{"id":19368471,"url":"https://github.com/anchore/modular-policy","last_synced_at":"2026-06-19T00:31:11.944Z","repository":{"id":52236069,"uuid":"333942008","full_name":"anchore/modular-policy","owner":"anchore","description":"CLI utility for managing Anchore policy bundles as individual components. Useful for git-based policy management.","archived":false,"fork":false,"pushed_at":"2021-05-04T05:55:01.000Z","size":32,"stargazers_count":1,"open_issues_count":0,"forks_count":2,"subscribers_count":27,"default_branch":"master","last_synced_at":"2025-02-24T13:48:38.392Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anchore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-01-28T20:58:32.000Z","updated_at":"2021-08-30T17:34:11.000Z","dependencies_parsed_at":"2022-08-26T05:41:46.388Z","dependency_job_id":null,"html_url":"https://github.com/anchore/modular-policy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/anchore/modular-policy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fmodular-policy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fmodular-policy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fmodular-policy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fmodular-policy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anchore","download_url":"https://codeload.github.com/anchore/modular-policy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fmodular-policy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34513020,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-18T02:00:06.871Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-10T08:06:41.688Z","updated_at":"2026-06-19T00:31:11.915Z","avatar_url":"https://github.com/anchore.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Modular Policy Bundle Generator\n\nThis utility provides a convenient way to manage an Anchore policy bundle as individual components. \n\n**This is alpha software with no official support.**\n\nIn its current state it is meant to augment a manual policy management process. The `extract` and `generate` commands are relatively stable and can be used in a CI pipeline. The `allow` and `map` commands are not yet suitable for a fully automated solution.\n\nFor `anchore-cli` usage, refer to [CLI Usage: Policies](https://docs.anchore.com/current/docs/using/cli_usage/policies).\n\n## Config\n\nThe following config options must be placed before the subcommand:\n\n```bash\nanchore-bundle [OPTIONS] \u003csubcommand\u003e\n```\n\nCLI param      | Env var                 | Description\n---------------|-------------------------|-------------\n`--bundle-dir` | `$ANCHORE_BUNDLE_DIR`   | Path to policy bundle component directory\n`--debug`      | `$ANCHORE_BUNDLE_DEBUG` | Display verbose output for debugging\n\n### Tab completion\n```bash\neval \"$(_ANCHORE_BUNDLE_COMPLETE=source_bash anchore-bundle)\"\n```\n\n## Commands\n\nIn general you can find the usage of any command by passing the `--help` option:\n\n```bash\nanchore-bundle [\u003ccommand\u003e] --help\n```\n\n### Command: generate\n\nThe `generate` command creates a complete policy bundle, suitable for adding to Anchore. The output file is `bundle.json` and the bundle identifier is saved in `bundle_id`.\n\nIt parses `template.json` (in `$ANCHORE_BUNDLE_DIR`), and each component item in the template is replaced by the contents of the file matching the item `id`.\n\nFor example, the single item in the list `mappings: [ {'id': 'default_mapping'} ]` would be replaced by the contents of file `mappings/default_mapping.json`\n\nAll components are validated, and all JSON must be valid to produce the output file.\n\n```bash\n# Generate a new bundle from the contents of ./bundle/:\nanchore-bundle generate\n\n# Display the generated bundle_id\ncat bundle_id ; echo\n```\n\n### Command: extract\n\nThe `extract` command generates `template.json` and component item files from a complete policy bundle JSON file. The input file can be downloaded with `anchore-cli policy get \u003cpolicy\u003e --detail`, or from Anchore Enterprise UI.