@marinjursic/prc-linux-arm64 0.1.0

package/bin/catalog/assertions/iac.yaml

@@ -0,0 +1,24 @@
+schema_version: prc.assertions/v0.1
+catalog_version: 1.0.0
+assertions:
+  - id: PRC-A-IAC-001
+    revision: 1
+    control_ids: [USEQ-212AE882]
+    title: Inventoried infrastructure definitions satisfy reviewed policy checks
+    statement: No reviewed offline Checkov policy reports a violation in the sealed inventoried Terraform, Kubernetes, or container definition files.
+    applicability: inventory.infrastructure.terraform_files.size() > 0 || inventory.infrastructure.kubernetes_files.size() > 0 || inventory.container_files.size() > 0
+    evidence_required:
+      - kind: analysis-result
+        minimum_authority: executed
+        description: A completed digest-bound Checkov analysis of exactly the sealed inventoried Terraform, Kubernetes, and container definition files.
+    implementation_id: prc.native.analysis-evidence@0.1
+    parameters:
+      adapter_bindings:
+        - adapter_id: prc.adapter.checkov@3.3
+          manifest_sha256: 643069c38a3507b5ac36093f16f8e1932ca6c7fa3cd972a8576c8913ae821be7
+          observation_kind: iac-policy
+          pass_outcomes: [not_found]
+          fail_outcomes: [found]
+    severity: high
+    gate: required
+    remediation_class: R4

package/bin/catalog/assertions/supply-chain.yaml

@@ -0,0 +1,45 @@
+schema_version: prc.assertions/v0.1
+catalog_version: 1.0.0
+assertions:
+  - id: PRC-A-SUPPLY-001
+    revision: 1
+    control_ids: [USEQ-A9032C59]
+    title: Repository SBOM is generated
+    statement: A normalized CycloneDX 1.7 software bill of materials is generated from the sealed current repository inventory.
+    applicability: inventory.source_files > 0
+    evidence_required:
+      - kind: analysis-result
+        minimum_authority: executed
+        description: A digest-bound CycloneDX artifact generated by the authorized Syft adapter for the current sealed inventory.
+    implementation_id: prc.native.analysis-evidence@0.1
+    parameters:
+      adapter_bindings:
+        - adapter_id: prc.adapter.syft@1.51
+          manifest_sha256: f2c75e95c95a2151fb588615d03842a1ca2f5ad2f4e6fd6b98e08cbfcfba6836
+          observation_kind: sbom-generation
+          pass_outcomes: [value]
+          fail_outcomes: []
+    severity: high
+    gate: required
+    remediation_class: R2
+  - id: PRC-A-SUPPLY-002
+    revision: 1
+    control_ids: [USEQ-A9032C59]
+    title: Known repository dependency vulnerabilities are absent
+    statement: No known dependency vulnerability is reported for packages discoverable in the sealed current repository inventory by the authorized offline analysis and its fresh, identity-bound vulnerability database.
+    applicability: inventory.source_files > 0
+    evidence_required:
+      - kind: analysis-result
+        minimum_authority: executed
+        description: A completed digest-bound Grype analysis generated from the sealed inventory and a separately acquired database no more than 120 hours old.
+    implementation_id: prc.native.analysis-evidence@0.1
+    parameters:
+      adapter_bindings:
+        - adapter_id: prc.adapter.grype@0.116
+          manifest_sha256: b5d83d172c115d2b0b3d855287582a46d2d4c40555100d196ba39631b4a72599
+          observation_kind: dependency-vulnerability
+          pass_outcomes: [not_found]
+          fail_outcomes: [found]
+    severity: critical
+    gate: required
+    remediation_class: R2