Apptrust Evidence Policies

API transport: Prefer jf api (JFrog CLI 2.100.0+). See jf-api-patterns.md (path-only URLs; auth from jf config). Examples using curl with $JFROG_URL + bearer token are fallback when the CLI is missing or below 2.100.0.

Evidence Promotion Policy Creator

Create a JFrog lifecycle policy that validates evidence exists before allowing application promotion, scoped to applications with specific labels.

Prerequisites

Follow jfrog-apptrust-auth.md to authenticate with the JFrog Platform before proceeding.

Desired State

After the workflow completes, the following must be true:

• A template exists (Rego policy) that evaluates evidence for the requested predicate type.
• A rule exists that binds the template to the predicate type (and any extra parameters).
• A policy exists, scoped to the chosen project or application, that blocks or warns on promotion when the evidence check fails.

Validate by fetching the created policy (and its rule/template) via the Unified Policy API and confirming scope, predicate type, and enforcement action match what the user requested.

Workflow

Execute steps in order. Ask only one question at a time. calls errors handling: If you get response "access denied: required entitlement not available" retry the call 3 times

Step 1: Validate Authentication

Follow jfrog-apptrust-auth.md completely. Do not proceed until both authentication and AppTrust entitlement checks pass.

JFROG_URL=$(cat .jfrog/config | jq -r '.url')
JFROG_TOKEN=$(cat .jfrog/config | jq -r '.token')

Step 2: Retrieve All Templates

TEMPLATES=$(curl -s -X GET \
  -H "Authorization: Bearer ${JFROG_TOKEN}" \
  -H "Content-Type: application/json" \
  "${JFROG_URL}/unifiedpolicy/api/v1/templates")

Store the full response for analysis in Step 5.

Step 3: Retrieve All Rules