Add support for "**" in image glob matching

[imjasonh]

Signed-off-by: Jason Hall jason@chainguard.dev

Fixes #1903

This is WIP because it currently breaks a number of previous test cases, and I want to make sure this isn't considered a backward-incompatible change. Or if it is, that we're comfortable with this breakage.

Image policy globs now support ** to match any character; matching images that are specified like "ubuntu" or "myuser/myapp" should be matched with a glob like "index.docker.io/library/*" or "index.docker.io/*/*" respectively, rather than expecting "*" or "*/*" to match as before.

@hectorj2f @jdolitsky

[jdolitsky]

awesome. if breaking change is an issue, we can deprecate and make GlobMatchWithWarnings 😅?

[hectorj2f]

@imjasonh I believe you need to check the unit tests because they seem to be failing for the image_policies_test.

[imjasonh]

@imjasonh I believe you need to check the unit tests because they seem to be failing for the image_policies_test.

Yeah, the failures indicate the API breakage I'm talking about actually. The tests check image names like rando, which under this new logic would need a glob like index.docker.io/library/rando to match it. I'll need to relax the glob matching logic to handle this case with a warning like the others.