The Problem with Duplicate Attestations

Oct 13, 2025 by pynkocean.com 127 views

Introduction

In the realm of pipeline management and artifact verification, having a robust support system for policy decisions is crucial. This support system should be able to handle multiple attestations and provide a unified view of the artifact's provenance. In this article, we will explore the challenges of supporting policy decisions from multiple attestations and propose a solution to address these challenges.

The Challenge

When working with pipeline management tools like Tekton/Konflux, it is essential to minimize the time it takes for a build PipelineRun to be completed. One way to achieve this is by moving some of the tests and required tasks to a separate pipeline. This approach allows for a more efficient use of resources and reduces the overall build time.

However, when verifying the artifact with Conforma, the policies are applied to each provenance in the JSON stream instead of on the union of the provenance artifacts. This results in situations where the checks on required tasks are reporting as a warning and an error. This issue can be particularly problematic when some of the PipelineRuns are rerun, producing duplicate attestations.

The Problem with Duplicate Attestations

Duplicate attestations can occur when a PipelineRun is rerun, producing multiple attestations for the same artifact. In such cases, Conforma policy evaluations should be able to de-duplicate results to provide a unified view of the artifact's provenance. However, this is not currently possible, leading to inconsistencies in the policy evaluation results.

The Need for a Unified View

A unified view of the artifact's provenance is essential for accurate policy evaluation. This view should take into account all the attestations produced by the PipelineRuns, regardless of whether they are duplicate or not. By providing a unified view, Conforma policy evaluations can ensure that the policies are applied correctly, and the artifact's provenance is accurately represented.

Proposed Solution

To address the challenges of supporting policy decisions from multiple attestations, we propose the following solution:

Merge Attestations: When a new PipelineRun is completed, merge its attestation with the existing attestations for the same artifact. This can be achieved by creating a new attestation that combines the information from the existing attestations.
De-Duplicate Results: Implement a mechanism to de-duplicate results in Conforma policy evaluations. This can be achieved by using a data structure that can efficiently store and retrieve unique attestations.
Apply Policies Correctly: Update Conforma policy evaluations to apply policies correctly, taking into account the unified view of the artifact's provenance.

Benefits of the Proposed Solution

The proposed solution offers several benefits, including:

Improved Accuracy: By providing a unified view of the artifact's provenance, Conforma policy evaluations can ensure that the policies are applied correctly, reducing the risk of errors and inconsistencies.
Increased Efficiency: By merging attestations and de-duplicating results, Conforma policy evaluations can reduce the computational overhead associated with processing multiple attestations.
Enhanced User Experience: By providing a unified view of the artifact's provenance, users can easily understand the artifact's history and make informed decisions.

Conclusion

Supporting policy decisions from multiple attestations is a critical challenge in pipeline management and artifact verification. By proposing a solution that merges attestations, de-duplicates results, and applies policies correctly, we can improve the accuracy, efficiency, and user experience of Conforma policy evaluations. By implementing this solution, we can ensure that policy decisions are made with confidence, and the artifact's provenance is accurately represented.

Future Work

While the proposed solution addresses the challenges of supporting policy decisions from multiple attestations, there are several areas for future work:

Implementing the Proposed Solution: Implement the proposed solution in Conforma policy evaluations to demonstrate its effectiveness.
Evaluating the Solution: Evaluate the proposed solution to ensure that it meets the requirements and provides the expected benefits.
Refining the Solution: Refine the proposed solution based on the evaluation results to ensure that it is optimal and efficient.

Introduction

In our previous article, we explored the challenges of supporting policy decisions from multiple attestations and proposed a solution to address these challenges. In this article, we will answer some of the frequently asked questions (FAQs) related to supporting policy decisions from multiple attestations.

Q: What is the main challenge in supporting policy decisions from multiple attestations?

A: The main challenge is that Conforma policy evaluations apply policies to each provenance in the JSON stream instead of on the union of the provenance artifacts. This results in situations where the checks on required tasks are reporting as a warning and an error.

Q: Why is it essential to merge attestations?

A: Merging attestations is essential to provide a unified view of the artifact's provenance. This view should take into account all the attestations produced by the PipelineRuns, regardless of whether they are duplicate or not. By merging attestations, we can ensure that the policies are applied correctly, and the artifact's provenance is accurately represented.

Q: How can we de-duplicate results in Conforma policy evaluations?

A: We can de-duplicate results in Conforma policy evaluations by using a data structure that can efficiently store and retrieve unique attestations. This can be achieved by implementing a mechanism that checks for duplicate attestations before applying policies.

Q: What are the benefits of the proposed solution?

A: The proposed solution offers several benefits, including:

Improved Accuracy: By providing a unified view of the artifact's provenance, Conforma policy evaluations can ensure that the policies are applied correctly, reducing the risk of errors and inconsistencies.
Increased Efficiency: By merging attestations and de-duplicating results, Conforma policy evaluations can reduce the computational overhead associated with processing multiple attestations.
Enhanced User Experience: By providing a unified view of the artifact's provenance, users can easily understand the artifact's history and make informed decisions.

Q: How can we implement the proposed solution in Conforma policy evaluations?

A: To implement the proposed solution in Conforma policy evaluations, we need to:

Merge Attestations: When a new PipelineRun is completed, merge its attestation with the existing attestations for the same artifact.
De-Duplicate Results: Implement a mechanism to de-duplicate results in Conforma policy evaluations.
Apply Policies Correctly: Update Conforma policy evaluations to apply policies correctly, taking into account the unified view of the artifact's provenance.

Q: What are the future work areas for supporting policy decisions from multiple attestations?

A: The future work areas for supporting policy decisions from multiple attestations include:

Implementing the Proposed Solution: Implement the proposed solution in Conforma policy evaluations to demonstrate its effectiveness.
Evaluating the Solution: Evaluate the proposed solution to ensure that it meets the requirements and provides the expected benefits.
Refining the Solution: Refine the proposed solution based on the evaluation results to ensure that it is optimal and efficient.

Conclusion

Supporting policy decisions from multiple attestations is a critical challenge in pipeline management and artifact verification. By answering some of the frequently asked questions related to supporting policy decisions from multiple attestations, we can better understand the challenges and proposed solutions. By implementing the proposed solution, we can ensure that policy decisions are made with confidence, and the artifact's provenance is accurately represented.

Additional Resources

For more information on supporting policy decisions from multiple attestations, please refer to the following resources:

Previous Article: Our previous article on supporting policy decisions from multiple attestations provides a detailed overview of the challenges and proposed solutions.
Documentation: The Conforma documentation provides detailed information on implementing the proposed solution in Conforma policy evaluations.
Community Forum: The Conforma community forum is a great place to ask questions and get feedback from other users and developers.