yaml849 B

Attestation Verification Policy (YAML)

The policy an admission controller evaluates before an artifact is allowed through: required predicate types, an allowed-builder list, a minimum SLSA level, a transparency-log requirement and one dated exception. Every package, version, hash and licence is fictional: the tree describes nothing real.

Config parsing Config testing Schema validation

Preview, first 28 linesyaml

# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

apiVersion: policy.orchard.example/v1
kind: AttestationPolicy
metadata:
  name: sample-release-policy

spec:
  requiredPredicates:
    - https://slsa.dev/provenance/v1
    - https://cyclonedx.org/bom
  builders:
    allowed: ["https://build.orchard.example/builders/hosted/v1"]
  slsa:
    minimumBuildLevel: 3
    requireVsa: true
  transparencyLog:
    required: true
    logIds: ["sample-rekor.orchard.example"]
  source:
    allowedRepositories: ["git+https://git.orchard.example/orchard/*"]
    requireTagProtection: true
  onFailure: block
  exceptions:
    - predicate: https://cyclonedx.org/bom
      until: 2026-04-01
      reason: SAMPLE grace period for the fictional pilot service

Specifications

Seed: 51200
Sample Only: true
Format: YAML
Required Predicates: 2
Minimum Build Level: 3
Exceptions: 1
On Failure: block
Line Endings: LF

Testing contract

Expected to pass

Scenario: Evaluate a release against an attestation policy.
Expected result: The SLSA v1 statement and VSA in this family satisfy the builder allowlist and level-3 minimum; the dated exception must stop applying after 2026-04-01.

What is a .yaml file?

YAML (YAML Ain't Markup Language) is a human-readable data-serialization format using indentation, key-value pairs, and lists, and is a superset of JSON. It supports comments, anchors, and multiple documents per file, favoring readability for configuration. Its indentation sensitivity makes it error-prone to hand-edit.

How to use this file

Use an example YAML file to test config parsers, indentation and anchor handling, multi-document streams, and safe-loading to avoid arbitrary object construction.

How to use this file for testing

“Attestation Verification Policy (YAML)” is a deterministic Testaroo fixture for Config parsing, Config testing, Schema validation. TOML and INI configuration files with nested sections and typed values, for testing config parsers and loaders.

Documented properties for this file: seed 51200 · LF · YAML. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.

Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.

Code examples

import yaml  # pip install pyyaml

with open("attestation-policy.yaml") as f:
    data = yaml.safe_load(f)
print(data)

Generated by generation/supply_chain.py. Free for any use, no attribution required, license.