func repositoryScope(refspec reference.Spec, push bool) (string, error) {
	u, err := url.Parse("dummy://" + refspec.Locator)
	if err != nil {
		return "", err
	}
	s := "repository:" + strings.TrimPrefix(u.Path, "/") + ":pull"
	if push {
		s += ",push"
	}
	return s, nil
}
repositoryScope returns a repository scope string such as "repository:foo/bar:pull"
for "host/foo/bar:baz".
When push is true, both pull and push are added to the scope.
package docker
import (
	"context"
	"net/url"
	"sort"
	"strings"
	"github.com/containerd/containerd/reference"
)