From da905e892c443d52efced400c19103506a4a59cd Mon Sep 17 00:00:00 2001 From: Felipe Cruz Martinez <15997951+felipecruz91@users.noreply.github.com> Date: Fri, 19 Jan 2024 10:51:14 +0100 Subject: [PATCH] Update SSC attestations policy description --- content/scout/policy/_index.md | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/content/scout/policy/_index.md b/content/scout/policy/_index.md index 84a38b2d72..2f9f897d03 100644 --- a/content/scout/policy/_index.md +++ b/content/scout/policy/_index.md @@ -165,25 +165,17 @@ The **Supply chain attestations** policy requires that your artifacts have [provenance](../../build/attestations/slsa-provenance.md) attestations. This policy is unfulfilled if an artifact lacks either an SBOM attestation or a -provenance attestation, or if the provenance attestation lacks information -about the Git repository and base images being used. To ensure compliance, +provenance attestation with max mode. To ensure compliance, update your build command to attach these attestations at build-time: ```console $ docker buildx build --provenance=true --sbom=true -t --push . ``` -BuildKit automatically detects the Git repository and base images when this -information is available in the build context. For more information about +For more information about building with attestations, see [Attestations](../../build/attestations/_index.md). -> **Note** -> -> Docker Scout is currently unable to discern the difference between using -> `scratch` as a base image and having no base image provenance. As a result, -> images based on `scratch` always fail the Supply chain attestations policy. - ### Quality gates passed The Quality gates passed policy builds on the [SonarQube