fix(sbom): revert Hermeto attribution requirement

antora/docs/modules/ROOT/pages/packages/release_sbom_cyclonedx.adoc

@@ -97,19 +97,6 @@ Verify that no components in the CycloneDX SBOM were fetched using an experiment
 * Effective from: `2026-08-01T00:00:00Z`
 * https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/sbom_cyclonedx/sbom_cyclonedx.rego#L400[Source, window="_blank"]
 
-[#sbom_cyclonedx__hermeto_attribution_required]
-=== link:#sbom_cyclonedx__hermeto_attribution_required[Hermeto attribution required]
-
-Registry dependencies with a PURL type listed in vendored_purl_types must be processed by Hermeto. When a hermetic build omits prefetch-input for a vendored ecosystem, Hermeto never runs and the SBOM contains only Syft-reported module-level data, which is insufficient for CVE analysis. This rule denies any such component that lacks the hermeto:found_by (or cachi2:found_by) property.
-
-*Solution*: Set the prefetch-input pipeline parameter to the Hermeto package manager name for the ecosystem (e.g. "gomod" for pkg:golang, "cargo" for pkg:cargo) so Hermeto processes the project's dependencies during the prefetch-dependencies task.
-
-* Rule type: [rule-type-indicator failure]#FAILURE#
-* FAILURE message: `Package %s has PURL type %q which requires Hermeto attribution but was not processed by Hermeto`
-* Code: `sbom_cyclonedx.hermeto_attribution_required`
-* Effective from: `2027-01-15T00:00:00Z`
-* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/sbom_cyclonedx/sbom_cyclonedx.rego#L435[Source, window="_blank"]
-
 [#sbom_cyclonedx__proxy_metadata_required]
 === link:#sbom_cyclonedx__proxy_metadata_required[Proxy metadata required]
 

antora/docs/modules/ROOT/pages/packages/release_sbom_spdx.adoc

@@ -121,19 +121,6 @@ Verify that no packages in the SPDX SBOM were fetched using an experimental Herm
 * Effective from: `2026-08-01T00:00:00Z`
 * https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/sbom_spdx/sbom_spdx.rego#L373[Source, window="_blank"]
 
-[#sbom_spdx__hermeto_attribution_required]
-=== link:#sbom_spdx__hermeto_attribution_required[Hermeto attribution required]
-
-Registry dependencies with a PURL type listed in vendored_purl_types must be processed by Hermeto. When a hermetic build omits prefetch-input for a vendored ecosystem, Hermeto never runs and the SBOM contains only Syft-reported module-level data, which is insufficient for CVE analysis. This rule denies any such package that lacks the hermeto:found_by (or cachi2:found_by) annotation.
-
-*Solution*: Set the prefetch-input pipeline parameter to the Hermeto package manager name for the ecosystem (e.g. "gomod" for pkg:golang, "cargo" for pkg:cargo) so Hermeto processes the project's dependencies during the prefetch-dependencies task.
-
-* Rule type: [rule-type-indicator failure]#FAILURE#
-* FAILURE message: `Package %s has PURL type %q which requires Hermeto attribution but was not processed by Hermeto`
-* Code: `sbom_spdx.hermeto_attribution_required`
-* Effective from: `2027-01-15T00:00:00Z`
-* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/sbom_spdx/sbom_spdx.rego#L408[Source, window="_blank"]
-
 [#sbom_spdx__matches_image]
 === link:#sbom_spdx__matches_image[Matches image]
 

