Blog
DevConf.US 2026: Closing the Gap Between Build Evidence and Compliance Enforcement
We’re excited to share that Conforma was featured at DevConf.US 2026. The talk tackles a gap many teams run into: you collect plenty of build evidence — SBOMs, SLSA provenance, signatures, attestations — but that evidence doesn’t enforce anything on its own.
Red Hat Summit 2026: From SBOM to Enforcement — Writing License Policies with Conforma
We’re excited to share that Conforma was featured at Red Hat Summit 2026. The talk demonstrates writing a Conforma policy rule from scratch to solve a real-world license compliance challenge.
Ask an OpenShift Expert: Red Hat Trusted Artifact Signer - Conforma
We were the guests of Episode 169 of the Red Hat YouTube podcast “Ask an OpenShift Expert”, where we dove into Conforma and how it bridges the gap between artifact generation and production deployment in a secure software supply chain.
FOSDEM 2026: From Passive Data to Active Defense with Conforma
We’re excited to share that Conforma was featured at FOSDEM 2026 in Brussels, one of Europe’s premier open-source software conferences. The talk introduced Conforma and demonstrated how to transform supply chain security data into actionable policy enforcement.
Validating arbitrary data
In this tutorial we’ll introduce some basic Conforma concepts and look at examples where Conforma is used to apply policy checks against arbitrary input data. We often use the ec validate image command, which fetches and verifies an image’s SLSA provenance attestations, then applies policy checks against them. But Conforma can work just as well with any kind of input using the ec validate input command, and in fact that is a useful way to demonstrate some Conforma ideas and techniques.
Introducing Our Comprehensive Resources Page
Whether you’re just getting started with supply chain security or looking to deepen your understanding of policy enforcement in container workflows, we’ve curated a comprehensive collection of resources to help you on your journey.
We’ve organized all our educational content, like conference presentations, demos, and expert talks, into our new Resources page for easy access and reference.
Presenting “Conforma”
To make a long story short, this project has a new name. “Enterprise Contract” is now “Conforma”. Read on for some background information about the name and why we decided to change it.
Gating Image Promotion on GitLab
Once you have a container image ready for promotion, it is important to first verify the image meets a certain criteria before it is made available to consumers. In this blog post, we look at how to achieve this in a GitLab pipeline.
Policies Polyglot: Evaluating Custom Predicates
Attestations are a wonderful way to attach metadata to container images in a secure manner. One of the most popular formats is SLSA Provenance which is used to provide information on how the image was created. Our Hitchhiker’s Guide demonstrates how to write policies to assert the contents of the SLSA Provenance. Here, we expand on that approach to assert the contents of any attestation format, even completely made up ones.
Introducing Action Validate for GitHub
You may already be familiar
with using the EC Validate command for local container image validation.
Now, you can seamlessly integrate this functionality directly into your build
processes or any other automated workflow in GitHub.
A Taste of Policies
In a previous blog post, we introduced the basic concepts of the Enterprise Contract. This time, we explore it further to showcase the usage of policies.
Introducing the Enterprise Contract
You may have heard of sigstore and its container image verification tool, cosign. This blog post introduces a policy-driven workflow, Enterprise Contract, built on those technologies.