\n\n```bash\nanchore-bundle extract [--no-backup] [--strategy=replace] SOURCE\n\n\n# Example: remove all existing components and restore Default Bundle\nBUNDLE_URL=https://raw.githubusercontent.com/anchore/anchore-engine/master/anchore_engine/conf/bundles/anchore_default_bundle.json\n\ncurl -o anchore_default_bundle.json $BUNDLE_URL\n\nanchore-bundle extract --strategy=replace anchore_default_bundle.json\n```\n\n### Command: map\n\nThe `map` command generates a file `mappings/\u003cMAPPING\u003e.json` that maps `ALLOWLIST` and `POLICY` to an image pattern: `\u003cregistry\u003e/\u003crepo\u003e:tag` (wildcards allowed, refer to [Policy Mappings](https://docs.anchore.com/current/docs/using/ui_usage/policies/mappings/) for details).\n\nThis mapping is added to `template.json`. By default, an existing mapping will maintain its position in the template, and **new mappings will be inserted at the top**. To override the default behavior, set the desired position in the mappings list with `--position=\u003cnumber\u003e` where 0 is highest priority.\n\nATTENTION: **ordering of mappings is important!**\n\nWhen an image is evaluated, the first mapping with a matching image pattern will be used to determine the policies, allowlists, etc that will be applied.\n\nComponents are expected to already exist in `policies/\u003cPOLICY\u003e.json` and `whitelists/\u003cALLOWLIST\u003e.json`. By default these files are validated. To override this, if the files will be created or changed in the future (before bundle generation), use the `--no-validate` option.\n\n```bash\nanchore-bundle map [--position=0] [--registry='*'] [--repo='*'] [--tag='*'] [--no-validate] MAPPING ALLOWLIST POLICY\n\n# Example: image-specific mapping (w/policy+allowlist) for all ubuntu:20.04 images\nanchore-bundle map --repo=ubuntu --tag=20.04 \\\n    ubuntu_20_04_mapping  ubuntu_20_04_allowlist  ubuntu_20_04_policy\n\n# Example: default mapping to use as a catch-all\nanchore-bundle map --position=999999 \\\n    default_mapping  default_allowlist  default_policy\n```\n\n### Command: allow\n\nThe `allow` command generates an allowlist with exceptions for all stop gates from a Compliance Report (JSON file). In addition to the Compilance Report, it attempts to obtain justifications from `anchore_gates.csv` and `anchore_security.csv` files.\n\nGates CSV format:\n```\nimage_id,repo_tag,trigger_id,gate,trigger,check_output,gate_action,policy_id,matched_rule_id,whitelist_id,whitelist_name,inherited,Justification\n```\n\nSecurity CSV format:\n```\ntag,cve,severity,feed,feed_group,package,package_path,package_type,package_version,fix,url,inherited,description,nvd_cvss_v2_vector,nvd_cvss_v3_vector,vendor_cvss_v2_vector,vendor_cvss_v3_vector,Justification\n```\n\nUsage:\n```bash\nanchore-bundle allow --compliance=\u003ccompliance_report\u003e.json --gates=\u003cgates\u003e.csv --security=\u003csecurity\u003e.csv\n```\n\n---\n\n## Modular Policy Demo\n\nThis demo requires a working Anchore deployment. Refer to the docker-compose [Quickstart](https://docs.anchore.com/current/docs/quickstart/) if you need to provision one.\n\n### Demo Setup\n\nTo run this demo you will need to download anchore_gates.csv and anchore_security.csv for `ubi8-minimal:8.3` from [Iron Bank](https://ironbank.dso.mil/repomap/redhat/ubi). These files are copied into `/anchore-cli/` during the container build.\n\n```bash\ndocker build -t anchore-bundle:demo .\n\n# Modify variables as needed to work in your environment\ndocker run -it --rm --network=host \\\n  -v $(pwd):/anchore-cli/ \\\n  -e ANCHORE_CLI_USER=admin \\\n  -e ANCHORE_CLI_PASS=foobar \\\n  -e ANCHORE_CLI_URL=http://localhost:8228/v1 \\\n  --name=anchore-bundle \\\n  anchore-bundle:demo -- bash\n\n# Make sure the original Default Bundle is active\nanchore-cli policy activate 2c53a13c-1765-11e8-82ef-23527761d060\n\n# Define the image to use for this demo\nexport IMG=registry.access.redhat.com/ubi8/ubi-minimal:8.3\n\n# Add the image to Anchore, wait until result is available:\nanchore-cli image add $IMG\nanchore-cli image get $IMG\n```\n\nAll of the following steps should be run in the container created in Demo Setup.\n\n### Policy Management Demo\n\n1. Evaluate the image w/Default Bundle. The process should succeed, but 'Final action: stop' is expected. Output is tee'd to a file for later comparison.\n\n```bash\nanchore-cli evaluate check $IMG --detail | tee eval-1.out\n```\n\n2. Extract original bundle into components and review the output.