policy.yaml

functionaries:
  - name: alice
    publicKeyPath: ./alice.pub
    scheme: rsa-pss

attestationRules:

  - name: untar
    predicateType: https://in-toto.io/attestation/link/v0.3
    policies:
      - type: https://in-toto.io/policy/predicate-attribute/v0.1
        definition:
          expressions:
            - this.predicate.command == ['tar', 'xvf', 'project.tar.gz'] 
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.subject
          rules:
            - REQUIRE "main.c"
            - REQUIRE "external.c"
            - REQUIRE "external.h"
            - REQUIRE "Makefile"
            - REQUIRE "it.Makefile"
            - DISALLOW "*"
    allowedFunctionaries:
      - alice

  - name: build_external
    predicateType: https://in-toto.io/attestation/link/v0.3
    policies:
      - type: https://in-toto.io/policy/predicate-attribute/v0.1
        definition:
          expressions:
            - this.predicate.command == ['cc', '-c', '-o', 'external.o', 'external.c'] 
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.predicate.materials
          rules:
            - MATCH "external.c" WITH "untar.subject"
            - MATCH "external.h" WITH "untar.subject"
            - ALLOW "Makefile"
            - DISALLOW "*"
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.subject
          rules:
            - REQUIRE "external.o"
            - DISALLOW "*"
    allowedFunctionaries:
      - alice

  - name: build_main
    predicateType: https://in-toto.io/attestation/link/v0.3
    policies:
      - type: https://in-toto.io/policy/predicate-attribute/v0.1
        definition:
          expressions:
            - this.predicate.command == ['cc', '-c', '-o', 'main.o', 'main.c'] 
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.predicate.materials
          rules:
            - MATCH "main.c" WITH "untar.subject"
            - MATCH "external.h" WITH "untar.subject"
            - ALLOW "Makefile"
            - DISALLOW "*"
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.subject
          rules:
            - REQUIRE "main.o"
            - DISALLOW "*"
    allowedFunctionaries:
      - alice

  - name: build_testy
    predicateType: https://in-toto.io/attestation/link/v0.3
    policies:
      - type: https://in-toto.io/policy/predicate-attribute/v0.1
        definition:
          expressions:
            - this.predicate.command == ['cc', '-o', 'testy', 'main.o', 'external.o']
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.predicate.materials
          rules:
            - MATCH "main.o" WITH "build_main.subject"
            - MATCH "external.o" WITH "build_external.subject"
            - ALLOW "Makefile"
            - DISALLOW "*"
      - type: https://in-toto.io/policy/artifact-rules/v0.1
        definition:
          field: this.subject
          rules:
            - REQUIRE "testy"
            - DISALLOW "*"
    allowedFunctionaries:
      - alice