Use constants for TUF roots

util/security/registry_jwt.py

@@ -9,6 +9,8 @@ logger = logging.getLogger(__name__)
 ANONYMOUS_SUB = '(anonymous)'
 ALGORITHM = 'RS256'
 CLAIM_TUF_ROOT = 'com.apostille.root'
+QUAY_TUF_ROOT = 'quay'
+SIGNER_TUF_ROOT = 'signer'
 
 # The number of allowed seconds of clock skew for a JWT. The iat, nbf and exp are adjusted with this
 # count.
@@ -106,7 +108,7 @@ def build_context_and_subject(user=None, token=None, oauthtoken=None, tuf_root=N
   
   # Default to quay root if not explicitly granted permission to see signer root
   if not tuf_root:
-    tuf_root = 'quay'
+    tuf_root = QUAY_TUF_ROOT
     
   if oauthtoken:
     context = {