Policy Types
Develocity Provenance Governor supports the following policy types:
| Policy Kind | Description |
|---|---|
|
Enforce specific build tool and version usage |
|
Control Java toolchain (JDK version/vendor) requirements |
|
Restrict dependency resolution sources |
|
Allow or block specific dependencies |
|
Enforce artifact promotion workflows |
|
Verify required attestation types exist |
|
Validate attestation signatures |
|
Evaluate VSA verification results |
-
BuildTool — Enforce constraints on the build tool used.
-
JavaToolchains — Enforce constraints on Java toolchains.
-
ResolvedDependenciesRepositories — Enforce constraints on dependency resolution repositories.
-
PackageUrl — Enforce constraints on resolved package URLs.
-
PublishRepositories — Enforce constraints on publish repositories.
-
AttestationsExist — Require specific attestations to be present.
-
TrustedPublicKeys — Enforce attestation signature verification.
-
VerificationSummary — Enforce constraints on verification summary results.