scripts/simple-tests.sh ran `skopeo copy ... docker-archive:/tmp/registry-src.tar`
inside do_tests, so the second iteration (v3.0.0) failed with "docker-archive
doesn't support modifying existing images" because the v2.8.1 pass had already
written the file. Move the source-image fetch into its own prepare_source_image
called once from main(), and guard with -f so reruns are idempotent.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
distribution/distribution v3.0.0 replaced libtrust with go-jose and keys
its trustedKeys map by RFC 7638 JWK thumbprint, so tokens signed with the
old libtrust-style kid header (which v2.8.1 used) are no longer matched.
Switch to emitting the signing certificate in the JWS x5c protected
header. Both v2.8.1 (parseAndVerifyCertChain) and v3.0.0 (verifyCertChain)
verify x5c against the rootcertbundle, so the same token works on both —
no libtrust dependency needed.
- pkg/server/auth.go: drop libtrust kid derivation; embed the signing
cert as base64 DER in the x5c header.
- go.mod/go.sum: remove github.com/docker/libtrust (archived).
- scripts/simple-tests.sh: parametrize REGISTRY_VERSIONS so CI exercises
both v2.8.1 and v3.0.0 (defaults to both).
- pkg/server/server_test.go: cover the x5c regression and the
previously-untested Authenticate / Authorize / DecodeScope* paths
(raises pkg/server coverage from 0% to ~27%).
- README/README_zh: note v2/v3 dual compatibility and v3's config path.
- CLAUDE.md: project guidance with the x5c rationale.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
