Feature Requests

Hi Team, We are generating the SBOM & SLSA Attestation steps in the pipeline and we don't want to perform attestation for all branches. Instead, we want to do attestation only for release, master, and main branches. This will help us save resources in Artifactory and Vault

It would be great if you could map the internal package int he Artifact SBOM so that it would show no assertion on the Harness SBOM page

Hi Team, The Harness-Vault connector is not capable of pulling keys from subfolders. It would be great if you could add this feature. We are adding subfolder details in the stage variable to fetch the keys.

In policy violations side-car page, search based on components/licenses defined in the violation rules

Severity of the policy set (warn or block) shown in the policy violations dashboard (Pipeline execution summary)

The name of the policy should also be shown in the Pipeline execution summary. This helps the team to identify which policy sets were violated

A best practice for artifact signing is to support timestamping. Timestamping: To ensure the signature was produced within the certificate's validity window, a timestamp is added to the signed artifact. This will allow us to not fail a verification/validation step if the signing material has changed or expired. Without this, we would need to resign the same artifacts.

integrating something like scorecard to help understand potential issues with opensource package dependencies. https://github.com/ossf/scorecard