From 941f34e0f3ca8023e5d2f1eade13365df2506ae8 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Fri, 22 May 2026 14:25:02 +0200 Subject: [PATCH 1/9] initial draft of new GitHub Policies --- docs/_data/editions.yml | 2 +- docs/_data/pipeline-policy-schemas/github.yml | 128 ++++++++++++++++++ docs/_includes/render-github-policies.html | 108 +++++++++++++++ docs/trusted-build-systems/github.md | 99 +++++++------- 4 files changed, 284 insertions(+), 53 deletions(-) create mode 100644 docs/_data/pipeline-policy-schemas/github.yml create mode 100644 docs/_includes/render-github-policies.html diff --git a/docs/_data/editions.yml b/docs/_data/editions.yml index 46bf9787..3c2af901 100644 --- a/docs/_data/editions.yml +++ b/docs/_data/editions.yml @@ -248,7 +248,7 @@ origin_verification-hint: Not supported by crypto providers origin_policies: true build_validation: true - extended_policies: true + extended_policies: false user_management: sso: true scim: true diff --git a/docs/_data/pipeline-policy-schemas/github.yml b/docs/_data/pipeline-policy-schemas/github.yml new file mode 100644 index 00000000..5e436140 --- /dev/null +++ b/docs/_data/pipeline-policy-schemas/github.yml @@ -0,0 +1,128 @@ +rules: + - type: creation + description: "Only allow users with bypass permission to create matching refs." + - type: update + description: "Only allow users with bypass permission to update matching refs." + - type: deletion + description: "Only allow users with bypass permissions to delete matching refs." + - type: required_linear_history + description: "Prevent merge commits from being pushed to matching refs." + - type: pull_request + description: "Require all commits be made to a non-target branch and submitted via a pull request before they can be merged." + parameters: + dismiss_stale_reviews_on_push: + description: "New, reviewable commits pushed will dismiss previous pull request review approvals." + method: equals + type: boolean + required: true + require_code_owner_review: + description: "Require an approving review in pull requests that modify files that have a designated code owner." + method: equals + type: boolean + required: true + require_last_push_approval: + description: "Whether the most recent reviewable push must be approved by someone other than the person who pushed it." + method: equals + type: boolean + required: true + required_approving_review_count: + description: "The number of approving reviews that are required before a pull request can be merged." + method: min + type: integer + required: true + required_review_thread_resolution: + description: "All conversations on code must be resolved before a pull request can be merged." + method: equals + type: boolean + required: true + - type: non_fast_forward + description: "Prevent users with push access from force pushing to refs." + - type: code_scanning + description: "Choose which tools must provide code scanning results before the reference is updated. When configured, code scanning must be enabled and have results for both the commit and the reference being updated." + parameters: + code_scanning_tools: + description: "Tools that must provide code scanning results for this rule to pass." + method: all_of + type: object array + required: true + properties: + alerts_threshold: + description: > + The severity level at which code scanning results that raise alerts block a reference update. For more information on alert severity levels, see "[About code scanning alerts](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels)." + method: min + type: enum + required: true + policy_type: array + enum: + - none + - errors + - errors_and_warnings + - all + security_alerts_threshold: + description: > + The severity level at which code scanning results that raise security alerts block a reference update. For more information on security severity levels, see "[About code scanning alerts](https://docs.github.com/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels)." + method: min + type: enum + required: true + policy_type: array + enum: + - none + - critical + - high_or_higher + - medium_or_higher + - all + tool: + description: "The name of a code scanning tool" + method: one_of + type: string + required: true + policy_type: array + +# new rules added in v2 - no tests yet + - type: required_signatures + description: "Require commits to be signed with a GPG key that is verified by GitHub." + - type: file_path_restriction + description: "Prevent commits that include changes in specified file and folder paths from being pushed to the commit graph. This includes absolute paths that contain file names." + parameters: + restricted_file_paths: + description: "The file paths that are restricted from being pushed to the commit graph." + method: all_of + type: string array + required: true + - type: file_extension_restriction + description: "Prevent commits that include files with specified file extensions from being pushed to the commit graph." + parameters: + restricted_file_extensions: + description: "The file extensions that are restricted from being pushed to the commit graph." + method: all_of + type: string array + required: true + - type: max_file_path_length + description: "Prevent commits that include file paths that exceed the specified character limit from being pushed to the commit graph." + parameters: + max_file_path_length: + description: "The maximum amount of characters allowed in file paths." + method: max + type: integer + required: true + - type: max_file_size + description: "Prevent commits with individual files that exceed the specified limit from being pushed to the commit graph." + parameters: + max_file_size: + description: "The maximum file size allowed in megabytes. This limit does not apply to Git Large File Storage (Git LFS)." + method: max + type: integer + required: true + - type: copilot_code_review + description: "Request Copilot code review for new pull requests automatically if the author has access to Copilot code review and their premium requests quota has not reached the limit." + parameters: + review_draft_pull_requests: + description: "Copilot automatically reviews draft pull requests before they are marked as ready for review." + method: equals + type: boolean + required: false + review_on_push: + description: "Copilot automatically reviews each new push to the pull request." + method: equals + type: boolean + required: false \ No newline at end of file diff --git a/docs/_includes/render-github-policies.html b/docs/_includes/render-github-policies.html new file mode 100644 index 00000000..4a7863f6 --- /dev/null +++ b/docs/_includes/render-github-policies.html @@ -0,0 +1,108 @@ + +{% if include.schema == nil or include.schema.rules == nil %} +
Error: schema argument missing or invalid
+{% endif %} + + + + + + + + + + + {%- for rule in include.schema.rules -%} + + + + + + {%- endfor -%} + +
