diff --git a/pkg/cli/server/extensions_test.go b/pkg/cli/server/extensions_test.go
index eab785ff9d..5cc6cfa0a3 100644
--- a/pkg/cli/server/extensions_test.go
+++ b/pkg/cli/server/extensions_test.go
@@ -1637,3 +1637,134 @@ func TestOverlappingSyncRetentionConfig(t *testing.T) {
 		So(string(data), ShouldContainSubstring, "overlapping sync content\":{\"Prefix\":\"prod/*")
 	})
 }
+
+func TestSyncWithRemoteStorageConfig(t *testing.T) {
+	oldArgs := os.Args
+
+	defer func() { os.Args = oldArgs }()
+
+	Convey("Test verify sync with remote storage works if sync.tmpdir is provided", t, func(c C) {
+		tmpfile, err := os.CreateTemp("", "zot-test*.json")
+		So(err, ShouldBeNil)
+		defer os.Remove(tmpfile.Name()) // clean up
+
+		content := `{
+			"distSpecVersion": "1.1.0-dev",
+			"storage": {
+				"rootDirectory": "%s",
+				"dedupe": false,
+				"remoteCache": false,
+				"storageDriver": {
+					"name": "s3",
+					"rootdirectory": "/zot",
+					"region": "us-east-2",
+					"regionendpoint": "localhost:4566",
+					"bucket": "zot-storage",
+					"secure": false,
+					"skipverify": false
+				}
+			},
+			"http": {
+				"address": "0.0.0.0",
+				"port": "%s"
+			},
+			"log": {
+				"level": "debug",
+				"output": "%s"
+			},
+			"extensions": {
+				"sync": {
+					"tmpDir": "/tmp/sync",
+					"registries": [
+						{
+							"urls": [
+								"http://localhost:9000"
+							],
+							"onDemand": true,
+							"tlsVerify": false,
+							"content": [
+								{
+									"prefix": "**"
+								}
+							]
+						}
+					]
+				}
+			}
+		}`
+
+		logPath, err := runCLIWithConfig(t.TempDir(), content)
+		So(err, ShouldBeNil)
+
+		data, err := os.ReadFile(logPath)
+		So(err, ShouldBeNil)
+		defer os.Remove(logPath) // clean up
+		So(string(data), ShouldNotContainSubstring,
+			"using both sync and remote storage features needs config.Extensions.Sync.TmpDir to be specified")
+	})
+
+	Convey("Test verify sync with remote storage panics if sync.tmpdir is not provided", t, func(c C) {
+		port := GetFreePort()
+		logFile, err := os.CreateTemp("", "zot-log*.txt")
+		So(err, ShouldBeNil)
+		defer os.Remove(logFile.Name()) // clean up
+
+		tmpfile, err := os.CreateTemp("", "zot-test*.json")
+		So(err, ShouldBeNil)
+		defer os.Remove(tmpfile.Name()) // clean up
+		content := fmt.Sprintf(`{
+			"distSpecVersion": "1.1.0-dev",
+			"storage": {
+				"rootDirectory": "%s",
+				"dedupe": false,
+				"remoteCache": false,
+				"storageDriver": {
+					"name": "s3",
+					"rootdirectory": "/zot",
+					"region": "us-east-2",
+					"regionendpoint": "localhost:4566",
+					"bucket": "zot-storage",
+					"secure": false,
+					"skipverify": false
+				}
+			},
+			"http": {
+				"address": "0.0.0.0",
+				"port": "%s"
+			},
+			"log": {
+				"level": "debug",
+				"output": "%s"
+			},
+			"extensions": {
+				"sync": {
+					"registries": [
+						{
+							"urls": [
+								"http://localhost:9000"
+							],
+							"onDemand": true,
+							"tlsVerify": false,
+							"content": [
+								{
+									"prefix": "**"
+								}
+							]
+						}
+					]
+				}
+			}
+		}`, t.TempDir(), port, logFile.Name())
+
+		err = os.WriteFile(tmpfile.Name(), []byte(content), 0o0600)
+		So(err, ShouldBeNil)
+
+		So(func() { _ = cli.NewServerRootCmd().Execute() }, ShouldPanic)
+
+		data, err := os.ReadFile(logFile.Name())
+		So(err, ShouldBeNil)
+		defer os.Remove(logFile.Name()) // clean up
+		So(string(data), ShouldContainSubstring,
+			"using both sync and remote storage features needs config.Extensions.Sync.TmpDir to be specified")
+	})
+}
diff --git a/pkg/cli/server/root.go b/pkg/cli/server/root.go
index 1f5b3682a7..c129d5ddc0 100644
--- a/pkg/cli/server/root.go
+++ b/pkg/cli/server/root.go
@@ -381,6 +381,13 @@ func validateConfiguration(config *config.Config, log zlog.Logger) error {
 			return zerr.ErrBadConfig
 		}
 
+		// enforce tmpDir in case sync + s3
+		if config.Extensions != nil && config.Extensions.Sync != nil && config.Extensions.Sync.TmpDir == "" {
+			log.Error().Err(zerr.ErrBadConfig).
+				Msg("using both sync and remote storage features needs config.Extensions.Sync.TmpDir to be specified")
+
+			return zerr.ErrBadConfig
+		}
 	}
 
