[Spike] Evaluate regsync for registries without periodic sync

[paralta]

Follow up on: #648

Description

Investigate leveraging regsync to enable periodic sync for registries that lack Catalog API support (GHCR, ACR).

Context

The Zot sync extension requires the OCI Catalog API (/v2/_catalog) for periodic sync. GHCR and ACR don't support this API, limiting them to on-demand sync only. regsync from the regclient project may offer an alternative approach for scheduled mirroring.

Investigation Tasks

• Test regsync with GHCR as source registry
• Validate OCI v1.1 referrers support for cosign signature sync
• Evaluate regsync capabilities compared to zot sync capabilities
• Assess performance implications and latency

[paralta]

Summary

We evaluated regsync as an alternative for syncing from registries that don't support the Catalog API (/v2/_catalog). Built a PoC to test GHCR sync, authentication, and cosign signature preservation.

Findings

regsync is a viable solution for enabling periodic sync from registries that lack Catalog API support (GHCR, ACR).

Key Validations

Test	Result	Notes
GHCR sync without Catalog API	✅ Pass	Uses explicit repository references
OCI v1.1 referrers (cosign)	✅ Supported	referrers: true

---

Workload Distribution

Approach	Sync Workload	Pros	Cons
Zot Sync Extension	Handled by Zot registry	Native integration, no extra process	Requires Catalog API
regsync	External process (service)	Works with any registry	Additional component to deploy

Zot Sync (Native)

• Workload handled inside the registry
• Configuration via Zot config JSON
• Polling managed by Zot

regsync (External)

• Workload handled by DIR server or dedicated service
• Configuration via YAML file
• Requires dedicated service or cron job

---

Recommendation

Implement a hybrid sync approach:

1. Use Zot sync extension for registries with Catalog API (Harbor, self-hosted Zot)
2. Use regsync service for GHCR/ACR with config generated from DIR's sync API

                         ┌─────────────────────────────────────────┐
                         │              DIR Server                 │
                         │  ┌───────────────────────────────────┐  │
                         │  │           Zot Registry            │  │
                         │  └───────────────┬───────────────────┘  │
                         │                  │                      │
                         │       ┌──────────┴──────────┐           │
                         │       │                     │           │
                         │       ▼                     ▼           │
                         │  ┌──────────┐        ┌──────────┐       │
                         │  │ Zot Sync │        │ regsync  │       │
                         │  │Extension │        │ Service  │       │
                         │  └────┬─────┘        └────┬─────┘       │
                         └───────┼───────────────────┼─────────────┘
                                 │                   │
        ┌────────────────────────┤                   ├────────────────────┐
        │                        │                   │                    │
        ▼                        ▼                   ▼                    ▼
  ┌───────────┐  ┌───────────┐  ┌───────────┐  ┌───────────┐  ┌───────────┐
  │  Harbor   │  │Docker Hub │  │Amazon ECR │  │   GHCR    │  │ Azure ACR │
  └───────────┘  └───────────┘  └───────────┘  └───────────┘  └───────────┘
  ┌───────────┐  ┌───────────┐
  │ Self-host │  │  JFrog    │
  │    Zot    │  │Artifactory│
  └───────────┘  └───────────┘