TypeParametersDescription
{%- if rule.parameters -%}{%- endif -%}{{ rule.type }}{%- if rule.parameters -%}{%- endif -%}{%- if rule.parameters -%}Yes{%- endif -%}{{ rule.description }}
+ +{%- for rule in include.schema.rules -%} +{%- if rule.parameters -%} +
{{ rule.type }}
+

{{ rule.description }}

+{%- assign has_properties = false -%} +{%- for param in rule.parameters -%} + {%- if param[1].properties -%} + {%- assign has_properties = true -%} + {%- endif -%} +{%- endfor -%} +The following parameters are supported: + + + + + + {%- if has_properties -%} + + {%- endif -%} + + + + {%- for param in rule.parameters -%} + + + + {%- if has_properties -%} + + {%- endif -%} + + {%- endfor -%} + +
ParameterDescriptionProperties
{{ param[0]}}
({{ param[1].type }}{%- if param[1].required -%}; required{%- endif -%})		{{ param[1].description}} + {%- if param[1].properties -%} + + + + + + + + + + {%- for prop in param[1].properties -%} + + + + + + {%- endfor -%} + +
PropertyValuesDescription
{{ prop[0] }}{%- if prop[1].required -%}
(required){%- endif -%}		 + {%- if prop[1].type == 'enum' -%} + one of +
    + {%- for enum in prop[1].enum -%} +
  • {{ enum }}
    • + {%- endfor -%} +
+ {%- else -%} + {{ prop[1].type }} + {%- endif -%} + 		{{ prop[1].description }} +
+ {%- else -%} + – + {%- endif -%} +
+Example: +
+```yaml + github-scm-policies: + ruleset_constraints: + rules: + - type: {{ rule.type }}{% if rule.parameters %} + parameters: {% for param in rule.parameters %} + {{ param[0] }}: {% case param[1].type %}{% when "boolean" %}true{% when "integer" %}1{% when "string array" %} + - value{% when "object array" %} + - {% for prop in param[1].properties %}{{ prop[0] }}: {% case prop[1].type %}{% when "enum" %}{{ prop[1].enum | last }}{% when "string" %}value{% endcase %} + {% endfor %}{% endcase %}{% endfor %}{% endif %} +``` +
+{%- endif -%} +{%- endfor -%} \ No newline at end of file diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index a8370189..76bbfb55 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -115,15 +115,11 @@ The action supports the following output parameters: - `signing-request-web-url`: URL of the signing request in SignPath - `signed-artifact-download-url`: download URL of the signed artifact -## Define policies for source code and builds +## Policies {% include editions.md feature="pipeline_integrity.extended_policies" %} -You can define specific source code and build policies for your repository per signing policy: - -* `runners`: define which runners may be used by GitHub Actions -* `build`: define conditions for GitHub Actions workflows and runs -* `branch_rulesets`: define minimum requirements for branch rulesets including conditions for integrity, reviews, and code scanning +You can define pipeline policies that restrict source code and build settings. Steps to create a policy file: @@ -131,36 +127,57 @@ Steps to create a policy file: * name it `.signpath/policies//.yml` * restrict write permissions to the policy files using GitHub's [code owners] feature -### Policy sections +There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#github-actions-policies) and [GitHub's source code management system](#github-scm-policies). -#### `runners` section +### Example -Use the `runners` section to define which runners may be used in the workflow run. +```yaml +github-actions-policies: + disallow_reruns: false + runners: + require_github_hosted: true + allowed_groups: + - Hardened Runners + +github-scm-policies: + ruleset_constraints: + - enforced_from: 2025-01-01 + allow_bypass_actors: true + rules: + - type: non_fast_forward + - type: pull_request + parameters: + required_approving_review_count: 2 + require_last_push_approval: true +``` -{%- include render-table.html table=site.data.tables.trusted-build-systems.github-extended-policies-runners -%} -#### `build` section +### `github-actions-policies` -Use the `build` section to configure rules for the build run. +Allows to restrict the GitHub Actions build with the following policies: -{%- include render-table.html table=site.data.tables.trusted-build-systems.github-extended-policies-build -%} +| Top-Level Policy | Description +|-------------------|------------------------- +| `disallow_reruns` | Set to `true` to prevent signing builds from re-runs. By enforcing this policy, old, temporarily failed builds cannot be re-run and signed under the false impression that they include recent changes, such as vulnerability fixes. These builds would still be identified by their branch name, e.g. `main`. +| `runners` | Runner-specific settings, see table below. -#### `branch_rulesets` section {#branch_rulesets} +#### `runners` section -Use the `branch_rulests` section to configure conditions for [GitHub branch rulesets]. +| Policy | Description +|--------------------------|------------------- +| `required_github_hosted` | Set to `true` to ensure that all jobs of the workflow are executed on Github-hosted runners. +| `alllowed_groups` | Provide a list of GitHub runner group names. Ensures that all jobs of the workflow are executed on runners from one of the listed groups. -* You can configure branch rulesets in GitHub on an organization or repository level. SignPath verifies that there is at least one branch ruleset for each specified condition. -* Rules define minimum requirements that may be exceeded by the actual branch ruleset. +### `github-scm-policies` -##### How `branch_rulesets` conditions are evaluated +Allows to define `ruleset_constraints` for [GitHub branch rulesets]. All specified constraints must be covered by one or multiple active branch rulesets defined in GitHub. Multiple `ruleset_constraints` with different parameters can be defined. -You can group your policy requirements into multiple conditions, each containing a combination of rules, bypassers, and enforcement date: +#### General parameters for `ruleset_constraints` -| Section | Values | Description +| Parameter | Values | Description |-------------------------|--------------------------------|---------------------------- -| `rules` | See below | Rules that must be implemented by one ore more active branch rulesets | `allow_bypass_actors` | boolean | If `true`, the branch ruleset is allowed to define bypassers -| `enforced_from` | None, timestamp, or `EARLIEST` | By default, the rules are only evaluated at the time of signing. When provided, defines that these rules must have been in place from the specified date (YAML ISO timestamp) or earliest availability of audit log entries (`EARLIEST`). +| `enforced_from` | None, timestamp, or `EARLIEST` | By default, the constraints are only evaluated at the time of signing. When `enforced_from` is set, the constraints must have been continously fulfilled from the specified date (YAML ISO timestamp) or earliest availability of audit log