podman image trust set/show - option to use $XDG_CONFIG_HOME/containers/policy.json

[jsbiff]

Feature request description

podman commands will check for policy settings in $XDG_CONFIG_HOME/containers/policy.json

For example, the following error shows podman looking for the user policy.json file:

podman pull docker.io/library/httpd Error: no policy.json file found at any of the following: "/home/user/.config/containers/policy.json", "/etc/containers/policy.json"

BUT, currently the podman image trust command will ONLY set or show policy from the system file /etc/containers/policy.json

A new command switch should be added for the podman image trust set|show command, to tell it to show/create/update the user file instead of the system file, to support rootless operation.

Suggest potential solution

Say, for example the switch added for this FR is --user or -u, then, given that the file $XDG_CONFIG_HOME/containers/policy.json does NOT yet exist:

podman image trust set --user -t signedBy default

Would CREATE a new $XDG_CONFIG_HOME/containers/policy.json file and set the default policy to signedBy.

IF the user policy file already exists, it would be updated.

Then:

podman image trust show -u

Would list policies defined in the $XDG_CONFIG_HOME/containers/policy.json file (in this case, only the default policy has been set so far)

Have you considered any alternatives?

Possibly, instead of a switch specifically looking for and updating $XDG_CONFIG_HOME/containers/policy.json , you could provide an option to explicitly specify any file path? However, since only two places are valid for the rest of podman (the system path /etc/containers/policy.json and $XDG_CONFIG_HOME/containers/policy.json), I'm not sure there's much value in allowing other paths to be specified)

Additional context

Add any other context or screenshots about the feature request here.