Ambiguous rule set: ALLOW foo while DISALLOW * is also a rule

[vladimir-v-diaz]

The following example is used in the layout creation document (see in-toto/in-toto#182):

step_update.add_product_rule_from_string("ALLOW demo-project/foo.py")
step_update.add_product_rule_from_string("DISALLOW *")

These two rules together seem to contradict each other. I personally find it easier to grok DISALLOW * EXCEPT "demo-project/foo.py" or ALLOW * EXCEPT "foo". However, I'm not familiar with in-toto's rules and why things are designed this way.

[adityasaky]

I'm taking a pass at our issues backlog. From https://github.com/in-toto/docs/blob/master/in-toto-spec.md#4331-rule-processing:

They operate in a similar fashion as firewall rules do. This means if an artifact is successfully consumed by a rule, it is removed from the queue and cannot be consumed by subsequent rules.

Revisiting via #4 when considering the documentation of artifact rules makes sense to me, in the meantime I think we can close this issue as the spec indicates how the scenario described here works.