entries (`EARLIEST`). {:.panel.info} > **About `enforced_from` evaluation** @@ -170,40 +187,18 @@ You can group your policy requirements into multiple conditions, each containing > * **Audit log events** for _GitHub Enterprise_ subscriptions. Audit log events are only available for the last 180 days, any prior policy violations will not be detected. > * The **last modified date** of the branch rulesets for all other subscriptions. At least one branch ruleset that has not been modified since the specified timestap must implement the rule. -##### Available `branch_rulesets` rules +TODO: better explain relation between GitHub branch rulesets and ruleset constraints -{%- include render-table.html table=site.data.tables.trusted-build-systems.github-extended-policies-branch-ruleset-rules -%} +#### Supported rules -### Example +The following rules are supported: -```yaml -# .signpath/policies/my-project-slug/release-signing.yml +{%- include render-github-policies.html schema=site.data.pipeline-policy-schemas.github -%} -github-policies: - runners: - allowed_groups: - - 'MySecureRunners' # all jobs need to run on runners in the specified group - build: - disallow_reruns: true - branch_rulesets: - - condition: - rules: - - block_force_pushes: # force pushes are prevented - - require_pull_request: # code reviews are required - min_required_approvals: 1 - require_code_owner_review: true - allow_bypass_actors: false # no-one is allowed to bypass this rule - enforced_from: EARLIEST # rule enforcement history is checked - - condition: - rules: - - require_code_scanning: # code scanning must not reveal problems - tools: - - tool: CodeQL - min_alerts_threshold: errors - min_security_alerts_threshold: medium - allow_bypass_actors: true # some people may bypass these rules - enforced_from: '2025-01-01 00:00' # had to be reset at some point -``` +TODO: What does the `policy_type: array` mean (e.g. for code scanning tool) +TODO: Provide sample values for integers and strings? (e.g. not `value`) +TODO: Why are all the pull request parameters required? +TODO: Explain min/max [code owners]: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners [GitHub branch rulesets]: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets From 98a9e17beb8aae69f92be95a95bf94459f501833 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Sun, 14 Jun 2026 20:11:53 +0200 Subject: [PATCH 2/9] github policy changes - go through schema is missing --- docs/_data/pipeline-policy-schemas/github.yml | 15 ++-- docs/_includes/render-github-policies.html | 21 +++--- docs/trusted-build-systems/github.md | 75 +++++++++++++++---- 3 files changed, 81 insertions(+), 30 deletions(-) diff --git a/docs/_data/pipeline-policy-schemas/github.yml b/docs/_data/pipeline-policy-schemas/github.yml index 5e436140..4c5f94cc 100644 --- a/docs/_data/pipeline-policy-schemas/github.yml +++ b/docs/_data/pipeline-policy-schemas/github.yml @@ -14,27 +14,27 @@ rules: description: "New, reviewable commits pushed will dismiss previous pull request review approvals." method: equals type: boolean - required: true + required: false require_code_owner_review: description: "Require an approving review in pull requests that modify files that have a designated code owner." method: equals type: boolean - required: true + required: false require_last_push_approval: description: "Whether the most recent reviewable push must be approved by someone other than the person who pushed it." method: equals type: boolean - required: true + required: false required_approving_review_count: description: "The number of approving reviews that are required before a pull request can be merged." method: min type: integer - required: true + required: false required_review_thread_resolution: description: "All conversations on code must be resolved before a pull request can be merged." method: equals type: boolean - required: true + required: false - type: non_fast_forward description: "Prevent users with push access from force pushing to refs." - type: code_scanning @@ -77,6 +77,7 @@ rules: type: string required: true policy_type: array + sample: CodeQL # new rules added in v2 - no tests yet - type: required_signatures @@ -89,6 +90,7 @@ rules: method: all_of type: string array required: true + sample: "\n - 'src/config/local.env'" - type: file_extension_restriction description: "Prevent commits that include files with specified file extensions from being pushed to the commit graph." parameters: @@ -97,6 +99,7 @@ rules: method: all_of type: string array required: true + sample: "\n - '.sql'" - type: max_file_path_length description: "Prevent commits that include file paths that exceed the specified character limit from being pushed to the commit graph." parameters: @@ -105,6 +108,7 @@ rules: method: max type: integer required: true + sample: '1024 # characters' - type: max_file_size description: "Prevent commits with individual files that exceed the specified limit from being pushed to the commit graph." parameters: @@ -113,6 +117,7 @@ rules: method: max type: integer required: true + sample: '10 # mb' - type: copilot_code_review description: "Request Copilot code review for new pull requests automatically if the author has access to Copilot code review and their premium requests quota has not reached the limit." parameters: diff --git a/docs/_includes/render-github-policies.html b/docs/_includes/render-github-policies.html index 4a7863f6..7635fecb 100644 --- a/docs/_includes/render-github-policies.html +++ b/docs/_includes/render-github-policies.html @@ -47,7 +47,7 @@
{{ rule.type }}
{%- for param in rule.parameters -%} {{ param[0]}}
({{ param[1].type }}{%- if param[1].required -%}; required{%- endif -%}) - {{ param[1].description}} + {{ param[1].description}}{% if param[1].method == "min" %}
Note: The value defines a required minimum. Higher values are accepted.{% endif %}{% if param[1].method == "max" %}
Note: The value defines a required maximum. Lower values are accepted.{% endif %} {%- if has_properties -%} {%- if param[1].properties -%} @@ -66,16 +66,17 @@
{{ rule.type }}
{%- if prop[1].type == 'enum' -%} one of -
    + {%- if prop[1].method == "min" or prop[1].method == "max" -%}
      {%- else -%}
        {%- endif -%} {%- for enum in prop[1].enum -%}
      • {{ enum }}
        • {%- endfor -%} -
      + {%- if prop[1].method == "min" or prop[1].method == "max" -%}
    {%- else -%}
{%- endif -%} {%- else -%} {{ prop[1].type }} {%- endif -%} {{ prop[1].description }} +{% if prop[1].method == "min" %} _Note: The value defines a required minimum. Higher values are accepted._{% endif %}{% if prop[1].method == "max" %} _Note: The value defines a required maximum. Lower values are accepted._{% endif %} {%- endfor -%} @@ -95,13 +96,13 @@
{{ rule.type }}
