Blog on Conforma

Presenting "Conforma"

Wed, 22 Jan 2025 12:24:00 -0500

To make a long story short, this project has a new name. “Enterprise Contract” is now “Conforma”. Read on for some background information about the name and why we decided to change it.

Gating Image Promotion on GitLab

Wed, 12 Jun 2024 18:54:00 +0000

Once you have a container image ready for promotion, it is important to first verify the image meets a certain criteria before it is made available to consumers. In this blog post, we look at how to achieve this in a GitLab pipeline.

Policies Polyglot: Evaluating Custom Predicates

Wed, 20 Mar 2024 15:02:00 -0400

Attestations are a wonderful way to attach metadata to container images in a secure manner. One of the most popular formats is SLSA Provenance which is used to provide information on how the image was created. Our Hitchhiker’s Guide demonstrates how to write policies to assert the contents of the SLSA Provenance. Here, we expand on that approach to assert the contents of any attestation format, even completely made up ones.

Introducing Action Validate for GitHub

Tue, 24 Oct 2023 13:02:00 -0400

You may already be familiar with using the EC-CLI Validate command for local container image validation. Now, you can seamlessly integrate this functionality directly into your build processes or any other automated workflow in GitHub.

A Taste of Policies

Tue, 15 Aug 2023 12:34:56 -0400

In a previous blog post, we introduced the basic concepts of the Enterprise Contract. This time, we explore it further to showcase the usage of policies.

Introducing the Enterprise Contract

Mon, 24 Apr 2023 12:56:35 -0400

You may have heard of sigstore and its container image verification tool, cosign. This blog post introduces a policy-driven workflow, Enterprise Contract, built on those technologies.