Notary v2镜像签名与策略治理（签名-信任策略）最佳实践

实现示例type Sig = { alg: 'RS256'; kid: string; b64: string } type Image = { name: string; tag: string; digest: string } type Trust = { allowKids: Set<string>; allowAlgs: Set<string> } function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function validSig(s: Sig, t: Trust): boolean { return t.allowAlgs.has(s.alg) && t.allowKids.has(s.kid) && /^[A-Za-z0-9+/=]+$/.test(s.b64) } function validImage(i: Image): boolean { return !!i.name && !!i.tag && hex64(i.digest) } function allowDeploy(i: Image, s: Sig, t: Trust): boolean { return validImage(i) && validSig(s, t) } 审计与运行治理审计签名密钥与算法、摘要；不合规阻断部署并回退。信任策略变更需审批与归档。