```yaml github-scm-policies: ruleset_constraints: - rules: - - type: {{ rule.type }}{% if rule.parameters %} - parameters: {% for param in rule.parameters %} - {{ param[0] }}: {% case param[1].type %}{% when "boolean" %}true{% when "integer" %}1{% when "string array" %} - - value{% when "object array" %} - - {% for prop in param[1].properties %}{{ prop[0] }}: {% case prop[1].type %}{% when "enum" %}{{ prop[1].enum | last }}{% when "string" %}value{% endcase %} - {% endfor %}{% endcase %}{% endfor %}{% endif %} + - rules: + - type: {{ rule.type }}{% if rule.parameters %} + parameters: {% for param in rule.parameters %} + {{ param[0] }}: {% if param[1].sample %}{{ param[1].sample }}{% else %}{% case param[1].type %}{% when "boolean" %}true{% when "integer" %}1{% when "string array" %} + - value{% when "object array" %} + - {% for prop in param[1].properties %}{{ prop[0] }}: {% if prop[1].sample %}{{ prop[1].sample }}{% else %}{% case prop[1].type %}{% when "enum" %}{{ prop[1].enum | last }}{% when "string" %}value{% endcase %}{% endif %} + {% endfor %}{% endcase %}{% endif %}{% endfor %}{% endif %} ``` {%- endif -%} diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index 76bbfb55..adb20aa6 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -2,7 +2,7 @@ header: GitHub layout: resources toc: true -show_toc: 2 +show_toc: 3 description: GitHub --- @@ -127,12 +127,12 @@ Steps to create a policy file: * name it `.signpath/policies//.yml` * restrict write permissions to the policy files using GitHub's [code owners] feature -There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#github-actions-policies) and [GitHub's source code management system](#github-scm-policies). +There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#github-build-policies) and [GitHub's source code management system](#github-scm-policies). ### Example ```yaml -github-actions-policies: +github-build-policies: disallow_reruns: false runners: require_github_hosted: true @@ -144,15 +144,15 @@ github-scm-policies: - enforced_from: 2025-01-01 allow_bypass_actors: true rules: - - type: non_fast_forward - - type: pull_request - parameters: - required_approving_review_count: 2 - require_last_push_approval: true + - type: non_fast_forward + - type: pull_request + parameters: + required_approving_review_count: 2 + require_last_push_approval: true ``` -### `github-actions-policies` +### `github-build-policies` Allows to restrict the GitHub Actions build with the following policies: @@ -172,6 +172,55 @@ Allows to restrict the GitHub Actions build with the following policies: Allows to define `ruleset_constraints` for [GitHub branch rulesets]. All specified constraints must be covered by one or multiple active branch rulesets defined in GitHub. Multiple `ruleset_constraints` with different parameters can be defined. +{:.panel.info} +> **How ruleset constraints map to GitHub ruleset rules** +> +> GitHub allows you to define **_branch rulesets_**, both for repositories and at an organization level. Each branch ruleset defines a set of _rules_ and, optionally, a set of _bypass actors._ +> +> SignPath allows you to define **_ruleset contraints_**. Every _rule_ in a _ruleset constraint_ defined in SignPath's policies must be fulfilled by at least one _rule_ in a _branch ruleset_ on GitHub. You can define whether _bypass actors_ are allowed and whether the constraint has to be continually fulfilled (see below). +> +> **_Example:_** +> +> For example, the following GitHub branch rulesets would fulfill all of the defined ruleset constraints: +> +> 1. The `non_fast_forward` constraint is covered by Ruleset 1 +> 2. The `deletion` constraint is covered by Ruleset 1. It would allow bypass actors, but disallowing them is stricter and therefore valid. +> 3. The `creation` constraint is covered by Ruleset 2. +> +> +> +> +> +> +> +> +> +> +> +> +> +> +>
SignPath constraintsGitHub branch rulesets
+> ```yaml +> github-scm-policies: +> ruleset_constraints: +> - allow_bypass_actors: false +> rules: +> - type: non_fast_forward +> - allow_bypass_actors: true +> rules: +> - type: deletion +> - type: creation +> ``` +> +> Ruleset 1 (does not allow bypass actors) +> * non_fast_forward +> * deletion +> +> Ruleset 2 (allows bypass actors) +> * creation +>
+ #### General parameters for `ruleset_constraints` | Parameter | Values | Description @@ -187,18 +236,14 @@ Allows to define `ruleset_constraints` for [GitHub branch rulesets]. All specifi > * **Audit log events** for _GitHub Enterprise_ subscriptions. Audit log events are only available for the last 180 days, any prior policy violations will not be detected. > * The **last modified date** of the branch rulesets for all other subscriptions. At least one branch ruleset that has not been modified since the specified timestap must implement the rule. -TODO: better explain relation between GitHub branch rulesets and ruleset constraints - #### Supported rules The following rules are supported: {%- include render-github-policies.html schema=site.data.pipeline-policy-schemas.github -%} -TODO: What does the `policy_type: array` mean (e.g. for code scanning tool) -TODO: Provide sample values for integers and strings? (e.g. not `value`) -TODO: Why are all the pull request parameters required? -TODO: Explain min/max +TODO: What does the `policy_type: array` mean (e.g. for code scanning tool) --> Taha also doesn't know - discuss with Stefan +TODO: Sync Schema back to Pipeline Connector [code owners]: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners [GitHub branch rulesets]: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets From 54ee916084357482044c6227e240fbfe902b1c12 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Mon, 17 Aug 2026 09:04:59 +0200 Subject: [PATCH 3/9] adds some todos --- docs/trusted-build-systems/github.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index adb20aa6..456efa2b 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -133,6 +133,7 @@ There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#gith ```yaml github-build-policies: + version: '1.0' disallow_reruns: false runners: require_github_hosted: true @@ -140,6 +141,7 @@ github-build-policies: - Hardened Runners github-scm-policies: + version: '1.0' ruleset_constraints: - enforced_from: 2025-01-01 allow_bypass_actors: true @@ -228,6 +230,9 @@ Allows to define `ruleset_constraints` for [GitHub branch rulesets]. All specifi | `allow_bypass_actors` | boolean | If `true`, the branch ruleset is allowed to define bypassers | `enforced_from` | None, timestamp, or `EARLIEST` | By default, the constraints are only evaluated at the time of signing. When `enforced_from` is set, the constraints must have been continously fulfilled from the specified date (YAML ISO timestamp) or earliest availability of audit log entries (`EARLIEST`). + + + {:.panel.info} > **About `enforced_from` evaluation** > From a787b723cbb8b48af96787f188c3c83a86624b4c Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Wed, 