// Generated by conforma CLI documentation tooling. DO NOT EDIT.
= verify-conforma-konflux-ta

Version: 0.1

== Synopsis

Verify the Conforma policy is met

== Params
[horizontal]

*SNAPSHOT_FILENAME* (`string`):: The filename of the `Snapshot` that is located within the trusted artifact

*SOURCE_DATA_ARTIFACT* (`string`):: Trusted Artifact to use to obtain the Snapshot to validate.

*POLICY_CONFIGURATION* (`string`):: Name of the policy configuration (EnterpriseContractPolicy
resource) to use. `namespace/name` or `name` syntax supported. If
namespace is omitted the namespace where the task runs is used.
You can also specify a policy configuration using a git url, e.g.
`github.com/conforma/config//slsa3`.

+
*Default*: `enterprise-contract-service/default`
*PUBLIC_KEY* (`string`):: Public key used to verify traditional long-lived signatures. Must be a valid k8s cosign reference, e.g. k8s://my-space/my-secret where my-secret contains the expected cosign.pub attribute. Required for traditional signing key verification. Will be ignored if any of CERTIFICATE_IDENTITY, CERTIFICATE_IDENTITY_REGEXP, CERTIFICATE_OIDC_ISSUER, or CERTIFICATE_OIDC_ISSUER_REGEXP are provided.
*REKOR_HOST* (`string`):: Rekor host for transparency log lookups
*CERTIFICATE_IDENTITY* (`string`):: Expected identity in the signing certificate for keyless verification. This should be the email or URI that was used when signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
*CERTIFICATE_OIDC_ISSUER* (`string`):: Expected OIDC issuer in the signing certificate for keyless verification. This should match the issuer that provided the identity token used for signing. You should provide both CERTIFICATE_OIDC_ISSUER and CERTIFICATE_IDENTITY for keyless verification. The PUBLIC_KEY param will be ignored if this is provided.
*CERTIFICATE_IDENTITY_REGEXP* (`string`):: Similar to CERTIFICATE_IDENTITY but the value is a regexp that will be matched. Note that CERTIFICATE_IDENTITY takes precedence over this if both are present.
*CERTIFICATE_OIDC_ISSUER_REGEXP* (`string`):: Similar to CERTIFICATE_OIDC_ISSUER but a regexp that will be matched. Note that CERTIFICATE_OIDC_ISSUER takes precedence over this if both are present.
*IGNORE_REKOR* (`string`):: Skip Rekor transparency log checks during validation. Compatible with traditional signing secret signature checks only. If any of the CERTIFICATE_* keyless verification params are present, this value is disregarded and Rekor transparency log checks are included.
+
*Default*: `false`
*TUF_MIRROR* (`string`):: TUF mirror URL. Provide a value when NOT using public sigstore deployment.
*SSL_CERT_DIR* (`string`):: Path to a directory containing SSL certs to be used when communicating
with external services. This is useful when using the integrated registry
and a local instance of Rekor on a development cluster which may use
certificates issued by a not-commonly trusted root CA. In such cases,
`/var/run/secrets/kubernetes.io/serviceaccount` is a good value. Multiple
paths can be provided by using the `:` separator.

*CA_TRUST_CONFIGMAP_NAME* (`string`):: The name of the ConfigMap to read CA bundle data from.
+
*Default*: `trusted-ca`
*CA_TRUST_CONFIG_MAP_KEY* (`string`):: The name of the key in the ConfigMap that contains the CA bundle data.
+
*Default*: `ca-bundle.crt`
*INFO* (`string`):: Include rule titles and descriptions in the output. Set to `"false"` to disable it.
+
*Default*: `true`
*STRICT* (`string`):: Fail the task if policy fails. Set to `"false"` to disable it.
+
*Default*: `true`
*HOMEDIR* (`string`):: Value for the HOME environment variable.
+
*Default*: `/tekton/home`
*EFFECTIVE_TIME* (`string`):: Run policy checks with the provided time.
+
*Default*: `now`
*ALLOW_PAST_EFFECTIVE_TIME* (`string`):: Allow setting EFFECTIVE_TIME to a date in the past.
+
*Default*: `false`
*EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
*POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).
+
*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2`
*WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.

+
*Default*: `4`
*EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable.
*SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
+
*Default*: `false`
*SINGLE_COMPONENT_CUSTOM_RESOURCE* (`string`):: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline.

+
*Default*: `unknown`
*SINGLE_COMPONENT_CUSTOM_RESOURCE_NS* (`string`):: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled.

*ORAS_OPTIONS* (`string`):: oras options to pass to Trusted Artifacts calls
*TRUSTED_ARTIFACTS_DEBUG* (`string`):: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable.
*TRUSTED_ARTIFACTS_EXTRACT_DIR* (`string`):: Directory to use to extract trusted artifact archive.
+
*Default*: `/var/workdir/conforma`
*RETRY_DURATION* (`string`):: Base duration for exponential backoff calculation (e.g., "1s", "500ms")
+
*Default*: `1s`
*RETRY_FACTOR* (`string`):: Exponential backoff multiplier (e.g., "2.0", "1.5")
+
*Default*: `2.0`
*RETRY_JITTER* (`string`):: Randomness factor for backoff calculation (0.0-1.0, e.g., "0.1", "0.2")
+
*Default*: `0.1`
*RETRY_MAX_RETRY* (`string`):: Maximum number of retry attempts
+
*Default*: `3`
*RETRY_MAX_WAIT* (`string`):: Maximum wait time between retries (e.g., "3s", "10s")
+
*Default*: `3s`
*ENABLE_VSA* (`string`):: Enable VSA generation
+
*Default*: `false`
*ATTESTATION_FORMAT* (`string`):: Attestation format: dsse (signed envelope) or predicate (raw JSON)
+
*Default*: `dsse`
*VSA_SIGNING_KEY* (`string`):: Signing key for format=dsse (k8s:// or file:// URL)
*VSA_UPLOAD* (`string`):: VSA upload destination
+
*Default*: `local@/var/workdir/conforma/vsa`
*ociStorage* (`string`):: OCI storage URL for trusted artifacts

== Results

[horizontal]
*TEST_OUTPUT*:: Short summary of the policy evaluation for each image
*VSA_GENERATED*:: Whether VSAs were generated (true/false)
*sourceDataArtifact*:: Trusted Artifact URI containing VSA files