antora/docs/modules/ROOT/pages/release_policy.adoc

@@ -92,7 +92,6 @@ Rules included:
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__allowed_proxy_urls[SBOM CycloneDX: Allowed proxy URLs]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_attributes[SBOM CycloneDX: Disallowed package attributes]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_external_references[SBOM CycloneDX: Disallowed package external references]        
-* xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__hermeto_attribution_required[SBOM CycloneDX: Hermeto attribution required]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__proxy_metadata_required[SBOM CycloneDX: Proxy metadata required]        
 * xref:packages/release_sbom.adoc#sbom__disallowed_packages_provided[SBOM: Disallowed packages list is provided]        
 * xref:packages/release_slsa_build_build_service.adoc#slsa_build_build_service__allowed_builder_ids_provided[SLSA - Build - Build Service: Allowed builder IDs provided]        
@@ -103,7 +102,6 @@ Rules included:
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__allowed_proxy_urls[SPDX SBOM: Allowed proxy URLs]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_attributes[SPDX SBOM: Disallowed package attributes]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_external_references[SPDX SBOM: Disallowed package external references]        
-* xref:packages/release_sbom_spdx.adoc#sbom_spdx__hermeto_attribution_required[SPDX SBOM: Hermeto attribution required]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__proxy_metadata_required[SPDX SBOM: Proxy metadata required]        
 * xref:packages/release_schedule.adoc#schedule__rule_data_provided[Schedule related checks: Rule data provided]        
 * xref:packages/release_tasks.adoc#tasks__data_provided[Tasks: Data provided]        
@@ -182,7 +180,6 @@ Rules included:
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_attributes[SBOM CycloneDX: Disallowed package attributes]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_external_references[SBOM CycloneDX: Disallowed package external references]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__experimental_hermeto_backend[SBOM CycloneDX: Experimental Hermeto backend]        
-* xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__hermeto_attribution_required[SBOM CycloneDX: Hermeto attribution required]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__proxy_metadata_required[SBOM CycloneDX: Proxy metadata required]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__cdx_supported_version[SBOM CycloneDX: Supported Version]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__valid_cdx_1_4[SBOM CycloneDX: Valid 1.4]        
@@ -215,7 +212,6 @@ Rules included:
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_attributes[SPDX SBOM: Disallowed package attributes]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_external_references[SPDX SBOM: Disallowed package external references]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__experimental_hermeto_backend[SPDX SBOM: Experimental Hermeto backend]        
-* xref:packages/release_sbom_spdx.adoc#sbom_spdx__hermeto_attribution_required[SPDX SBOM: Hermeto attribution required]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__proxy_metadata_required[SPDX SBOM: Proxy metadata required]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__valid[SPDX SBOM: Valid]        
 * xref:packages/release_schedule.adoc#schedule__date_restriction[Schedule related checks: Date Restriction]        
@@ -376,8 +372,8 @@ Rules included:
 * xref:packages/release_git_branch.adoc#git_branch__git_branch[Git branch checks: Builds have a trusted target branch]        
 * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_extensions[GitHub Certificate Checks: GitHub Workflow Certificate Extensions]        
 * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_name[GitHub Certificate Checks: GitHub Workflow Name]        
-* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_ref[GitHub Certificate Checks: GitHub Workflow Repository]        
 * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_repository[GitHub Certificate Checks: GitHub Workflow Repository]        
+* xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_ref[GitHub Certificate Checks: GitHub Workflow Repository]        
 * xref:packages/release_github_certificate.adoc#github_certificate__gh_workflow_trigger[GitHub Certificate Checks: GitHub Workflow Trigger]        
 * xref:packages/release_github_certificate.adoc#github_certificate__rule_data_provided[GitHub Certificate Checks: Rule data provided]        
 * xref:packages/release_hermetic_task.adoc#hermetic_task__hermetic[Hermetic task: Task called with hermetic param set]        
@@ -426,7 +422,6 @@ Rules included:
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__allowed_proxy_urls[SBOM CycloneDX: Allowed proxy URLs]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_attributes[SBOM CycloneDX: Disallowed package attributes]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_external_references[SBOM CycloneDX: Disallowed package external references]        
-* xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__hermeto_attribution_required[SBOM CycloneDX: Hermeto attribution required]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__proxy_metadata_required[SBOM CycloneDX: Proxy metadata required]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__cdx_supported_version[SBOM CycloneDX: Supported Version]        
 * xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__valid_cdx_1_4[SBOM CycloneDX: Valid 1.4]        
@@ -460,7 +455,6 @@ Rules included:
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__contains_packages[SPDX SBOM: Contains packages]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_attributes[SPDX SBOM: Disallowed package attributes]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_external_references[SPDX SBOM: Disallowed package external references]        
-* xref:packages/release_sbom_spdx.adoc#sbom_spdx__hermeto_attribution_required[SPDX SBOM: Hermeto attribution required]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__matches_image[SPDX SBOM: Matches image]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__proxy_metadata_required[SPDX SBOM: Proxy metadata required]        
 * xref:packages/release_sbom_spdx.adoc#sbom_spdx__valid[SPDX SBOM: Valid]        

antora/docs/modules/ROOT/partials/release_policy_nav.adoc

@@ -120,7 +120,6 @@
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_attributes[Disallowed package attributes]
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__disallowed_package_external_references[Disallowed package external references]
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__experimental_hermeto_backend[Experimental Hermeto backend]
-**** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__hermeto_attribution_required[Hermeto attribution required]
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__proxy_metadata_required[Proxy metadata required]
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__cdx_supported_version[Supported Version]
 **** xref:packages/release_sbom_cyclonedx.adoc#sbom_cyclonedx__valid_cdx_1_4[Valid 1.4]
@@ -158,7 +157,6 @@
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_attributes[Disallowed package attributes]
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__disallowed_package_external_references[Disallowed package external references]
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__experimental_hermeto_backend[Experimental Hermeto backend]
-**** xref:packages/release_sbom_spdx.adoc#sbom_spdx__hermeto_attribution_required[Hermeto attribution required]
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__matches_image[Matches image]
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__proxy_metadata_required[Proxy metadata required]
 **** xref:packages/release_sbom_spdx.adoc#sbom_spdx__valid[Valid]

