docs: support registry-level scopes in trust policy - #330
Open
rgnote wants to merge 2 commits into
Open
Conversation
Extend `registryScopes` in the OCI trust policy to accept a registry host (a value with no `/` separator) in addition to a fully qualified repository URI. A registry scope applies the policy to every repository in that registry, which addresses the operational pain of enumerating a fully qualified URI per repository when trust is reasoned about at the registry (e.g. account+region) boundary. To keep the "exactly one applicable policy per artifact" invariant, the scope forms are given an explicit specificity ordering (repository > registry > global) and the most specific match wins, so a repository level exception can coexist with a broader registry or global policy. Matching is defined as exact, case-sensitive string comparison with no reference expansion, prefix matching, or case folding. Resolves notaryproject#289 Signed-off-by: Rakesh Gariganti <5878554+rgnote@users.noreply.github.com>
rgnote
requested review from
NiazFK,
gokarnm,
priteshbandi,
shizhMSFT,
toddysm,
vaninrao10 and
yizha1
as code owners
July 2, 2026 23:31
There was a problem hiding this comment.
Pull request overview
Updates the OCI trust policy specification to allow registryScopes entries to target either a specific repository (${registry-name}/${namespace}/${repository-name}) or an entire registry host (${registry-name}), and defines how implementations must select a single applicable policy using a specificity ordering.
Changes:
- Extend
registryScopesto support registry-host (no/) values in addition to fully qualified repository URIs. - Specify exact, case-sensitive matching semantics and a specificity order (repository > registry > global) to preserve the “exactly one applicable policy” invariant.
- Add an example demonstrating a registry-wide policy with a repository-level exception.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Rakesh Gariganti <5878554+rgnote@users.noreply.github.com>
yizha1
reviewed
Jul 27, 2026
| - The scope MUST contain one of the following: | ||
| - List of one or more fully qualified repository URIs. | ||
| - Each value in the scope collection MUST be one of the following: | ||
| - A fully qualified repository URI of the form `${registry-name}/${namespace}/${repository-name}`. |
Contributor
There was a problem hiding this comment.
What is the behavior if a user specify ${registry-name}/${namespace}, for example registry.acme-rockets.io/software/, does it mean all the repositories under software follow the specific policy?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extend
registryScopesin the OCI trust policy to accept a registry host (a value with no/separator) in addition to a fully qualified repository URI. A registry scope applies the policy to every repository in that registry, which addresses the operational pain of enumerating a fully qualified URI per repository when trust is reasoned about at the registry (e.g. account+region) boundary.To keep the "exactly one applicable policy per artifact" invariant, the scope forms are given an explicit specificity ordering (repository > registry > global) and the most specific match wins, so a repository level exception can coexist with a broader registry or global policy. Matching is defined as exact, case-sensitive string comparison with no reference expansion, prefix matching, or case folding.
Resolves #289