com (3)
        withClaims: (4)
          organization: "my-org"

  canPerform:
    - publish-attestations (5)
    - publish-policy-scans (6)
    - read-attestations (7)

  withResources: (8)
    - pkg:maven/* (9)
    - dv:my-develocity (10)
    - af:my-artifactory/* (11)
    - s3:my-s3-store/* (12)

# 1. Write a policy with a label
apiVersion: policy.gradle.com/v1
kind: JavaToolchain
metadata:
  name: require-java-21
  labels:
    policy.my-corp.com/gate: production  # <-- Label
spec:
  matchingStrategy: must-match
  toolchains:
    - vendor: Eclipse Adoptium
      versions: ["21.0.5"]

# 2. Create a PolicyScanDefinition that selects policies by label
---
apiVersion: policy.gradle.com/v1
kind: PolicyScanDefinition
metadata:
  name: production-gate
spec:
  description: Policies for production deployments
  policy-selector:
    match-labels:
      policy.my-corp.com/gate: production  # <-- Selects all policies with this label

# 3. Execute the scan via API (references the PolicyScanDefinition name)
# POST /packages/maven/com.example/my-app/1.0.0/policy-scans/production-gate

apiVersion: policy.gradle.com/v1
kind: TypeOfPolicy (1)
metadata: (2)
  name: friendly-name (3)
  labels: (4)
    policy.my-corp.com/java-21: enforcement-policies
    policy.my-corp.com/owner: DevSecOps
spec:
  description: Human-readable description of the policy. (5)
  remediation: Human-readable remediation steps if the policy is violated. (6)
  matchingStrategy: must-match or none-match (7)
  resultsLabels: (8)
    policy.my-corp.com/cvss: <critical|high|medium|low> # common for vulnerability management
    policy.my-corp.com/severity: <minor|sever|warning> # common for compliance and regulatory enforcement / risk assessment
    policy.my-corp.com/dry-run: true # domain specific
    policy.my-corp.com/severity-level: <SEV-1,SEV-2,SEV-3> # common for incident management

kind: BuildTool
apiVersion: policy.gradle.com/v1
metadata:
  name: example-build-tool-policy
  labels:
    policy.my-corp.com/gate: build
  annotations:
    createdBy: admin
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Require specific build tools and versions for CI pipelines
  remediation: Use an approved build tool and version
  matchingStrategy: must-match
  buildTools:
    - toolType: gradle
      toolVersions:
        - "7.6"
        - "8.0"
      agentVersions:
        - "1.0"
        - "2.0"
    - toolType: maven
      toolVersions:
        - "3.8.6"
      agentVersions:
        - "1.0"

apiVersion: policy.gradle.com/v1
kind: JavaToolchain
metadata:
  name: none-match-oracle-java-toolchain
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Disallow Oracle Java Toolchains in builds.
  remediation: Update the Gradle build to use BellSoft Java toolchain.
  matchingStrategy: none-match
  toolchains:
  - vendor: oracle

apiVersion: policy.gradle.com/v1
kind: JavaToolchain
metadata:
  name: must-match-bellsoft-java-toolchain
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Builds must use BellSoft Java toolchains in builds.
  remediation: Update the build to use BellSoft Java toolchain.
  matchingStrategy: must-match
  toolchains:
  - vendor: BellSoft Liberica
    versions:
    - 21.0.8
    - 21.0.7
    - 21.0.6
    - 21.0.5

apiVersion: policy.gradle.com/v1
kind: ResolvedDependenciesRepositories
metadata:
  name: must-match-repositories
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Allow resolved dependencies repositories
  remediation: Remove the offending repository from build configuration
  matchingStrategy: must-match
  uris:
  - https://artifacts.example.com/maven2
  - https://repo.grdev.net/artifactory/enterprise-libs-release-candidates-local/
  - https://plugins.gradle.org/m2/
  - https://repo.grdev.net/artifactory/public

apiVersion: policy.gradle.com/v1
kind: AttestationsExist
metadata:
  name: require-build-tool-attestation
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Require Build Tool attestation to be present.
  remediation: Ensure the build publishes a Build Tool attestation.
  expectedPredicates:
  - https://gradle.com/attestation/build-tool/v1

