This repository contains a reusable collection of policies to use with the 🔴🟡🟢 AMPEL Policy Engine.
The policies contained here are free to use and we always welcome patches and contributions!
Every policy, policy set and policy group has a document of its own next to
its source, and every directory has a README indexing what it holds. Both are
generated from the policy sources with make docs.
The repository contains policies for the following supply chain technologies and formats:
- AIIR: Policies for AIIR commit receipt attestations
- gitsign: Policies for commits signed with gitsign
- Grype: Policies for Grype vulnerability scan results
- OMS: Policies for OpenSSF Model Signing signatures
- OpenEoX: Policies to work with end of life/end of support data
- OpenVEX: Policies for OpenVEX exploitability data
- OSV: Policies for OSV vulnerability scan results
- protobom: SBOM policies reading documents through the protobom API
- Release: Policies for release tags cut on a merged commit and linked to the evaluated one
- SBOM: Software Bill of Materials
- Scorecard: OpenSSF Scorecard
- Security Insights: Security Insights Specification
- Signature: Detached signature verification
- Sigstore: Sigstore signing identity checks
- SLSA: Supply Chain Levels for Software Artifacts
- SLSA Source: SLSA Source Attestations
- Snappy: The Carabiner API snaphotter
- test-results: In-toto test results predicate
- Trivy: Policies for Trivy vulnerability scan results
- VSA: Verification Summary Attestation
Additionally we are also in the process of creating a community driven collection of policy sets and groups, modeling popular frameworks and best practices. Here are some early examples:
- OSPS Baseline: OpenSSF's Open Source Project Security Baseline
- OSPS Baseline groups: One policy group per OSPS Baseline control
- NTIA Minimum Elements: NTIA's Minimum Elements for Software Bill of Materials
- CISA 2026 SBOM Minimum Elements: CISA's 2026 Minimum Elements for Software Bill of Materials
- SLSA Build Levels: Policy sets for SLSA build levels 1 to 3
This is a community project and as such, we are happy to get contributions, issues, new policies, and PolicySets! Feel free to open issues or pull requests to this repo to make things better for everyone!
The .hjson files are the policy sources. Edit those, then run make json to
refresh the compiled JSON twins and make docs to refresh the documentation
and the directory indexes. Text outside the index markers of a README survives
regeneration, so introductions can be hand written.