feat!: remove MockTUFClient (#135)

* feat! remove MockTUFClient

*Breaking*
- use LocalPolicyDir and nil TUFClient instead

Other:
- add stateful Verifier

pkg/policy/testdata/policies/allow-canonical/doi/policy.rego

@@ -0,0 +1,11 @@
+package attest
+
+import rego.v1
+
+default canonical = false
+
+canonical if {
+  not input.tag
+}
+
+result := {"success": canonical}

pkg/policy/testdata/policies/allow-canonical/mapping.yaml

@@ -0,0 +1,17 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    attestations:
+      repo: "localhost:5001/library-refs"
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: ^localhost:5001/(.*)$
+    rewrite: docker.io/library/$1
+  - pattern: ^registry[.]local:5000/(.*)$
+    rewrite: docker.io/library/$1

pkg/policy/testdata/policies/allow/doi/policy.rego

@@ -0,0 +1,7 @@
+package attest
+
+import rego.v1
+
+result := {
+  "success": true,
+}

pkg/policy/testdata/policies/allow/mapping.yaml

@@ -0,0 +1,17 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    attestations:
+      repo: "localhost:5001/library-refs"
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: ^localhost:5001/(.*)$
+    rewrite: docker.io/library/$1
+  - pattern: ^registry[.]local:5000/(.*)$
+    rewrite: docker.io/library/$1

pkg/policy/testdata/policies/deny/doi/policy.rego

@@ -0,0 +1,7 @@
+package attest
+
+import rego.v1
+
+result := {
+  "success": false,
+}

pkg/policy/testdata/policies/deny/mapping.yaml

@@ -0,0 +1,11 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/policies/no-rego/doi/policy.yaml

@@ -0,0 +1 @@
+policy: "this is not rego"

pkg/policy/testdata/policies/no-rego/mapping.yaml

@@ -0,0 +1,11 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.yaml
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/policies/verify-sig/doi/policy.rego

@@ -0,0 +1,19 @@
+package attest
+
+import rego.v1
+
+keys := [{
+	"id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
+	"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----",
+	"from": "2023-12-15T14:00:00Z",
+	"to": null,
+}]
+
+opts := {"keys": keys}
+
+success if {
+	some env in attest.fetch("foo")
+	statement := attest.verify(env, opts)
+}
+
+result := {"success": success}

pkg/policy/testdata/policies/verify-sig/mapping.yaml

@@ -0,0 +1,11 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/policies/wrong-key/doi/policy.rego

@@ -0,0 +1,30 @@
+package attest
+
+import rego.v1
+
+keys := [{
+	"id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
+	"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHyZpSgzvqFqNv7f3x7865OS38rAb\nQMcff55zM2UH/KR3Pr84a8QsGDNgaNGzJQJWjtMSgfV8WnNoffNK+svFNg==\n-----END PUBLIC KEY-----",
+	"from": "2023-12-15T14:00:00Z",
+	"to": null,
+}]
+
+default success := false
+
+provs(pred) := p if {
+	res := attest.fetch(pred)
+	not res.error
+	p := res.value
+}
+
+atts := union({provs("foo")})
+
+opts := {"keys": keys}
+
+success if {
+	some env in atts
+	res := attest.verify(env, opts)
+	not res.error
+}
+
+result := {"success": success}

pkg/policy/testdata/policies/wrong-key/mapping.yaml

@@ -0,0 +1,11 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images