Add proper mirror support (#74)

* Add rewrite support and fix existing tests

* Add unit tests for policy matching

* Compile regexes up front and store policies in map

* Add test for verify flow with mirror

* Rename ImageName -> ResolvedName

And only set it when necessary

* Rename Rewrite -> Replacement

but keep it as rewrite in the yaml

test/testdata/local-policy-fail/mapping.yaml

@@ -1,11 +1,10 @@
-# map repos to policies
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: test-images
+  - id: test-images
     description: Local test images
     files:
-      - path: doi/policy.rego
+      - path: policy.rego
+rules:
+  - pattern: ".*"
+    policy-id: test-images

test/testdata/local-policy-mirror/mapping.yaml

@@ -0,0 +1,12 @@
+version: v1
+kind: policy-mapping
+policies:
+  - id: test-images
+    description: Local test images
+    files:
+      - path: policy.rego
+rules:
+  - pattern: "^docker[.]io/library/test-image$"
+    policy-id: test-images
+  - pattern: "^mirror[.]org/library/(.*)$"
+    rewrite: docker.io/library/$1

test/testdata/local-policy-mirror/policy.rego

@@ -0,0 +1,54 @@
+package attest
+
+import rego.v1
+
+keys := [{
+	"id": "6b241993defaba26558c64f94a94303ce860e7ad9163d801495c91cf57197c75",
+	"key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZmicqYSY38DprGr42jU0V3ND0ROj\nzSRH1+yjsxhh0bi52Hh/DuOhrSq2KJ5a09lW3ybnDjljowbkof0Y1i9Oow==\n-----END PUBLIC KEY-----",
+	"from": "2023-12-15T14:00:00Z",
+	"to": null,
+	# this key is still active
+	"status": "active",
+	"signing-format": "dssev1",
+}]
+
+provs(pred) := p if {
+	res := attest.fetch(pred)
+	not res.error
+	p := res.value
+}
+
+atts := union({
+	provs("https://slsa.dev/provenance/v0.2"),
+	provs("https://spdx.dev/Document"),
+})
+
+opts := {"keys": keys}
+
+statements contains s if {
+	some att in atts
+	res := attest.verify(att, opts)
+	not res.error
+	s := res.value
+}
+
+subjects contains subject if {
+	some statement in statements
+	some subject in statement.subject
+}
+
+success if {
+	print("input:",input)
+	true
+}
+
+result := {
+	"success": success,
+	"violations": set(),
+	"summary": {
+		"subjects": subjects,
+		"slsa_levels": ["SLSA_BUILD_LEVEL_3"],
+		"verifier": "docker-official-images",
+		"policy_uri": "https://docker.com/official/policy/v0.1",
+	},
+}

test/testdata/local-policy-no-tl/mapping.yaml

@@ -1,11 +1,10 @@
-# map repos to policies
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: test-images
+  - id: test-images
     description: Local test images
     files:
-      - path: doi/policy.rego
+      - path: policy.rego
+rules:
+  - pattern: ".*"
+    policy-id: test-images

test/testdata/local-policy-pass/mapping.yaml

@@ -1,16 +1,10 @@
-# map repos to policies
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: test-images
+  - id: test-images
     description: Local test images
     files:
-      - path: doi/policy.rego
-mirrors:
-  - policy-id: test-images
-    mirror:
-      domains: ["*"]
-      prefix: ""
+      - path: policy.rego
+rules:
+  - pattern: ".*"
+    policy-id: test-images

test/testdata/local-policy/mapping.yaml

@@ -1,29 +1,18 @@
-# map repos to policies
 version: v1
 kind: policy-mapping
 policies:
-  - origin:
-      domain: docker.io
-      prefix: library/
-    id: test-images
-    description: Local test images
+  - id: docker-official-images
+    description: Docker Official Images
     files:
-      - path: "doi/policy.rego"
-
-mirrors:
-  - policy-id: test-images
-    mirror:
-      domains: ["*"]
-      prefix: "repo"
-  - policy-id: test-images
-    mirror:
-      domains: ["*"]
-      prefix: "library/"
-  - policy-id: test-images
-    mirror:
-      domains: ["*"]
-      prefix: "test-image"
-  - policy-id: test-images
-    mirror:
-      domains: ["*"]
-      prefix: "image-signer-verifier-test"
+      - path: doi/policy.rego
+rules:
+  - pattern: "^docker[.]io/library/(.*)$"
+    policy-id: docker-official-images
+  - pattern: "repo$"
+    policy-id: docker-official-images
+  - pattern: "test-image$"
+    policy-id: docker-official-images
+  - pattern: "image-signer-verifier-test$"
+    policy-id: docker-official-images
+  - pattern: "library/(.*)$"
+    rewrite: docker.io/library/$1