docs: support registry-level scopes in trust policy - #330
Conversation
Extend `registryScopes` in the OCI trust policy to accept a registry host (a value with no `/` separator) in addition to a fully qualified repository URI. A registry scope applies the policy to every repository in that registry, which addresses the operational pain of enumerating a fully qualified URI per repository when trust is reasoned about at the registry (e.g. account+region) boundary. To keep the "exactly one applicable policy per artifact" invariant, the scope forms are given an explicit specificity ordering (repository > registry > global) and the most specific match wins, so a repository level exception can coexist with a broader registry or global policy. Matching is defined as exact, case-sensitive string comparison with no reference expansion, prefix matching, or case folding. Resolves notaryproject#289 Signed-off-by: Rakesh Gariganti <5878554+rgnote@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates the OCI trust policy specification to allow registryScopes entries to target either a specific repository (${registry-name}/${namespace}/${repository-name}) or an entire registry host (${registry-name}), and defines how implementations must select a single applicable policy using a specificity ordering.
Changes:
- Extend
registryScopesto support registry-host (no/) values in addition to fully qualified repository URIs. - Specify exact, case-sensitive matching semantics and a specificity order (repository > registry > global) to preserve the “exactly one applicable policy” invariant.
- Add an example demonstrating a registry-wide policy with a repository-level exception.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Rakesh Gariganti <5878554+rgnote@users.noreply.github.com>
| - The scope MUST contain one of the following: | ||
| - List of one or more fully qualified repository URIs. | ||
| - Each value in the scope collection MUST be one of the following: | ||
| - A fully qualified repository URI of the form `${registry-name}/${namespace}/${repository-name}`. |
There was a problem hiding this comment.
What is the behavior if a user specify ${registry-name}/${namespace}, for example registry.acme-rockets.io/software/, does it mean all the repositories under software follow the specific policy?
There was a problem hiding this comment.
Thanks for the comment @yizha1
We accept only 1) a repository path, or 2) a registry path, or 3) a wildcard.
If a user provides registry.acme-rockets.io/software/, it is considered as a bad input since it does not belong to any of the three acceptable inputs (because of the trailing slash)
There was a problem hiding this comment.
I didn't make my question clear. For example, for these two repos, registry.acme-rockets.io/software/acme and registry.acme-rockets.io/software/acme, they shared the same policy, can I use registry.acme-rockets.io/software to match these two repo, so that I don't have to specify each of them in the policy.
Extend
registryScopesin the OCI trust policy to accept a registry host (a value with no/separator) in addition to a fully qualified repository URI. A registry scope applies the policy to every repository in that registry, which addresses the operational pain of enumerating a fully qualified URI per repository when trust is reasoned about at the registry (e.g. account+region) boundary.To keep the "exactly one applicable policy per artifact" invariant, the scope forms are given an explicit specificity ordering (repository > registry > global) and the most specific match wins, so a repository level exception can coexist with a broader registry or global policy. Matching is defined as exact, case-sensitive string comparison with no reference expansion, prefix matching, or case folding.
Resolves #289