policy/lib/rule_data/rule_data.rego

@@ -165,11 +165,6 @@ defaults := {
 	# e.g., {"maven": ["^https://maven-proxy\\.example\\.com/.*"]}
 	"allowed_proxy_url_patterns": {},
 	#
-	# Used in release/sbom_cyclonedx and release/sbom_spdx
-	# PURL types for ecosystems where vendoring is possible and Hermeto attribution is required
-	# Current supported vendored types: ["golang", "cargo"]
-	"vendored_purl_types": ["golang", "cargo"],
-	#
 	# Used in release/lib/attestations.rego
 	# Allowed provenance buildTypes for PipelineRun attestations (both SLSA v0.2 and v1)
 	"allowed_provenance_build_types": [

policy/lib/sbom/sbom.rego

@@ -427,23 +427,6 @@ rule_data_errors contains error if {
 	}
 }
 
-# Verify vendored_purl_types is a list of unique strings.
-rule_data_errors contains error if {
-	some e in j.validate_schema(
-		rule_data.get("vendored_purl_types"),
-		{
-			"$schema": "http://json-schema.org/draft-07/schema#",
-			"type": "array",
-			"items": {"type": "string"},
-			"uniqueItems": true,
-		},
-	)
-	error := {
-		"message": sprintf("Rule data vendored_purl_types has unexpected format: %s", [e.message]),
-		"severity": e.severity,
-	}
-}
-
 # Verify allowed_proxy_url_patterns is an object mapping strings to arrays of strings.
 rule_data_errors contains error if {
 	some e in j.validate_schema(

policy/release/sbom/sbom_test.rego

@@ -391,33 +391,6 @@ test_proxy_rule_data_validation if {
 		with data.rule_data as d_bad_regex
 }
 
-test_vendored_purl_types_rule_data_validation if {
-	# Valid data - no errors
-	assertions.assert_empty(sbom.deny) with input.attestations as _sbom_attestation
-		with lib.sbom._verified_sbom_attestations as _sbom_attestation
-		with data.rule_data as {"vendored_purl_types": ["golang", "cargo"]}
-
-	# Invalid vendored_purl_types: wrong type and duplicate
-	d_bad := {"vendored_purl_types": [1, "golang", "golang"]}
-	expected_bad := {
-		{
-			"code": "sbom.disallowed_packages_provided",
-			# regal ignore:line-length
-			"msg": "Rule data vendored_purl_types has unexpected format: 0: Invalid type. Expected: string, given: integer",
-			"severity": "failure",
-		},
-		{
-			"code": "sbom.disallowed_packages_provided",
-			# regal ignore:line-length
-			"msg": "Rule data vendored_purl_types has unexpected format: (Root): array items[1,2] must be unique",
-			"severity": "failure",
-		},
-	}
-	assertions.assert_equal_results(expected_bad, sbom.deny) with input.attestations as _sbom_attestation
-		with lib.sbom._verified_sbom_attestations as _sbom_attestation
-		with data.rule_data as d_bad
-}
-
 test_anchoring_warnings_external_references if {
 	d := {
 		lib.sbom.rule_data_allowed_external_references_key: [

policy/release/sbom_cyclonedx/sbom_cyclonedx.rego

@@ -432,51 +432,6 @@ deny contains result if {
 	)
 }
 
-# METADATA
-# title: Hermeto attribution required
-# description: >-
-#   Registry dependencies with a PURL type listed in vendored_purl_types must
-#   be processed by Hermeto. When a hermetic build omits prefetch-input for a
-#   vendored ecosystem, Hermeto never runs and the SBOM contains only
-#   Syft-reported module-level data, which is insufficient for CVE analysis.
-#   This rule denies any such component that lacks the hermeto:found_by (or
-#   cachi2:found_by) property.
-# custom:
-#   short_name: hermeto_attribution_required
-#   failure_msg: >-
-#     Package %s has PURL type %q which requires Hermeto attribution but was
-#     not processed by Hermeto
-#   solution: >-
-#     Set the prefetch-input pipeline parameter to the Hermeto package manager
-#     name for the ecosystem (e.g. "gomod" for pkg:golang, "cargo" for
-#     pkg:cargo) so Hermeto processes the project's dependencies during the
-#     prefetch-dependencies task.
-#   collections:
-#   - redhat
-#   - policy_data
-#   - redhat_security
-#   effective_on: 2027-01-15T00:00:00Z
-deny contains result if {
-	vendored := {t | some t in rule_data.get("vendored_purl_types")}
-
-	some s in sbom.cyclonedx_sboms
-	some component in s.components
-
-	purl := component.purl
-	parsed_purl := ec.purl.parse(purl)
-	parsed_purl.type in vendored
-
-	sbom.is_registry_dependency(parsed_purl, component)
-
-	not sbom.component_found_by_hermeto(component)
-
-	result := metadata.result_helper_with_term(
-		rego.metadata.chain(),
-		[purl, parsed_purl.type],
-		purl,
-	)
-}
-
 _has_distribution_reference(component) if {
 	some reference in component.externalReferences
 	reference.type == "distribution"