at-container-registry/examples/verification/trust-policy.yaml

# ATProto Signature Trust Policy
#
# This file defines which signatures to trust and what to do when
# signatures are invalid or missing.
#
# Usage with atcr-verify:
#   atcr-verify IMAGE --policy trust-policy.yaml

version: 1.0

# Global settings
defaultAction: enforce  # Options: enforce, audit, allow
requireSignature: true  # Require at least one signature

# Policies matched by image scope (first match wins)
policies:
  # Production images require signatures from trusted DIDs
  - name: production-images
    description: "Production images must be signed by DevOps or Security team"
    scope: "atcr.io/*/prod-*"
    require:
      signature: true
      trustedDIDs:
        - did:plc:your-org-devops
        - did:plc:your-org-security
      minSignatures: 1
      maxAge: 2592000  # 30 days in seconds
    action: enforce  # Reject if policy fails

  # Critical infrastructure requires multi-signature
  - name: critical-infrastructure
    description: "Critical services require 2 signatures"
    scope: "atcr.io/*/critical-*"
    require:
      signature: true
      trustedDIDs:
        - did:plc:your-org-security
        - did:plc:your-org-devops
      minSignatures: 2  # Require at least 2 signatures
      algorithms:
        - ECDSA-K256-SHA256  # Only allow specific algorithms
    action: enforce

  # Staging images require signature from any team member
  - name: staging-images
    description: "Staging images need any trusted signature"
    scope: "atcr.io/*/staging-*"
    require:
      signature: true
      trustedDIDs:
        - did:plc:your-org-devops
        - did:plc:your-org-security
        - did:plc:your-org-developers
      minSignatures: 1
    action: enforce

  # Development images are audited but not blocked
  - name: dev-images
    description: "Development images are monitored"
    scope: "atcr.io/*/dev-*"
    require:
      signature: false  # Don't require signatures
    action: audit  # Log but don't reject

  # Test images from external sources
  - name: external-test-images
    description: "Test images from partners"
    scope: "atcr.io/external/*"
    require:
      signature: true
      trustedDIDs:
        - did:plc:partner-acme
        - did:plc:partner-widgets
      minSignatures: 1
    action: enforce

  # Default fallback for all other images
  - name: default
    description: "All other images require signature"
    scope: "atcr.io/*/*"
    require:
      signature: true
      minSignatures: 1
    action: enforce

# Trusted DID registry
trustedDIDs:
  # Your organization's DevOps team
  did:plc:your-org-devops:
    name: "DevOps Team"
    description: "Production deployment automation"
    validFrom: "2024-01-01T00:00:00Z"
    expiresAt: null  # Never expires
    contact: "devops@yourorg.com"
    allowedScopes:
      - "atcr.io/*/prod-*"
      - "atcr.io/*/staging-*"
      - "atcr.io/*/critical-*"

  # Your organization's Security team
  did:plc:your-org-security:
    name: "Security Team"
    description: "Security-reviewed images"
    validFrom: "2024-01-01T00:00:00Z"
    expiresAt: null
    contact: "security@yourorg.com"
    allowedScopes:
      - "atcr.io/*/*"  # Can sign any image

  # Developer team (limited access)
  did:plc:your-org-developers:
    name: "Developer Team"
    description: "Development and staging images"
    validFrom: "2024-06-01T00:00:00Z"
    expiresAt: "2025-12-31T23:59:59Z"  # Temporary access
    contact: "dev-team@yourorg.com"
    allowedScopes:
      - "atcr.io/*/dev-*"
      - "atcr.io/*/staging-*"
    notes: "Access expires end of 2025 - review then"

  # External partner: ACME Corp
  did:plc:partner-acme:
    name: "ACME Corp Integration Team"
    description: "Third-party integration images"
    validFrom: "2024-09-01T00:00:00Z"
    expiresAt: "2025-09-01T00:00:00Z"
    contact: "integration@acme.example.com"
    allowedScopes:
      - "atcr.io/external/acme-*"

  # External partner: Widgets Inc
  did:plc:partner-widgets:
    name: "Widgets Inc"
    description: "Widgets service integration"
    validFrom: "2024-10-01T00:00:00Z"
    expiresAt: "2025-10-01T00:00:00Z"
    contact: "api@widgets.example.com"
    allowedScopes:
      - "atcr.io/external/widgets-*"

# Signature validation settings
validation:
  # Signature age limits
  maxSignatureAge: 7776000  # 90 days in seconds (null = no limit)

  # Allowed signature algorithms
  allowedAlgorithms:
    - ECDSA-K256-SHA256  # ATProto default
    - ECDSA-P256-SHA256  # Alternative

  # DID resolution settings
  didResolver:
    timeout: 10  # seconds
    cache:
      enabled: true
      ttl: 3600  # 1 hour in seconds
    fallbackResolvers:
      - https://plc.directory
      - https://backup-plc.example.com

  # PDS connection settings
  pds:
    timeout: 15  # seconds
    retries: 3
    cache:
      enabled: true
      ttl: 600  # 10 minutes

# Audit logging
audit:
  enabled: true
  logLevel: info  # debug, info, warn, error

  # What to log
  logEvents:
    - signature_verified
    - signature_missing
    - signature_invalid
    - signature_expired
    - did_resolution_failed
    - pds_query_failed
    - policy_violation

  # Log destinations
  destinations:
    - type: stdout
      format: json
    - type: file
      path: /var/log/atcr-verify/audit.log
      format: json
      rotate: true
      maxSize: 100MB
      maxFiles: 10

# Reporting and metrics
reporting:
  # Prometheus metrics
  metrics:
    enabled: true
    port: 9090
    path: /metrics

  # Periodic reports
  reports:
    enabled: true
    interval: 86400  # Daily in seconds
    email:
      - security@yourorg.com
      - devops@yourorg.com
    includeStatistics: true

# Emergency overrides
overrides:
  # Allow bypassing verification in emergencies
  enabled: false  # Enable with extreme caution!
  requireApproval: true
  approvers:
    - security@yourorg.com
  validDuration: 3600  # Override valid for 1 hour

# Examples of policy evaluation:
#
# atcr.io/myorg/prod-api:v1.2.3
#   → Matches: production-images
#   → Requires: 1 signature from DevOps or Security
#   → Action: enforce
#
# atcr.io/myorg/critical-auth:v2.0.0
#   → Matches: critical-infrastructure
#   → Requires: 2 signatures from Security and DevOps
#   → Action: enforce
#
# atcr.io/myorg/staging-frontend:latest
#   → Matches: staging-images
#   → Requires: 1 signature from any team member
#   → Action: enforce
#
# atcr.io/myorg/dev-experiment:test
#   → Matches: dev-images
#   → Requires: none
#   → Action: audit (log only)
#
# atcr.io/external/acme-connector:v1.0
#   → Matches: external-test-images
#   → Requires: 1 signature from partner-acme
#   → Action: enforce