Policy: add memorize cache and verify request efficiency
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 4.5k
- Forks
- 682
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 29
Description
In some cases, certain policy conditions run multiple times, eg, after more data is pulled in or when build steps are slightly different(eg, metadata resolve and evaluate for the same image source). Rego helpers have built-in memoization, but at least in some cases, it needed to be disabled as it was incorrectly remembering results for “unknown” fields.
The same command doing multiple requests also shouldn’t need to verify the same operation twice.
Additionally, need to verify HTTP requests made by buildkit during verification are not duplicated. Cache was added for attestation pull in v0.27, but the whole code path still needs to be verified.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Trace the policy evaluation path and BuildKit's verification HTTP requests, then compare the attestation cache added in v0.27. Done means repeated policy checks and verification requests are avoided without incorrectly memoizing results involving unknown fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- build-system, performance, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100