26 Aug 2026 13:19:54 +0200 Subject: [PATCH 4/9] resolves open todos --- docs/_data/pipeline-policy-schemas/github.yml | 3 +-- docs/_includes/render-github-policies.html | 2 +- docs/trusted-build-systems/github.md | 25 +++++++++++-------- 3 files changed, 17 insertions(+), 13 deletions(-) diff --git a/docs/_data/pipeline-policy-schemas/github.yml b/docs/_data/pipeline-policy-schemas/github.yml index 4c5f94cc..0e210fcc 100644 --- a/docs/_data/pipeline-policy-schemas/github.yml +++ b/docs/_data/pipeline-policy-schemas/github.yml @@ -78,8 +78,7 @@ rules: required: true policy_type: array sample: CodeQL - -# new rules added in v2 - no tests yet +# new rules - no tests yet - type: required_signatures description: "Require commits to be signed with a GPG key that is verified by GitHub." - type: file_path_restriction diff --git a/docs/_includes/render-github-policies.html b/docs/_includes/render-github-policies.html index 7635fecb..4c8fe25e 100644 --- a/docs/_includes/render-github-policies.html +++ b/docs/_includes/render-github-policies.html @@ -101,7 +101,7 @@
{{ rule.type }}
parameters: {% for param in rule.parameters %} {{ param[0] }}: {% if param[1].sample %}{{ param[1].sample }}{% else %}{% case param[1].type %}{% when "boolean" %}true{% when "integer" %}1{% when "string array" %} - value{% when "object array" %} - - {% for prop in param[1].properties %}{{ prop[0] }}: {% if prop[1].sample %}{{ prop[1].sample }}{% else %}{% case prop[1].type %}{% when "enum" %}{{ prop[1].enum | last }}{% when "string" %}value{% endcase %}{% endif %} + - {% for prop in param[1].properties %}{% if forloop.first %}{{ prop[0] }}: {% else %}{{ prop[0] | prepend: " " }}: {% endif %}{% if prop[1].sample %}{{ prop[1].sample }}{% else %}{% case prop[1].type %}{% when "enum" %}{{ prop[1].enum | last }}{% when "string" %}value{% endcase %}{% endif %} {% endfor %}{% endcase %}{% endif %}{% endfor %}{% endif %} ``` diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index dd44413b..bb9451b4 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -11,7 +11,7 @@ description: GitHub * Use the predefined Trusted Build System _GitHub.com_ (see [configuration](/trusted-build-systems#configuration)) * add it to the Organization * link it to each SignPath Project for GitHub -* Required for [source code and build policies](#define-policies-for-source-code-and-builds): Install the [SignPath GitHub App](https://github.com/apps/signpath) and allow access to the code repositories. +* Required for [audit log evaluation](#audit-log-evaluation): Install the [SignPath GitHub App] and allow access to the code repositories. {:.panel.info} > **GitHub Enterprise Server** @@ -72,7 +72,7 @@ steps: > > * the the GitHub repository is private > * the workflow permissions are set to the default "Read repository contents and packages permissions" -> * The SignPath GitHub App is _not_ installed +> * The [SignPath GitHub App] is _not_ installed > > You can use the following snippet: > ``` @@ -163,6 +163,11 @@ Allows to restrict the GitHub Actions build with the following policies: | `disallow_reruns` | Set to `true` to prevent signing builds from re-runs. By enforcing this policy, old, temporarily failed builds cannot be re-run and signed under the false impression that they include recent changes, such as vulnerability fixes. These builds would still be identified by their branch name, e.g. `main`. | `runners` | Runner-specific settings, see table below. +{:panel.info} +> **Limit to 3 re-runs** +> +> Due to performance reasons, SignPath currently allows policy evaluation for up to 3 re-runs of a build. Further re-runs with active policies will fail. + #### `runners` section | Policy | Description @@ -228,17 +233,19 @@ Allows to define `ruleset_constraints` for [GitHub branch rulesets]. All specifi | Parameter | Values | Description |-------------------------|--------------------------------|---------------------------- | `allow_bypass_actors` | boolean | If `true`, the branch ruleset is allowed to define bypassers -| `enforced_from` | None, timestamp, or `EARLIEST` | By default, the constraints are only evaluated at the time of signing. When `enforced_from` is set, the constraints must have been continously fulfilled from the specified date (YAML ISO timestamp) or earliest availability of audit log entries (`EARLIEST`). - - - +| `enforced_from` | `CURRENT_BUILD` (default), timestamp or `EARLIEST` | By default, the constraints are only evaluated at the time of signing (`CURRENT_BUILD`). When another value is set for `enforced_from`, the constraints must have been continously fulfilled from the specified date (YAML ISO timestamp) or earliest availability of audit log entries (`EARLIEST`). {:.panel.info} +> **GitHub export** +> +> The SignPath policies are an extension and therefore compatible with the export format in GitHub. You can export a branch ruleset in GitHub, convert it to YAML and then paste the entire `rules` section under `ruleset_constraints` in your SignPath policies. + +{:.panel.info#audit-log-evaluation} > **About `enforced_from` evaluation** > > Depending on your GitHub subscription, the continuous enforcement of policies is either based on: > -> * **Audit log events** for _GitHub Enterprise_ subscriptions. Audit log events are only available for the last 180 days, any prior policy violations will not be detected. +> * **Audit log events** for _GitHub Enterprise_ subscriptions. Audit log events are only available for the last 180 days, any prior policy violations will not be detected. _Audit Log evaluation requires the [SignPath GitHub App] to be installed._ > * The **last modified date** of the branch rulesets for all other subscriptions. At least one branch ruleset that has not been modified since the specified timestap must implement the rule. #### Supported rules @@ -247,8 +254,6 @@ The following rules are supported: {%- include render-github-policies.html schema=site.data.pipeline-policy-schemas.github -%} -TODO: What does the `policy_type: array` mean (e.g. for code scanning tool) --> Taha also doesn't know - discuss with Stefan -TODO: Sync Schema back to Pipeline Connector - [code owners]: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners [GitHub branch rulesets]: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets +[SignPath GitHub App]: https://github.com/apps/signpath \ No newline at end of file From a9441d25cfa9f14091484b6ff531ebb96f02d698 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Wed, 26 Aug 2026 13:34:41 +0200 Subject: [PATCH 5/9] adds dedicated pipeline policy page --- docs/_data/menus/documentation.yml | 3 ++ docs/pipeline-policies/index.md | 42 ++++++++++++++++++++++++++++ docs/trusted-build-systems/github.md | 12 +++----- 3 files changed, 49 insertions(+), 8 deletions(-) create mode 100644 docs/pipeline-policies/index.md