Fold enforce-tag-immutability into harden-zot-registry #235

Merged

eblume merged 1 commit from enforce-tag-immutability into main

2026-02-21 08:05:17 -08:00

Author	SHA1	Message	Date
Erich Blume	b42660f881	Fold enforce-tag-immutability into harden-zot-registry Tag immutability requires auth to be meaningful, so it can't be resolved independently. Replace client-side push checks with server-side accessControl policy: artifact-workloads group gets read+create (no update/delete), enforcing immutability at the registry level. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-21 07:52:49 -08:00

Author

SHA1

Message

Date

Erich Blume

b42660f881

Fold enforce-tag-immutability into harden-zot-registry

Tag immutability requires auth to be meaningful, so it can't be resolved
independently. Replace client-side push checks with server-side
accessControl policy: artifact-workloads group gets read+create (no
update/delete), enforcing immutability at the registry level.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-21 07:52:49 -08:00