apiVersion: policy.gradle.com/v1
kind: TrustedPublicKeys
metadata:
  name: trusted-keys
  labels:
    policy.my-corp.com/gate: build
spec:
  description: For the Java 21 toolchain, validate attestation signatures
  remediation: Make sure the attestations are signed with the expected key
  keys:
    my-signing-key: (1)
      pem: |- (2)
           -----BEGIN PUBLIC KEY-----
           MCowBQYDK2VwAyEAVzZ+Xr2RqM6RvYcOmxPADdMi7u8pJ7L8Fv6HnQz/xJg=
           -----END PUBLIC KEY-----
    my-b64-key: (3)
      pemBase64: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQVZ6WitYcjJScU02UnZZY09teFBBRGRNaTd1OHBKN0w4RnY2SG5Rei94Smc9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=

apiVersion: policy.gradle.com/v1
kind: PolicyScanDefinition
metadata:
  name: build-gate
  labels:
    policy.my-corp.com/gate: build
spec:
  description: Policy scan definition for the build gate
  policy-selector:
    match-labels:
      policy.my-corp.com/gate: build

[
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/BuildTool/only-gradle-builds",
    "policyDescription": "Ensure only Gradle is used as the build tool.",
    "policyRemediation": "Use Gradle as the build tool. Consult migration guides if necessary.",
    "attestationStoreInstance": "jfrog-artifactory:prod",
    "attestationStoreUri": "https://jfrog.example.com/artifactory/maven-releases/.evidence/maven-app-1.0.0-build-env.json",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "buildTool": "Gradle",
      "predicateType": "https://gradle.com/attestation/build-tool/v1"
    }
  },
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/TrustedPublicKeys/release-pipeline-signer",
    "policyDescription": "Verify all attestations are signed by the release pipeline's trusted key.",
    "policyRemediation": "Ensure the attestation is signed by a trusted key from the release pipeline. Re-run the build if necessary.",
    "attestationStoreInstance": "jfrog-artifactory:prod",
    "attestationStoreUri": "https://jfrog.example.com/artifactory/maven-releases/.evidence/maven-app-1.0.0-release.json",
    "sourcedFromUri": null,
    "details": {
      "signerKeyId": "abcd1234",
      "predicateType": "https://in-toto.io/Statement/v0.1"
    }
  }
]

[
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "unsatisfied",
    "policyUri": "/policies/ResolvedDependenciesRepository/disallow-untrusted-repos",
    "policyDescription": "Disallow untrusted Maven repositories.",
    "policyRemediation": "Remove 'https://untrusted.repo.com/maven2' from your build's dependency repositories.",
    "attestationStoreInstance": "jfrog-artifactory:prod",
    "attestationStoreUri": "https://jfrog.example.com/artifactory/maven-releases/.evidence/maven-app-1.0.0-build.json",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "untrustedRepository": "https://untrusted.repo.com/maven2",
      "predicateType": "https://gradle.com/attestation/resolved-dependencies/v1"
    }
  },
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/BuildTool/only-gradle-builds",
    "policyDescription": "Ensure only Gradle is used as the build tool.",
    "policyRemediation": "Use Gradle as the build tool. Consult migration guides if necessary.",
    "attestationStoreInstance": "jfrog-artifactory:prod",
    "attestationStoreUri": "https://jfrog.example.com/artifactory/maven-releases/.evidence/maven-app-1.0.0-build-env.json",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "buildTool": "Gradle",
      "predicateType": "https://gradle.com/attestation/build-tool/v1"
    }
  }
]

#!/bin/bash

# Stream results and filter for unsatisfied policies
# We use curl with 'Accept: application/x-ndjson' to fetch the results as a stream.
# jq filters the stream for any object where .status == "unsatisfied"

FAILED_POLICIES=$(curl -s --request POST \
  --url "http://dpg.example.com/packages/maven/com.example/my-app/1.0.0/policy-scans/build-gate" \
  --header "authorization: Basic ${AUTH_TOKEN}" \
  --header "Accept: application/x-ndjson" \
  --header "content-type: application/x-www-form-urlencoded" \
  --data-urlencode "sha256=..." \
  --data-urlencode "repositoryUrl=..." \
  | jq -c 'select(.status == "unsatisfied")')

if [ -n "$FAILED_POLICIES" ]; then
  echo "Policy scan FAILED. The following policies were unsatisfied:"
  echo "$FAILED_POLICIES" | jq .
  exit 1
else
  echo "Policy scan PASSED."
fi

apiVersion: policy.gradle.com/v1
kind: AccessControl
metadata:
  name: example
spec:
  identityMatchingStrategy:
    withOidc:
    - withIssuerUri: "https://token.actions.githubusercontent.com"
      withClaims:
        repository_owner: example-org

# Set up credentials
export DPG_URL="https://develocity-provenance-governor.example.com"
export DPG_AUTH=$(echo -n 'username:password' | base64)

# Publish attestations
curl -X POST "$DPG_URL/packages/maven/com.example/my-app/1.0.0/attestations" \
  -H "Authorization: Basic $DPG_AUTH" \
  -H "Content-Type: application/json" \
  -d '{
    "sha256": "73f482a2296dcc654c380979aae3916a1925ff906b1c43a0659f97fd56e44497",
    "repositoryUrl": "artifactory.example.com/maven-repo-local",
    "buildScan": {
      "ids": ["bjvognekiphus"]
    }
  }'

# Export all configurations
kubectl get configmap policies -n develocity-provenance-governor -o yaml > policies-backup.yaml
kubectl get configmap properties -n develocity-provenance-governor -o yaml > properties-backup.yaml
kubectl get secret secrets -n develocity-provenance-governor -o yaml > secrets-backup.yaml
kubectl get secret license -n develocity-provenance-governor -o yaml > license-backup.yaml

kubectl apply -f policies-backup.yaml
kubectl apply -f properties-backup.yaml
kubectl apply -f secrets-backup.yaml
kubectl apply -f license-backup.yaml
kubectl rollout restart deployment/api -n develocity-provenance-governor

***************************
APPLICATION FAILED TO START
***************************

Description:

Failed to bind properties under 'develocity' to com.gradle.cavendish.dv.DevelocityProperties:

    Reason: java.lang.IllegalArgumentException: No develocity.license provided in configuration.

Action:

Update your application's configuration

***************************
APPLICATION FAILED TO START
***************************

Description:

Failed to bind properties under 'develocity' to com.gradle.cavendish.dv.DevelocityProperties:

    Reason: java.lang.IllegalArgumentException: Develocity Access Key `develocity.instances.grdev.access-key` must have text

Action:

Update your application's configuration

2025-10-16T17:51:58.967-06:00 ERROR 70284 --- [ctor-http-nio-2] c.g.c.dv.DevelocityAccessTokenManager    : Error refreshing access tokens

org.springframework.web.reactive.function.client.WebClientResponseException$Unauthorized: 401 Unauthorized from POST https://develocity.grdev.net/api/auth/token
	...

2025-10-16T17:51:58.098-06:00  INFO 70284 --- [  restartedMain] c.g.c.p.PolicyScanDefinitionEvaluator    : Policy Scan support enabled for [java-21-toolchain] including policy [none-match-oracle-java-toolchain]
2025-10-16T17:51:58.098-06:00  INFO 70284 --- [  restartedMain] c.g.c.p.PolicyScanDefinitionEvaluator    : Policy Scan support enabled for [java-21-toolchain] including policy [must-match-bellsoft-java-toolchain]
2025-10-16T17:51:58.099-06:00  INFO 70284 --- [  restartedMain] c.g.c.p.PolicyScanDefinitionEvaluator    : Policy Scan support enabled for [java-21-toolchain] including policy [purls-none-match-lombok]
2025-10-16T17:51:58.099-06:00  INFO 70284 --- [  restartedMain] c.g.c.p.PolicyScanDefinitionEvaluator    : Policy Scan support enabled for [java-21-toolchain] including policy [none-match-purl-spring-beans-6.2.7]
2025-10-16T17:51:58.100-06:00  INFO 70284 --- [  restartedMain] c.g.c.p.PolicyScanDefinitionEvaluator    : Policy Scan support enabled for [java-21-toolchain] including policy [must-match-repositories]