feat: add PolicyCheck callback to CopyOptions#1189
Merged
Conversation
Add an optional PolicyCheck callback on CopyOptions, invoked with the source reference at the start of Copy. A non-nil return aborts the copy with the policy error wrapped via %w. This lets callers plug in policy enforcement (e.g., containers-policy.json) without the root oras package taking a dependency on the policy package. Signed-off-by: Terry Howe <terrylhowe@gmail.com>
TerryHowe
requested review from
Wwwsylvia,
sabre1041 and
shizhMSFT
as code owners
May 23, 2026 18:06
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1189 +/- ##
=======================================
Coverage 83.09% 83.10%
=======================================
Files 82 82
Lines 5743 5746 +3
=======================================
+ Hits 4772 4775 +3
Misses 600 600
Partials 371 371 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an optional
PolicyCheckcallback toCopyOptions:Copyinvokes it once with the source reference before any I/O. A non-nil return aborts the copy and the error is wrapped via%w(policy check failed for %s: %w).When
PolicyCheckis nil the behavior is unchanged.Why
Lets callers plug in policy enforcement (e.g., containers-policy.json signature/identity checks) without the root
oraspackage taking a build-time dependency on thepolicypackage. Keeps theoras<->registry/remote/policyboundary clean.Part of the v3 PR-by-PR breakdown (PR 17:
feat/copy-policy-check). Self-contained; no new package deps.(Note: prs.md lists
content_test.go,example_test.go, andexample_copy_test.gounder this PR, but those diffs infeat/everythingare actuallyrepo.Registry.PlainHTTP/NewCredentialFuncrenames that belong to PR 13. They are intentionally excluded here so this PR stays scoped to PolicyCheck.)Test plan
go build -mod=mod ./...go test -mod=mod -run TestCopy_PolicyCheck -v .— PASS forrejected,allowed,no policysubtestsgo test -mod=mod -run Copy .— full Copy test family passes