diff --git a/docs/_data/menus/documentation.yml b/docs/_data/menus/documentation.yml index db34c9ad..582ed0d4 100644 --- a/docs/_data/menus/documentation.yml +++ b/docs/_data/menus/documentation.yml @@ -65,6 +65,9 @@ - text: Origin Verification path: origin-verification +- text: Pipeline Policies + path: pipeline-policies + - text: SLSA Attestations path: slsa-attestations items: diff --git a/docs/pipeline-policies/index.md b/docs/pipeline-policies/index.md new file mode 100644 index 00000000..cef8bcf9 --- /dev/null +++ b/docs/pipeline-policies/index.md @@ -0,0 +1,42 @@ +--- +header: Pipeline Policies +layout: resources +toc: false +description: Documentation for using Pipeline Policies in SignPath +--- + + + +Pipeline policies allow restricting source code and build settings of your CI/CD pipeline. + +Steps to create a Pipeline Policy: +1. In SignPath, create a Pipeline Policy with either an _internal_ definition, i.e. YAML pasted in the web interface or an _external_ definition stored in a source code repository. +2. For each [signing policy](/projects#signing-policies), one or more pipeline policies can be added. At submit time, the build system and source code management system settings are evaluated and compliance with the policy definition is checked. If the level is set to _Log_, a respective information entry is shown on the signing request page. If the level is set to _Enforce_, the signinig request is denied. + +# Example + +```yaml +github-build-policies: + version: '1.0' + disallow_reruns: false + runners: + require_github_hosted: true + allowed_groups: + - Hardened Runners + +github-scm-policies: + version: '1.0' + ruleset_constraints: + - enforced_from: 2025-01-01 + allow_bypass_actors: true + rules: + - type: non_fast_forward + - type: pull_request + parameters: + required_approving_review_count: 2 + require_last_push_approval: true +``` + +# Reference + +Currently, only policies for [GitHub](/trusted-build-systems/github#pipeline-policies-for-github) are supported. diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index bb9451b4..66f72327 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -115,19 +115,15 @@ The action supports the following output parameters: - `signing-request-web-url`: URL of the signing request in SignPath - `signed-artifact-download-url`: download URL of the signed artifact -## Policies +## Pipeline Policies for GitHub {% include editions.md feature="pipeline_integrity.extended_policies" %} -You can define pipeline policies that restrict source code and build settings. +You can define [pipeline policies](/pipeline-policies) that restrict source code and build settings. -Steps to create a policy file: +The available policies specific to GitHub are listed in this section. -* create the policy file in the `default` branch of the source code repository -* name it `.signpath/policies//.yml` -* restrict write permissions to the policy files using GitHub's [code owners] feature - -There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#github-build-policies) and [GitHub's source code management system](#github-scm-policies). +There are separate policy sections for GitHub's CI sytem, [GitHub Actions](#github-build-policies) (`github-build-policies`) and [GitHub's source code management system](#github-scm-policies) (`github-scm-policies`). ### Example From 2f6f3b27d33aa75029cf384cdf492dcc44ecd442 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Wed, 26 Aug 2026 13:42:48 +0200 Subject: [PATCH 6/9] very basic cleanup of subscription names --- docs/_data/editions.yml | 113 +++++++++++++++++++++------ docs/_data/featuregroups.yml | 8 +- docs/pipeline-policies/index.md | 2 +- docs/trusted-build-systems/github.md | 2 +- 4 files changed, 97 insertions(+), 28 deletions(-) diff --git a/docs/_data/editions.yml b/docs/_data/editions.yml index c81fc3a9..bf9234db 100644 --- a/docs/_data/editions.yml +++ b/docs/_data/editions.yml @@ -7,10 +7,10 @@ projects-hint: quota-hint users: 'up to 2' users-hint: quota-hint - signign_requests_release: 'up to 60' - signign_requests_release-hint: quota-hint - signign_requests_test: 'up to 300' - signign_requests_test-hint: quota-hint + signing_requests_release: 'up to 60' + signing_requests_release-hint: quota-hint + signing_requests_test: 'up to 300' + signing_requests_test-hint: quota-hint ci_pipelines: '1' file_based_signing: authenticode: true @@ -55,7 +55,7 @@ origin_verification: false origin_policies: false build_validation: false - extended_policies: false + pipeline_policies: false user_management: sso: false scim: false @@ -81,10 +81,10 @@ projects-hint: 'You may use several artifact configurations per project, e.g. for different components. Click "buy now" and add projects to adjust quota.' users: 'up to 15' users-hint: quota-hint - signign_requests_release: 'up to 500' - signign_requests_release-hint: quota-hint - signign_requests_test: 'up to 2500' - signign_requests_test-hint: quota-hint + signing_requests_release: 'up to 500' + signing_requests_release-hint: quota-hint + signing_requests_test: 'up to 2500' + signing_requests_test-hint: quota-hint ci_pipelines: '1 per project' file_based_signing: authenticode: true @@ -129,7 +129,7 @@ origin_verification: false origin_policies: false build_validation: false - extended_policies: false + pipeline_policies: false user_management: sso: false scim: false @@ -146,14 +146,14 @@ gpg_key_management: false link_type: 'pricing_page' -- name: Advanced Code Signing - title: Advanced Code Signing +- name: Semantic Code Signing + title: Semantic Code Signing quotas: certificates: 'unlimited' projects: 'unlimited' users: 'unlimited' - signign_requests_release: 'unlimited' - signign_requests_test: 'unlimited' + signing_requests_release: 'unlimited' + signing_requests_test: 'unlimited' ci_pipelines: 'unlimited' file_based_signing: authenticode: true @@ -194,10 +194,79 @@ disable_malware_scanning: true pipeline_integrity: trusted_build_systems: optional - origin_verification: optional + origin_verification: false + origin_policies: false + build_validation: false + pipeline_policies: false + user_management: + sso: true + scim: true + groups: true + admin_delegation: true + other: + malware_detection: true + hsm_key_storage: true + available_on_premises: true + cert_enrollment: true + support: 'priority' + support-hint: 'Priority support using email, phone and screen sharing' + code_signing_consulting: 'available' + no_display: + gpg_key_management: true + link_type: 'sales_email' + +- name: Pipeline Integrity + title: Pipeline Integrity + quotas: + certificates: 'unlimited' + projects: 'unlimited' + users: 'unlimited' + signing_requests_release: 'unlimited' + signing_requests_test: 'unlimited' + ci_pipelines: 'unlimited' + file_based_signing: + authenticode: false + powershell: false + windows_scripting_host: false + clickonce: