Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Add documentation explaining why to use Conforma instead of cosign directly #3344

Open
Labels

Description

The project lacks a document explaining the value proposition of using Conforma (EC) versus using cosign directly for verification. While ec validate image docs mention that certain stages are "akin to cosign verify" and "cosign verify-attestation", there is no high-level explanation of what Conforma adds on top of cosign.

A new documentation page (e.g., "Why Conforma?" or similar) should cover:

  1. Policy-as-code evaluation -- Conforma layers Rego/OPA policy evaluation over signature and attestation verification, enabling organizational compliance rules that cosign alone cannot express
  2. Batch and snapshot validation -- validating multiple images from an ApplicationSnapshot in a single invocation
  3. Structured output and reporting -- multiple output formats (JSON, YAML, JUnit, summary, VSA) for CI/CD integration and audit trails
  4. EnterpriseContractPolicy CRD integration -- declarative policy configuration via Kubernetes custom resources
  5. Tekton task integration -- ready-made pipeline tasks for CI/CD workflows
  6. Built-in rule library -- curated policy rules for SLSA provenance, build tasks, and release readiness

This page should be linked from the main navigation and the index page.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

        AltStyle によって変換されたページ (->オリジナル) /