refactor: drop unused registry config path overrides

Only registries.conf was ever set (by tests); PolicyConfigPath,
CertsDirPaths, and ContainersAuthPath were always empty and fell through
to the container ecosystem default search locations. Remove the exported
ConfigOptions struct and ClientOptConfigOptions option, and replace them
with an unexported withRegistriesConfigPath test hook. No production
behavior changes; avoids committing public API to the still-experimental
oras-go v3 config surface.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

pkg/registry/client.go

@@ -57,14 +57,6 @@ storing semantic versions, Helm adopts the convention of changing plus (+) to
 an underscore (_) in chart version tags when pushing to a registry and back to
 a plus (+) when pulling from a registry.`
 
-// ConfigOptions specifies override paths for container ecosystem config files.
-type ConfigOptions struct {
-	RegistriesConfigPath string
-	PolicyConfigPath     string
-	CertsDirPaths        []string
-	ContainersAuthPath   string
-}
-
 type (
 	// RemoteClient shadows the ORAS remote.Client interface
 	// (hiding the ORAS type from Helm client visibility)
@@ -92,7 +84,9 @@ type (
 		builder               *remote.ClientBuilder
 		policyEvaluator       *policy.Evaluator
 		signatureVerification bool
-		configOptions         ConfigOptions
+		// registriesConfigPath overrides the registries.conf path; empty means
+		// the container ecosystem default search locations are used. Test-only.
+		registriesConfigPath string
 		insecure              bool
 		certFile              string
 		keyFile               string
@@ -137,11 +131,10 @@ func NewClient(options ...ClientOption) (*Client, error) {
 	// Load the full container ecosystem config stack: Docker config.json,
 	// containers auth.json, registries.conf, policy.json, certs.d, registries.d.
 	// Missing files are silently skipped.
+	// Only registries.conf is overridable (empty means default search); all
+	// other config files always resolve to their default locations.
 	loaderOpts := remoteconfig.LoadConfigsOptions{
-		RegistriesConfigPath: client.configOptions.RegistriesConfigPath,
-		PolicyConfigPath:     client.configOptions.PolicyConfigPath,
-		CertsDirPaths:        client.configOptions.CertsDirPaths,
-		ContainersAuthPath:   client.configOptions.ContainersAuthPath,
+		RegistriesConfigPath: client.registriesConfigPath,
 	}
 	configs, err := remoteconfig.LoadConfigsWithOptions(loaderOpts)
 	if err != nil {
@@ -415,10 +408,12 @@ func ClientOptSignatureVerification(enabled bool) ClientOption {
 	}
 }
 
-// ClientOptConfigOptions returns a function that overrides default config file paths.
-func ClientOptConfigOptions(o ConfigOptions) ClientOption {
+// withRegistriesConfigPath overrides the registries.conf path. It is unexported
+// because the only consumer is hermetic tests; production always uses the
+// container ecosystem default search locations.
+func withRegistriesConfigPath(path string) ClientOption {
 	return func(c *Client) {
-		c.configOptions = o
+		c.registriesConfigPath = path
 	}
 }
 

pkg/registry/client_test.go

@@ -230,16 +230,14 @@ func TestNewClient_WithDenyAllPolicy(t *testing.T) {
 	require.Same(t, evaluator, c.policyEvaluator)
 }
 
-func TestNewClient_WithConfigOptions(t *testing.T) {
+func TestNewClient_WithRegistriesConfigPath(t *testing.T) {
 	t.Parallel()
 
 	credFile := filepath.Join(t.TempDir(), "config.json")
 	c, err := NewClient(
 		ClientOptWriter(io.Discard),
 		ClientOptCredentialsFile(credFile),
-		ClientOptConfigOptions(ConfigOptions{
-			RegistriesConfigPath: "/nonexistent/registries.conf",
-		}),
+		withRegistriesConfigPath("/nonexistent/registries.conf"),
 	)
 	require.NoError(t, err) // nonexistent paths are silently skipped
 	require.NotNil(t, c)
@@ -271,7 +269,7 @@ func TestLogin_LocationRewrite(t *testing.T) {
 	c, err := NewClient(
 		ClientOptWriter(io.Discard),
 		ClientOptCredentialsFile(credFile),
-		ClientOptConfigOptions(ConfigOptions{RegistriesConfigPath: registriesConf}),
+		withRegistriesConfigPath(registriesConf),
 	)
 	require.NoError(t, err)