false + device_drivers: false + office_add_ins: false + opc: false + nuget: false + android: false + java: false + apk: false + rpm: false + deb: false + office_macros: false + xml: false + jsf: false + docker: false + sbom: false + dsse: false + smime: false + cms: false + gpg: false + raw: false + hash_based_signing: none + artifact_configuration: + deep_signing: true + multiple_configurations_per_project: true + metadata_constraints: true + user_defined_parameters: true + policy_enforcement: + manual_approval: true + quorum_approval: true + signing_policies_per_project: 'unlimited' + policies_for_certs: true + resubmit: true + disable_malware_scanning: true + pipeline_integrity: + trusted_build_systems: true + origin_verification: true origin_policies: true build_validation: true - extended_policies: true + pipeline_policies: true user_management: sso: true scim: true @@ -221,8 +290,8 @@ certificates: 'unlimited' projects: 'n/a' users: 'unlimited' - signign_requests_release: 'unlimited' - signign_requests_test: 'unlimited' + signing_requests_release: 'unlimited' + signing_requests_test: 'unlimited' ci_pipelines: 'unlimited' file_based_signing: none hash_based_signing: @@ -251,7 +320,7 @@ origin_verification-hint: Not supported by crypto providers origin_policies: true build_validation: true - extended_policies: false + pipeline_policies: false user_management: sso: true scim: true @@ -277,8 +346,8 @@ projects: 'unlimited' projects-hint: 'OSS teams must apply for each project individually.' users: 'unlimited' - signign_requests_release: 'fair use' - signign_requests_test: 'fair use' + signing_requests_release: 'fair use' + signing_requests_test: 'fair use' ci_pipelines: '1 per project' file_based_signing: authenticode: true @@ -323,7 +392,7 @@ origin_policies: 'required' build_validation: 'required' disable_malware_scanning: false - extended_policies: 'predefined' + pipeline_policies: true user_management: sso: false scim: false diff --git a/docs/_data/featuregroups.yml b/docs/_data/featuregroups.yml index a82f0879..5c978c4a 100644 --- a/docs/_data/featuregroups.yml +++ b/docs/_data/featuregroups.yml @@ -17,11 +17,11 @@ title: 'Signing requests' hint: 'Signing requests (think software packages or releases) per year. Each signing request may contain multiple files.' href: '/product/editions-explained#signing-requests' - - name: signign_requests_release + - name: signing_requests_release title: 'release-signing' hint: 'Signing requests using your EV certificate' class: f sub - - name: signign_requests_test + - name: signing_requests_test title: 'test-signing' hint: 'Signing request using a test certificate that must be installed on target machines. Used for testing the signing configuration, signing internal builds, release candidates etc.' class: f sub @@ -177,8 +177,8 @@ title: 'Build validation' hint: 'Automatically checks build configurations for security weaknesses.' class: f sub - - name: extended_policies - title: 'SCM and CI policy control' + - name: pipeline_policies + title: 'Pipeline Policies' hint: 'Define specific SCM and CI/CD policy requirements, e.g. branch protection or build agents' class: f sub diff --git a/docs/pipeline-policies/index.md b/docs/pipeline-policies/index.md index cef8bcf9..a9e021cc 100644 --- a/docs/pipeline-policies/index.md +++ b/docs/pipeline-policies/index.md @@ -5,7 +5,7 @@ toc: false description: Documentation for using Pipeline Policies in SignPath --- - +{% include editions.md feature="pipeline_integrity.pipeline_policies" %} Pipeline policies allow restricting source code and build settings of your CI/CD pipeline. diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index 66f72327..7fe1bec3 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -117,7 +117,7 @@ The action supports the following output parameters: ## Pipeline Policies for GitHub -{% include editions.md feature="pipeline_integrity.extended_policies" %} +{% include editions.md feature="pipeline_integrity.pipeline_policies" %} You can define [pipeline policies](/pipeline-policies) that restrict source code and build settings. From 7be6e25558a6745db4759668e246eb79c2db07b0 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Wed, 26 Aug 2026 16:57:01 +0200 Subject: [PATCH 7/9] updates docs with azure devops build policies --- docs/pipeline-policies/index.md | 8 +++- docs/trusted-build-systems/azure-devops.md | 54 +++++++++++++++++++++- docs/trusted-build-systems/github.md | 2 +- 3 files changed, 61 insertions(+), 3 deletions(-) diff --git a/docs/pipeline-policies/index.md b/docs/pipeline-policies/index.md index a9e021cc..d99fe9e8 100644 --- a/docs/pipeline-policies/index.md +++ b/docs/pipeline-policies/index.md @@ -39,4 +39,10 @@ github-scm-policies: # Reference -Currently, only policies for [GitHub](/trusted-build-systems/github#pipeline-policies-for-github) are supported. +Pipeline Policies for the following systems are supported. See the respective pages for details: + +* Source Code Management (SCM) systems: + * [GitHub](/trusted-build-systems/github#github-scm-policies) (`github-scm-policies`) +* CI/CD systems: + * [GitHub Actions](/trusted-build-systems/github#github-build-policies) (`github-build-policies`) + * [Azure DevOps](/trusted-build-systems/azure-devops#azure-devops-build-policies) (`azure-devops-build-policies`) diff --git a/docs/trusted-build-systems/azure-devops.md b/docs/trusted-build-systems/azure-devops.md index 3263c412..fa1de0bc 100644 --- a/docs/trusted-build-systems/azure-devops.md +++ b/docs/trusted-build-systems/azure-devops.md @@ -97,4 +97,56 @@ The action supports the following output parameters: - `SigningRequestWebUrl`: URL of the signing request in SignPath UI. Available to subsequent tasks as environment variable `_SIGNINGREQUESTWEBURL`. - `SignedArtifactDownloadUrl`: download URL of the signed artifact. Available to subsequent tasks as environment variable `_SIGNEDARTIFACTDOWNLOADURL`. -_Note: `` is the value of the `name` property of the `SubmitSigningRequest` task._ \ No newline at end of file +_Note: `` is the value of the `name` property of the `SubmitSigningRequest` task._ + +## Pipeline Policies for Azure DevOps + +{% include editions.md feature="pipeline_integrity.pipeline_policies" %} + +You can define [pipeline policies](/pipeline-policies) that restrict source code and build settings. + +The available policies specific to Azure DevOps are listed in this section. + +### Example + +```yaml +azure-devops-build-policies: + version: 1.0 + agents: + allow_self_hosted: false + build: + disallow_classic_pipelines: true +``` + +### `azure-devops-build-policies` + +Allows to restrict the Azure DevOps build pipelines with the following policies: + + + + + + + + + + + + + + + + + + +
PolicyDescription
+```yaml + agents: + allow_self_hosted: false +``` +Restricts builds to AzureDevOps-hosted build agents.
