Add proper mirror support (#74)

* Add rewrite support and fix existing tests

* Add unit tests for policy matching

* Compile regexes up front and store policies in map

* Add test for verify flow with mirror

* Rename ImageName -> ResolvedName

And only set it when necessary

* Rename Rewrite -> Replacement

but keep it as rewrite in the yaml

pkg/policy/testdata/mappings/doi/mapping.yaml

@@ -0,0 +1,10 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/mappings/local/mapping.yaml

@@ -0,0 +1,10 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: local-policy
+    description: Local Policy
+    files:
+      - path: local-policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images # note this policy does not exist in this file

pkg/policy/testdata/mappings/rewrite-invalid/mapping.yaml

@@ -0,0 +1,13 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "^mycoolmirror[.]org/library/(.*)$"
+    rewrite: "docker.io/library/$1"
+    policy-id: docker-official-images # invalid to specify both rewrite and policy-id

pkg/policy/testdata/mappings/rewrite-loop/mapping.yaml

@@ -0,0 +1,14 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "^yin/(.*)$"
+    rewrite: "yang/$1"
+  - pattern: "^yang/(.*)$"
+    rewrite: "yin/$1"

pkg/policy/testdata/mappings/rewrite-multiple/mapping.yaml

@@ -0,0 +1,14 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "^mycoolmirror[.]org/library/(.*)$"
+    rewrite: "docker.io/library/$1"
+  - pattern: "^myevencoolermirror[.]org/library/(.*)$"
+    rewrite: "mycoolmirror.org/library/$1"

pkg/policy/testdata/mappings/rewrite-to-local/mapping.yaml

@@ -0,0 +1,12 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: local-policy
+    description: Local Policy
+    files:
+      - path: local-policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images # note this policy does not exist in this file
+  - pattern: "^mycoolmirror[.]org/library/(.*)$"
+    rewrite: "docker.io/library/$1"

pkg/policy/testdata/mappings/rewrite-to-no-match/mapping.yaml

@@ -0,0 +1,12 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "^mycoolmirror[.]org/library/(.*)$"
+    rewrite: "badredirect.org/$1" # no matching rule for this rewrite

pkg/policy/testdata/mappings/simple-rewrite/mapping.yaml

@@ -0,0 +1,12 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "^mycoolmirror[.]org/library/(.*)$"
+    rewrite: "docker.io/library/$1"

pkg/policy/testdata/mock-tuf-allow-canonical/mapping.yaml

@@ -2,15 +2,16 @@
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: docker-official-images
+  - id: docker-official-images
     description: Docker Official Images
+    attestations:
+      repo: "localhost:5001/library-refs"
     files:
       - path: doi/policy.rego
-mirrors:
-  - policy-id: docker-official-images
-    mirror:
-      domains: [localhost:5001, registry.local:5000]
-      prefix: ""
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: ^localhost:5001/(.*)$
+    rewrite: docker.io/library/$1
+  - pattern: ^registry[.]local:5000/(.*)$
+    rewrite: docker.io/library/$1

pkg/policy/testdata/mock-tuf-allow/mapping.yaml

@@ -2,17 +2,16 @@
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: docker-official-images
+  - id: docker-official-images
     description: Docker Official Images
     attestations:
       repo: "localhost:5001/library-refs"
     files:
       - path: doi/policy.rego
-mirrors:
-  - policy-id: docker-official-images
-    mirror:
-      domains: [localhost:5001, registry.local:5000]
-      prefix: ""
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: ^localhost:5001/(.*)$
+    rewrite: docker.io/library/$1
+  - pattern: ^registry[.]local:5000/(.*)$
+    rewrite: docker.io/library/$1

pkg/policy/testdata/mock-tuf-deny/mapping.yaml

@@ -2,10 +2,10 @@
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: docker-official-images
+  - id: docker-official-images
     description: Docker Official Images
     files:
       - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/mock-tuf-verify-sig/mapping.yaml

@@ -2,10 +2,10 @@
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: docker-official-images
+  - id: docker-official-images
     description: Docker Official Images
     files:
       - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images

pkg/policy/testdata/mock-tuf-wrong-key/mapping.yaml

@@ -2,10 +2,10 @@
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: docker-official-images
+  - id: docker-official-images
     description: Docker Official Images
     files:
       - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images