Support verifying vulnerability reports of a container image at admission

[yizha1]

What would you like to be added?

Vulnerability reports for a container image are documents that record all the vulnerabilities found in the image during a vulnerability assessment scan. These reports provide a detailed list of the vulnerabilities indexed by severity and often include suggestions for fixing them. Vulnerability reports are essential for vulnerability management and help organizations understand the security risks. The vulnerability report can be in a SARIF format. Ratify should support verifying vulnerability report and provide data for admission policy to make decision.

Besides vulnerability report, Ratify should support evaluating VEX (Vulnerability Exploitability eXchange) document, which allows software producers to classify and label the vulnerabilities in their software. VEX is a form of a security advisory that indicates whether a product or products are affected by a known vulnerability or vulnerabilities. It provides clarity on the vulnerabilities that pose risk and the ones that do not.

Scenario-1: Users can define an admission policy that can verify the integrity and authenticity of a vulnerability report during deployment. This policy can audit and prevent vulnerability report evaluation if the report is not signed.

Scenario-2: Users can define an admission policy that can evaluate the vulnerability report during deployment. This policy can audit and prevent image deployment if the latest report is older than days.

Scenario-3: Users can define an admission policy that can evaluate the vulnerability report during deployment. This policy can audit and prevent image deployment if specific vulnerabilities are found in the latest report. The VEX document, if available, can be used to filter false positives from the report.

Scenario-4: Users can define an admission policy that can evaluate the vulnerability report during deployment. This policy can audit and prevent image deployment if the number of critical or high-level vulnerabilities is not meeting SLA in the latest report. The VEX document, if available, can be used to filter false positives from the report.

Anything else you would like to add?

Detailed experience will be updated later.

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.