Stephan Renatus

👋 hello @ogazitt welcome to this discussion. > OPCR is meant to be a reference implementation of a "policy registry" - it is single-user, free to use, and has no...

I've got ideas about how to deal with this, centered around well-annotated example rego files. So if you'd like to pick a builtin to document, please create a rego file...

It would be nice to have both `--fail` and `--diff` at the same time. Right now, `--fail` trumps `--diff`.

https://github.com/oras-project/oras-go/issues/49 done, alpha release out.

> I haven't verified this is the case yet. We should try to do that. 🔍 I'd imagine an infinite loop that queries, queries, queries, while having the decision logger...

Alternatively, we'd actually reuse the connection, I suppose.

FWIW the RNG source should come from the BuiltinContext. We've had to bend `io.jwt.encode_sign` and `_raw` to use it, though: https://github.com/open-policy-agent/opa/commit/e732b0b4823490a171f347560f1f4e13c509bd44. **But** controlling that alone doesn't give us completely reproducible...

Hah, good point. I guess it would make sense to not worry about the `io.jwt.encode_sign[_raw]` builtins too much. But thinking about this again, we also can't ever control `http.send` and...

Would it be that much, though? One time ns integer if time us used, one string for each encode_sign call... I suppose it would go into the decision logs entry,...

Hmm http.send is different, though. Those response payloads can be very large.