Develocity Provenance Governor

kubectl --namespace develocity-provenance-governor apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api.127.0.0.1.nip.io
spec:
  rules:
    - host: api.127.0.0.1.nip.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-http
                port:
                  number: 80
EOF

kubectl get ingress api.127.0.0.1.nip.io --namespace develocity-provenance-governor

NAME   CLASS     HOSTS                  ADDRESS      PORTS   AGE
http   traefik   api.127.0.0.1.nip.io   172.18.0.3   80      15s

curl api.127.0.0.1.nip.io -i

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 0
Expires: 0
Pragma: no-cache
Referrer-Policy: no-referrer
Www-Authenticate: Basic realm="Realm"
...

kubectl --namespace develocity-provenance-governor apply -f manifest.yaml

kubectl rollout status deployment/api \
  --timeout=90s \
  --namespace develocity-provenance-governor

kubectl logs deployment/api \
  --namespace develocity-provenance-governor | grep -i license

Develocity license enabled, with license [...]
Started ProvenanceGovernor in ...

kubectl create secret generic secrets --namespace develocity-provenance-governor || true
kubectl create configmap properties --namespace develocity-provenance-governor || true
kubectl create configmap policies --namespace develocity-provenance-governor || true

kubectl edit secret secrets --namespace develocity-provenance-governor

stringData:
  develocity.instances.MY_INSTANCE.access-key: my-access-key-for-develocity

kubectl edit configmap properties --namespace develocity-provenance-governor

data:
  develocity.instances.MY_INSTANCE.uri: https://develocity.example.com

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s
kubectl logs deployment/api --namespace develocity-provenance-governor | grep -i "Develocity support enabled"

Develocity support enabled, for instance [MY_INSTANCE:https://develocity.example.com]

kubectl edit secret secrets --namespace develocity-provenance-governor

stringData:
  artifactory.instances.MY_ARTIFACTORY.access-token: my-access-token-for-artifactory

kubectl edit configmap properties --namespace develocity-provenance-governor

data:
  artifactory.instances.MY_ARTIFACTORY.uri: https://artifactory.example.com

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s
kubectl logs deployment/api --namespace develocity-provenance-governor | grep -i "Artifactory support enabled"

Artifactory support enabled, for instance [MY_ARTIFACTORY:https://artifactory.example.com]

Waiting for deployment "api" rollout to finish: 1 old replicas are pending termination...
error: timed out waiting for the condition

kubectl get pods --namespace develocity-provenance-governor

kubectl logs api-<POD_ID> --namespace develocity-provenance-governor

***************************
APPLICATION FAILED TO START
***************************

Failed to bind properties under 'artifactory.instances.INSTANCE_NAME_GOES_HERE' ... Reason: java.lang.IllegalArgumentException: uri must not be null

kubectl rollout restart deployment/api --namespace develocity-provenance-governor
kubectl rollout status deployment/api --namespace develocity-provenance-governor --timeout=90s

develocity.instances.<instance-name>.uri=https://develocity.example.com (1)

develocity.instances.<instance-name>.access-key=************ (your access key here)

artifactory.instances.<instance-name>.uri=https://artifactory.example.com (1)

artifactory.instances.<instance-name>.access-token=************ (your access token here)

s3.instances.<instance-name>.region=us-east-1 (1)
s3.instances.<instance-name>.bucket-name=dpg-bucket-01 (2)

apiVersion: policy.gradle.com/v1
kind: AccessControl
metadata:
  name: admin
spec:
  identityMatchingStrategy: (1)
    withBasicIdentity:
      - withName: "admin" (2)

    withOidc:
      - withIssuerUri: https://my-oidc-issuer.example.com (3)
        withClaims: (4)
          organization: "my-org"

  canPerform:
    - publish-attestations (5)
    - publish-policy-scans (6)
    - read-attestations (7)

  withResources: (8)
    - pkg:maven/* (9)
    - dv:my-develocity (10)
    - af:my-artifactory/* (11)
    - s3:my-s3-store/* (12)

# 1. Write a policy with a label
apiVersion: policy.gradle.com/v1
kind: JavaToolchains
metadata:
  name: require-java-21
  labels:
    policy.my-corp.com/gate: production  # <-- Label
spec:
  matchingStrategy: must-match
  toolchains:
    - vendor: Eclipse Adoptium
      versions: ["21.0.5"]

# 2. Create a PolicyScanDefinition that selects policies by label
---
apiVersion: policy.gradle.com/v1
kind: PolicyScanDefinition
metadata:
  name: production-gate
spec:
  description: Policies for production deployments
  policy-selector:
    match-labels:
      policy.my-corp.com/gate: production  # <-- Selects all policies with this label

# 3. Execute the scan via API (references the PolicyScanDefinition name)
# POST /packages/maven/com.example/my-app/1.0.0/policy-scans/production-gate

apiVersion: policy.gradle.com/v1
kind: TypeOfPolicy (1)
metadata: (2)
  name: friendly-name (3)
  labels: (4)
    policy.my-corp.com/gate: build
    policy.my-corp.com/owner: DevSecOps
spec:
  description: Human-readable description of the policy. (5)
  remediation: Human-readable remediation steps if the policy is violated. (6)
  matchingStrategy: must-match or none-match (7)
  resultsLabels: (8)
    policy.my-corp.com/cvss: <critical|high|medium|low> # common for vulnerability management
    policy.my-corp.com/severity: <minor|sever|warning> # common for compliance and regulatory enforcement / risk assessment
    policy.my-corp.com/dry-run: true # domain specific
    policy.my-corp.com/severity-level: <SEV-1,SEV-2,SEV-3> # common for incident management

kind: BuildTool
apiVersion: policy.gradle.com/v1
metadata:
  name: example-build-tool-policy
  labels:
    policy.my-corp.com/gate: build
  annotations:
    createdBy: admin
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Require specific build tools and versions for CI pipelines
  remediation: Use an approved build tool and version
  matchingStrategy: must-match
  buildTools:
    - toolType: gradle
      toolVersions:
        - "7.6"
        - "8.0"
      agentVersions:
        - "1.0"
        - "2.0"
    - toolType: maven
      toolVersions:
        - "3.8.6"
      agentVersions:
        - "1.0"

apiVersion: policy.gradle.com/v1
kind: JavaToolchains
metadata:
  name: none-match-oracle-java-toolchain
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Disallow Oracle Java Toolchains in builds.
  remediation: Update the Gradle build to use BellSoft Java toolchain.
  matchingStrategy: none-match
  toolchains:
  - vendor: oracle

apiVersion: policy.gradle.com/v1
kind: JavaToolchains
metadata:
  name: must-match-bellsoft-java-toolchain
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Builds must use BellSoft Java toolchains in builds.
  remediation: Update the build to use BellSoft Java toolchain.
  matchingStrategy: must-match
  toolchains:
  - vendor: BellSoft Liberica
    versions:
    - 21.0.8
    - 21.0.7
    - 21.0.6
    - 21.0.5

apiVersion: policy.gradle.com/v1
kind: ResolvedDependenciesRepositories
metadata:
  name: must-match-repositories
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Allow resolved dependencies repositories
  remediation: Remove the offending repository from build configuration
  matchingStrategy: must-match
  uris:
  - https://artifacts.example.com/maven2
  - https://repo.example.com/artifactory/libs-release-candidates-local/
  - https://plugins.gradle.org/m2/
  - https://repo.example.com/artifactory/public

apiVersion: policy.gradle.com/v1
kind: AttestationsExist
metadata:
  name: require-build-tool-attestation
  labels:
    policy.my-corp.com/gate: build
spec:
  resultsLabels:
    policy.my-corp.com/gate: build
  description: Require Build Tool attestation to be present.
  remediation: Ensure the build publishes a Build Tool attestation.
  expectedPredicates:
  - https://gradle.com/attestation/build-tool/v1

apiVersion: policy.gradle.com/v1
kind: AttestationsExist
metadata:
  name: require-verification-summary-attestation
  labels:
    policy.my-corp.com/gate: production
spec:
  resultsLabels:
    policy.my-corp.com/gate: production
  description: Require Verification Summary attestation (VSA) to be present.
  remediation: Ensure the package has passed a policy scan which generates a VSA.
  expectedPredicates:
  - https://slsa.dev/verification_summary/v1

apiVersion: policy.gradle.com/v1
kind: TrustedPublicKeys
metadata:
  name: trusted-keys
  labels:
    policy.my-corp.com/gate: build
spec:
  description: For the Java 21 toolchain, validate attestation signatures
  remediation: Make sure the attestations are signed with the expected key
  keys:
    my-signing-key: (1)
      pem: |- (2)
           -----BEGIN PUBLIC KEY-----
           MCowBQYDK2VwAyEAVzZ+Xr2RqM6RvYcOmxPADdMi7u8pJ7L8Fv6HnQz/xJg=
           -----END PUBLIC KEY-----
    my-b64-key: (3)
      pemBase64: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQVZ6WitYcjJScU02UnZZY09teFBBRGRNaTd1OHBKN0w4RnY2SG5Rei94Smc9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=

apiVersion: policy.gradle.com/v1
kind: PolicyScanDefinition
metadata:
  name: build-gate
  labels:
    policy.my-corp.com/gate: build
spec:
  description: Policy scan definition for the build gate
  policy-selector:
    match-labels:
      policy.my-corp.com/gate: build

[
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/BuildTool/only-gradle-builds",
    "policyDescription": "Ensure only Gradle is used as the build tool.",
    "policyRemediation": "Use Gradle as the build tool. Consult migration guides if necessary.",
    "attestationUri": "/packages/maven/com.example/my-app/1.0.0/sha256:73f482a2296dcc654c380979aae3916a1925ff906b1c43a0659f97fd56e44497/attestations/jfrog-artifactory:prod/maven-app-1.0.0-build-env",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "buildTool": "Gradle",
      "predicateType": "https://gradle.com/attestation/build-tool/v1"
    }
  },
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/TrustedPublicKeys/release-pipeline-signer",
    "policyDescription": "Verify all attestations are signed by the release pipeline's trusted key.",
    "policyRemediation": "Ensure the attestation is signed by a trusted key from the release pipeline. Re-run the build if necessary.",
    "attestationUri": "/packages/maven/com.example/my-app/1.0.0/sha256:73f482a2296dcc654c380979aae3916a1925ff906b1c43a0659f97fd56e44497/attestations/jfrog-artifactory:prod/maven-app-1.0.0-release",
    "sourcedFromUri": null,
    "details": {
      "keyIds": ["abcd1234"],
      "predicateType": "https://in-toto.io/Statement/v0.1"
    }
  }
]

[
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "unsatisfied",
    "policyUri": "/policies/ResolvedDependenciesRepositories/disallow-untrusted-repos",
    "policyDescription": "Disallow untrusted Maven repositories.",
    "policyRemediation": "Remove 'https://untrusted.repo.com/maven2' from your build's dependency repositories.",
    "attestationUri": "/packages/maven/com.example/my-app/1.0.0/sha256:73f482a2296dcc654c380979aae3916a1925ff906b1c43a0659f97fd56e44497/attestations/jfrog-artifactory:prod/maven-app-1.0.0-build",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "uris": ["https://untrusted.repo.com/maven2"],
      "predicateType": "https://gradle.com/attestation/resolved-dependencies-repositories/v1"
    }
  },
  {
    "labels": {
      "policy.my-corp.com/gate": "build"
    },
    "status": "satisfied",
    "policyUri": "/policies/BuildTool/only-gradle-builds",
    "policyDescription": "Ensure only Gradle is used as the build tool.",
    "policyRemediation": "Use Gradle as the build tool. Consult migration guides if necessary.",
    "attestationUri": "/packages/maven/com.example/my-app/1.0.0/sha256:73f482a2296dcc654c380979aae3916a1925ff906b1c43a0659f97fd56e44497/attestations/jfrog-artifactory:prod/maven-app-1.0.0-build-env",
    "sourcedFromUri": "https://develocity.example.com/s/abcdef1234567",
    "details": {
      "buildTool": "Gradle",
      "predicateType": "https://gradle.com/attestation/build-tool/v1"
    }
  }
]

#!/bin/bash

# Stream results and filter for unsatisfied policies
# We use curl with 'Accept: application/x-ndjson' to fetch the results as a stream.
# jq filters the stream for any object where .status == "unsatisfied"

FAILED_POLICIES=$(curl -s --request POST \
  --url "https://provenance-governor.example.com/packages/maven/com.example/my-app/1.0.0/policy-scans/build-gate" \
  --header "authorization: Basic ${AUTH_TOKEN}" \
  --header "Accept: application/x-ndjson" \
  --header "content-type: application/x-www-form-urlencoded" \
  --data-urlencode "sha256=a30f98e704871a244ac3f28c2ada5c120afe756e981438f221e21fff3042a11b" \
  --data-urlencode "repositoryUrl=repo.example.com/docker-trial" \
  | jq -c 'select(.status == "unsatisfied")')

if [ -n "$FAILED_POLICIES" ]; then
  echo "Policy scan FAILED. The following policies were unsatisfied:"
  echo "$FAILED_POLICIES" | jq .
  exit 1
else
  echo "Policy scan PASSED."
fi

apiVersion: policy.gradle.com/v1
kind: AccessControl
metadata:
  name: example
spec:
  identityMatchingStrategy:
    withOidc:
    - withIssuerUri: "https://token.actions.githubusercontent.com"
      withClaims:
        repository_owner: example-org