+```yaml + build: + disallow_classic_pipelines: true +``` +Disallows classic pipelines.
diff --git a/docs/trusted-build-systems/github.md b/docs/trusted-build-systems/github.md index 7fe1bec3..c78ed246 100644 --- a/docs/trusted-build-systems/github.md +++ b/docs/trusted-build-systems/github.md @@ -159,7 +159,7 @@ Allows to restrict the GitHub Actions build with the following policies: | `disallow_reruns` | Set to `true` to prevent signing builds from re-runs. By enforcing this policy, old, temporarily failed builds cannot be re-run and signed under the false impression that they include recent changes, such as vulnerability fixes. These builds would still be identified by their branch name, e.g. `main`. | `runners` | Runner-specific settings, see table below. -{:panel.info} +{:.panel.info} > **Limit to 3 re-runs** > > Due to performance reasons, SignPath currently allows policy evaluation for up to 3 re-runs of a build. Further re-runs with active policies will fail. From 01793d0285400edd0fb58ad28e16caf63e2676f1 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Thu, 27 Aug 2026 11:42:22 +0200 Subject: [PATCH 8/9] updates jenkins docs for release --- docs/_data/changelog.yml | 12 ++++++++++++ docs/trusted-build-systems/jenkins.md | 9 ++++----- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/docs/_data/changelog.yml b/docs/_data/changelog.yml index ab1f3e18..13ff652a 100644 --- a/docs/_data/changelog.yml +++ b/docs/_data/changelog.yml @@ -1,3 +1,15 @@ +- date: '2026-08-28' # TODO: update + updates: + jenkins_plugin: + version: 5.0.0 + breaking_changes: + - text: |- + The Jenkins Plugin now requires a Pipeline Connector instance to run. Contact [our support team](https://signpath.io/support) for details. + issues: [SIGN-8637] + new_features: + - text: |- + SCM [Pipeline Policies](/pipeline-policies) are now supported for Jenkins builds. + issues: [SIGN-8637] - date: '2026-08-14' updates: pipeline_connector: diff --git a/docs/trusted-build-systems/jenkins.md b/docs/trusted-build-systems/jenkins.md index ffe238f5..60f797c8 100644 --- a/docs/trusted-build-systems/jenkins.md +++ b/docs/trusted-build-systems/jenkins.md @@ -9,7 +9,7 @@ description: Jenkins Plugin ## Prerequisites * The Jenkins plugin has been installed on the respective Jenkins instance (Jenkins 2.359 or higher are supported). -* The plugin has been registered as a _custom_ Trusted Build System within SignPath and linked to the respective project (see the [configuration](/trusted-build-systems#configuration) section). +* A Pipeline Connector instance ([Contact our support team](https://signpath.io/support) for details) is configured to reach the Jenkins server. * The following plugins are installed on the Jenkins server: * [Credentials binding](https://plugins.jenkins.io/credentials-binding/) * [Git](https://plugins.jenkins.io/git/) @@ -17,10 +17,10 @@ description: Jenkins Plugin ## Performed checks -The plugin ensures that +SignPath ensures that * A build was actually performed by a specific Jenkins CI instance, not by some other entity in possession of the API token * [Origin metadata](/origin-verification) is provided by Jenkins CI, not the build script, and can therefore not be forged -* The artifact is stored as an immutable Jenkins artifact before it is submitted for signing +* The artifact originated from the Jenkins build ## Installation @@ -28,9 +28,8 @@ See the [official plugin page](https://plugins.jenkins.io/signpath/) on how the ### Configuration -* The _Trusted Build System Token_ needs to be stored in a _System_ Credential (Under _Manage Jenkins / Manage Credentials_) +* In the _Code Signing with SignPath_ section of the System settings, set the _Connector URL_ and _Endpoint Slug_ of the installed Pipeline Connector and optionally define a default organization ID. * The _Api Token_ of a SignPath user with submitter permissions needs to be available to the build pipelines of the respective projects. -* The default credential ID for the _Trusted Build System Token_, the default organization ID and the SignPath API endpoint can be configured in the plugin configuration (under _System_ in the _Code Signing with SignPath_ section). ## Usage From f25f26e3894063bc98e7506ed977e2307d480522 Mon Sep 17 00:00:00 2001 From: Paul Savoie Date: Wed, 2 Sep 2026 13:21:31 +0200 Subject: [PATCH 9/9] adds changelog --- docs/_data/changelog.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/_data/changelog.yml b/docs/_data/changelog.yml index 918d9dc1..7cfe2c6c 100644 --- a/docs/_data/changelog.yml +++ b/docs/_data/changelog.yml @@ -1,3 +1,21 @@ +- date: '2026-09-08' + updates: + pipeline_connector: + version: 0.8.0 + breaking_changes: + - text: |- + Added support for new [Pipeline Policies](/pipeline-policies). The old build and source code policies under `.signpath/policies/*` are only loaded if explicitly referenced as Pipeline Policies and are modified to match the new policy definition scheme. + issues: [SIGN-8632, SIGN-8843, SIGN-8847, SIGN-8846, SIGN-8819] + bug_fixes: + - text: |- + TeamCity: The entire `/refs/heads/*` branch identifier is again used for Git branches instead of the shortened name (e.g. `main`). + issues: [SIGN-8826] + application: + version: 1.220.0 + new_features: + - text: |- + [Pipeline Policies](/pipeline-policies) allow central policy controls for restricting source code and build settings of your CI/CD pipeline . + issues: [] - date: '2026-08-11' updates: application: