executor

type Options ¶

type Options struct {
	// Executors contains the configuration options for the executor per scope.
	// Each scope can have its own set of verifiers, stores, and policy
	// enforcer. At least one executor must be provided.
	// Required.
	Executors []ScopedOptions `json:"executors"`
}

Options contains the configuration options to create a scoped executor.

type ScopedExecutor ¶

type ScopedExecutor struct {
	// contains filtered or unexported fields
}

ScopedExecutor manages multiple ratify.Executor instances, each associated with specific scopes (registries or repositories). It provides a mechanism to route artifact validation requests to the appropriate executor based on the artifact's reference.

The executor supports three types of scope patterns:

• Wildcard registries: "*.example.com" matches any subdomain of example.com
• Specific registries: "registry.example.com" matches only that registry
• Repository paths: "registry.example.com/namespace/repo" matches a specific repository

Note: Top level domain wildcard is also not supported. That is, "*" is not a valid pattern. Scope matching follows a precedence order from most specific to least specific:

1. Exact repository match
2. Exact registry match
3. Wildcard registry match

func NewScopedExecutor(opts Options) (*ScopedExecutor, error)

func (s *ScopedExecutor) Resolve(ctx context.Context, artifact string) (ocispec.Descriptor, error)

func (s *ScopedExecutor) ValidateArtifact(ctx context.Context, artifact string) (*ratify.ValidationResult, error)

type ScopedOptions ¶

type ScopedOptions struct {
	// Scopes defines the scopes for which this executor is responsible.
	// Required.
	Scopes []string `json:"scopes"`

	// Verifiers contains the configuration options for the verifiers. Required.
	Verifiers []verifier.NewOptions `json:"verifiers"`

	// Stores contains the configuration options for the stores. Required.
	Stores []store.NewOptions `json:"stores"`

	// Policy contains the configuration options for the policy enforcer.
	// Optional.
	Policy *policyenforcer.NewOptions `json:"policyEnforcer,omitempty"`

	// Concurrency limits the maximum number of concurrent execution per
	// validation request. If less than or equal to 0, a default (currently 3)
	// is used. Optional.
	Concurrency int `json:"concurrency,omitempty"`
}

ScopedOptions contains the configuration options to create a group of plugins for the executor under a scope.