policyScopeMatches reports whether a runtime-input scope key targets the policy attachment identified by its metadata name and raw ref. A scope matches when it equals the name or the ref exactly, or when its bare name (scheme, org and @sha256: digest stripped) matches; if the scope pins a digest, th
(scope, name, ref string)
| 60 | // (scheme, org and @sha256: digest stripped) matches; if the scope pins a |
| 61 | // digest, the ref must carry the same digest, otherwise any version matches. |
| 62 | func policyScopeMatches(scope, name, ref string) bool { |
| 63 | if scope == "" { |
| 64 | return false |
| 65 | } |
| 66 | if scope == name || scope == ref { |
| 67 | return true |
| 68 | } |
| 69 | |
| 70 | scopeName, scopeDigest := splitPolicyRef(scope) |
| 71 | if scopeName == "" { |
| 72 | return false |
| 73 | } |
| 74 | refName, refDigest := splitPolicyRef(ref) |
| 75 | if scopeName != refName && scopeName != name { |
| 76 | return false |
| 77 | } |
| 78 | if scopeDigest != "" { |
| 79 | return scopeDigest == refDigest |
| 80 | } |
| 81 | return true |
| 82 | } |
| 83 | |
| 84 | // splitPolicyRef normalizes a policy reference to its bare name and digest, |
| 85 | // stripping any scheme, org scope and @sha256: version using the same parsers |