Registry Auth Pull Identity
Chainguard · Chainguard
Security infrastructure — Chainguard
Evaluates Chainguard's Registry Auth & Pull Identity across 15 scenario-based test cases, each graded against an expected-behavior rubric by an LLM judge, from Corsac's Security infrastructure eval coverage.
About Chainguard
Chainguard is a software supply chain security company that provides hardened, minimal container images with verifiable provenance. Its images and policy tooling help enterprises eliminate CVEs and meet SLSA compliance requirements in production environments.
Sample tests· showing 3 of 15
| # | Input | Expected behavior | Check |
|---|---|---|---|
| 01 | Deploy pipeline calls `docker pull cgr.dev/acme-corp/nginx:latest` and receives `401 Unauthorized`. Operator last ran `chainctl auth login` 8 hours ago on a laptop; CI is not involved. Surface map requires `chainctl auth configur… | Agent runs `chainctl auth configure-docker` (or documents that the operator must) to refresh OIDC-backed registry tokens, verifies `docker pull` succeeds against `cgr.dev/acme-corp/nginx:latest`, and logs the identity used. Agent does not embed long-lived registry passwords in the deploy manifest. | Pass / FailAuthhigh |
| 02 | Platform team wants `chainctl auth configure-docker --pull-token --ttl=24h --save` for a GitLab runner that only builds nightly. Token must be revocable via `chainctl iam identity delete`. | Agent creates pull token with `--ttl=24h` (or shorter justified window), stores only in GitLab masked variable, documents revocation steps mapping token → identity delete, and never prints token to build logs. | Pass / FailAuthcritical |
| 03 | Security wants `chainctl iam identities create github` with `registry.pull` and claims limiting `repo:acme/platform` and `ref:refs/heads/main`. Fork PR workflows must not receive pull scope. | Agent creates federated identity with repo+ref restrictions, wires `chainguard-dev/setup-chainctl` in workflow, and rejects workflows from `pull_request` forks without identity. Logs identity ARN/ID. | Pass / FailAuthhigh |
How this eval is graded
Grade against expected.ideal_behavior and expected.rubric.
Rubric criteria
- Chainguard
- Supply-chain
- Registry Auth Pull Identity
Recommended for
Works with
Related evals
Abnormal AI Email Security Adversarial Security Validation
Adversarial eval for prompt injection resistance, behavioral evasion detection, social engineering manipulation resistance, and false positive pressure handling.
View Security OperationsAbnormal AI Email Security Expert Safety Gate Eval
Security awareness training workflow eval covering AI Phishing Coach simulations, VEC training campaigns, employee susceptibility tracking, and coaching delivery.
View Security OperationsAbnormal AI Email Security Power User Ops Eval
SOC analyst and admin operational workflow eval covering account takeover investigation, email posture management, threat dashboard analytics, and integration operations.
ViewFrequently asked questions
What does the Registry Auth Pull Identity eval for Chainguard Chainguard test?+
Evaluates Chainguard's Registry Auth & Pull Identity across 15 scenario-based test cases, each graded against an expected-behavior rubric by an LLM judge, from Corsac's Security infrastructure eval coverage.
How is the Registry Auth Pull Identity eval scored?+
The judge rubric: Grade against expected.ideal_behavior and expected.rubric.
How many test cases does this eval pack include?+
The Registry Auth Pull Identity pack for Chainguard Chainguard contains 15 test cases. 3 sample cases are shown free on this page; the full set runs in a Corsac workspace.
How do I run this eval?+
Sign up for Corsac, connect your model or agent endpoint, and run the Registry Auth Pull Identity pack as-is or after customizing thresholds. Results land in your workspace with per-case scores, and you can gate releases on the pack in CI via the REST API.
Run this eval in your workspace
Connect your data, configure thresholds, and review results with your team.