Allow trusted builders by repo or tag

[modulo11]

Summary

With this change, the tag part of a trusted builder is ignored. Trusting a builder my/registry/builder at the moment does not also trust my/registry/builder:latest, which should be the same image. Following up on a Slack discussion, it might be more intuitive for users to trust an image regardless of any tag.

I took the opportunity to extract trusted/known builder handling into a common location.

Documentation

• Should this change be documented?
  • Yes, see #___
  • No

[natalieparellano]

Thank you for the contribution @modulo11 - the implementation looks solid.

I do want to circulate this a bit more to ensure that folks are on board with it - I've added it to the agenda for the next working group. There are two things to note:

• We'll auto trust deprecated images (e.g., heroku/builder:22) in this case, but we do that already (because heroku/builder:22 is on the trusted list though it's not suggested)
• We could end up auto-trusting "dev" images, which worries me a little. Folks might not be placing the same care into the creation of those images compared to ones that get promoted to production. But that seems more of a risk for bugs vs malicious content.

[modulo11]

@natalieparellano any updates from the working group meeting?

[natalieparellano]

@natalieparellano any updates from the working group meeting?

I missed it 🙀 - @jabrown85 do you recall if this was discussed?

[jabrown85]

Ah yeah - we did discuss this one the other day. The consensus of the those in the Working Group was that we like the idea of being able to trust a repo. E.g. pack config trusted-builders add heroku/builders in addition to the pack config trusted-builders add heroku/builders:24. We want users to be able to continue trusting only a tag. Auto-stripping the tag and trusting the entire repository could lead to users trusting things like heroku/builders:24-rc3.dev which is unexpected.

[natalieparellano]

Awesome - thank you @jabrown85! @modulo11 would you be able to update the implementation to reflect that?

[modulo11]

I updated the PR according to the discussion. The current behavior (also seen in the tests) is:

• Trusting my/trusted/builder-jammy will trust any tag, e.g., my/trusted/builder-jammy:1.2.3 and my/trusted/builder-jammy:latest
• Trusting my/trusted/builder-jammy:1.2.3 will only trust this specific tag
• Trusting my/trusted/builder-jammy:latest will only trust the latest tag, so my/trusted/builder-jammy:1.2.3 will be untrusted