\n\n```bash\n# Extract the Default Bundle into components\nanchore-bundle extract anchore_default_bundle.json\n\n# Initialize new git repo in bundle dir\ncd bundle\ngit init\ngit remote add origin http://localhost:3200/alex/demo-bundle.git\n\n# Prepare to save in git, review extracted components\ngit add ./*\ngit status\n\n# Commit and push\ngit commit -m 'initial commit'\ngit push -u origin HEAD\n\n# Review the bundle template, notice how each component item only has an id field:\nless template.json\n```\n\n3. Modify the bundle and review changes.\n\n```bash\n# Change the bundle name \u0026 id for easy comparison\nsed -i 's/\"id\": \"2c53a13c-1765-11e8-82ef-23527761d060\"/\"id\": \"demo_1\"/' template.json\nsed -i 's/\"name\": \"Default bundle\"/\"name\": \"Custom bundle\"/' template.json\n\n# Review the change\ngit diff\n\n# Commit and push\ngit add template.json\ngit commit -m 'set bundle id \u0026 name'\ngit push\n```\n\n4. Generate a new bundle with our modifications, and review the output.\n\n```bash\n# Return to parent dir (containing bundle/)\ncd ..\n\n# Generate a new bundle:\nanchore-bundle generate\n\n# Display the generated bundle_id\ncat bundle_id ; echo\n\n# Review the generated bundle, notice how component items are merged back into the template:\nless bundle.json\n\n# Compare the generated bundle with the original:\ndiff \u003c(python -m json.tool --sort-keys bundle.json) \\\n  \u003c(python -m json.tool --sort-keys anchore_default_bundle.json)\n\n# Push the bundle to Anchore and set as active:\nanchore-cli policy add bundle.json \u0026\u0026 anchore-cli policy activate $(cat bundle_id)\n```\n\n### Auto-whitelist Demo\n\nThe `anchore-bundle allow` subcommand can be run during step 3 above. The following demo assumes a bundle was extracted according to the steps above, and it uses example policy evaluation output for the ubi8-minimal image from Iron Bank.\n\nDownload `Compliance_Report.json` from web UI, and copy into container:\n```bash\n# From host machine (not inside container)\ndocker cp ~/Downloads/Compliance_Report_*.json anchore-bundle:/anchore-cli/\n```\n\nResume the demo inside the container...\n\n```bash\n# Confirm compliance report is available\nls -l\n\n# Generate new allowlist, based on eval output (compliance report, gates.csv, security.csv)\nanchore-bundle allow \\\n    -c Compliance_Report_*.json \\\n    -g anchore_gates.csv \\\n    -s anchore_security.csv\n\n# Generate mapping to include new allowlist in bundle\nanchore-bundle map --repo 'ubi8/ubi-minimal' ubi8-minimal 48e6f7d6-1765-11e8-b5f9-8b6f228548b6 thinkmassive-ubi8-minimal\n\n# Stage new mapping \u0026 allowlist to git; review changes, then commit\ncd bundle\ngit status\ngit add template.json mappings/ubi8-minimal.json whitelists/ubi8-ubi-minimal.json\ngit diff HEAD\ngit commit -m 'add mapping: ubi8-minimal'\n\n# Generate bundle with new components added\ncd ..\nanchore-bundle generate\n\n# Compare the generated bundle with the original:\ndiff \u003c(python -m json.tool --sort-keys bundle.json) \\\n  \u003c(python -m json.tool --sort-keys anchore_default_bundle.json)\n\n# Update active bundle (this will FAIL)\nanchore-cli policy add bundle.json \u0026\u0026 anchore-cli policy activate $(cat bundle_id)\n\n# Update policy_id in new mapping (copy from default mapping); regenerate bundle\ngrep policy_id bundle/mappings/c*\nvi bundle/mappings/ubi8-minimal.json\nanchore-bundle generate\n\n# Update active bundle (should succeed this time)\nanchore-cli policy add bundle.json \u0026\u0026 anchore-cli policy activate $(cat bundle_id)\n\n```\n\n9. Scan images using the modified policy bundle. The result should now be `Final action: warn` instead of `stop`, because the `Dockerfile directive 'FROM' check` is gone.\n\n```bash\nanchore-cli evaluate check $IMG --detail | tee eval-2.out\n\ndiff eval-1.out eval-2.out\n```\n\nRepeat steps 2-4 with your own modifications on an ongoing basis. Step 3 can be automated with a CI tool to always keep your active policy up to date with a branch of this repo.\n\n---\n\n## Continuous Integration\n\nYou may choose to fork this repo and use it to store your bundle components, in which case a CI build job can be used to keep the active bundle up to date.\n\nThe sample files and docs for this are still in progress.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fmodular-policy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanchore%2Fmodular-policy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fmodular-policy/lists"}