 	// enforce s3 driver on subpaths in case of using storage driver
@@ -396,6 +403,14 @@ func validateConfiguration(config *config.Config, log zlog.Logger) error {
 
 						return zerr.ErrBadConfig
 					}
+
+					// enforce tmpDir in case sync + s3
+					if config.Extensions != nil && config.Extensions.Sync != nil && config.Extensions.Sync.TmpDir == "" {
+						log.Error().Err(zerr.ErrBadConfig).
+							Msg("using both sync and remote storage features needs config.Extensions.Sync.TmpDir to be specified")
+
+						return zerr.ErrBadConfig
+					}
 				}
 			}
 		}
diff --git a/pkg/extensions/extension_sync.go b/pkg/extensions/extension_sync.go
index a8f9c16f9f..f72028fa40 100644
--- a/pkg/extensions/extension_sync.go
+++ b/pkg/extensions/extension_sync.go
@@ -6,7 +6,6 @@ package extensions
 import (
 	"net"
 	"net/url"
-	"os"
 	"strings"
 
 	zerr "zotregistry.io/zot/errors"
@@ -47,13 +46,9 @@ func EnableSyncExtension(config *config.Config, metaDB mTypes.MetaDB,
 			}
 
 			tmpDir := config.Extensions.Sync.TmpDir
-			if tmpDir == "" {
-				// use an os tmpdir as tmpdir if not set
-				tmpDir = os.TempDir()
-			}
+			credsPath := config.Extensions.Sync.CredentialsFile
 
-			service, err := sync.New(registryConfig, config.Extensions.Sync.CredentialsFile, tmpDir,
-				storeController, metaDB, log)
+			service, err := sync.New(registryConfig, credsPath, tmpDir, storeController, metaDB, log)
 			if err != nil {
 				return nil, err
 			}
diff --git a/pkg/extensions/sync/destination.go b/pkg/extensions/sync/destination.go
index 36483d4cf1..5150bc7576 100644
--- a/pkg/extensions/sync/destination.go
+++ b/pkg/extensions/sync/destination.go
@@ -37,22 +37,18 @@ type DestinationRegistry struct {
 }
 
 func NewDestinationRegistry(
-	storeController storage.StoreController,
-	tmpStorage OciLayoutStorage,
+	storeController storage.StoreController, // local store controller
+	tempStoreController storage.StoreController, // temp store controller
 	metaDB mTypes.MetaDB,
 	log log.Logger,
 ) Destination {
-	if tmpStorage == nil {
-		// to allow passing nil we can do this, noting that it will only work for a local StoreController
-		tmpStorage = NewOciLayoutStorage(storeController)
-	}
 	return &DestinationRegistry{
 		storeController: storeController,
+		tempStorage:     NewOciLayoutStorage(tempStoreController),
 		metaDB:          metaDB,
 		// first we sync from remote (using containers/image copy from docker:// to oci:) to a temp imageStore
 		// then we copy the image from tempStorage to zot's storage using ImageStore APIs
-		tempStorage: tmpStorage,
-		log:         log,
+		log: log,
 	}
 }
 
@@ -288,9 +284,11 @@ func getImageStoreFromImageReference(imageReference types.ImageReference, repo,
 		tempRootDir = strings.ReplaceAll(imageReference.StringWithinTransport(), fmt.Sprintf("%s:", repo), "")
 	}
 
-	metrics := monitoring.NewMetricsServer(false, log.Logger{})
+	return getImageStore(tempRootDir)
+}
 
-	tempImageStore := local.NewImageStore(tempRootDir, false, false, log.Logger{}, metrics, nil, nil)
+func getImageStore(rootDir string) storageTypes.ImageStore {
+	metrics := monitoring.NewMetricsServer(false, log.Logger{})
 
-	return tempImageStore
+	return local.NewImageStore(rootDir, false, false, log.Logger{}, metrics, nil, nil)
 }
diff --git a/pkg/extensions/sync/service.go b/pkg/extensions/sync/service.go
index 594044df8e..02d6cc9d5f 100644
--- a/pkg/extensions/sync/service.go
+++ b/pkg/extensions/sync/service.go
@@ -20,7 +20,6 @@ import (
 	"zotregistry.io/zot/pkg/log"
 	mTypes "zotregistry.io/zot/pkg/meta/types"
 	"zotregistry.io/zot/pkg/storage"
-	"zotregistry.io/zot/pkg/storage/local"
 )
 
 type BaseService struct {
@@ -67,13 +66,20 @@ func New(
 
 	service.contentManager = NewContentManager(opts.Content, log)
 
-	tmpImageStore := local.NewImageStore(tmpDir,
-		false, false, log, nil, nil, nil,
-	)
-
-	tmpStorage := NewOciLayoutStorage(storage.StoreController{DefaultStore: tmpImageStore})
-
-	service.destination = NewDestinationRegistry(storeController, tmpStorage, metadb, log)
+	if len(tmpDir) == 0 {
+		// first it will sync in tmpDir then it will move everything into local ImageStore
+		service.destination = NewDestinationRegistry(storeController, storeController, metadb, log)
+	} else {
+		// first it will sync under /rootDir/reponame/.sync/ then it will move everything into local ImageStore
+		service.destination = NewDestinationRegistry(
+			storeController,
+			storage.StoreController{
+				DefaultStore: getImageStore(tmpDir),
+			},
+			metadb,
+			log,
+		)
+	}
 
 	retryOptions := &retry.RetryOptions{}
 
@@ -140,7 +146,7 @@ func (service *BaseService) SetNextAvailableClient() error {
 		if err != nil {
 			service.log.Error().Err(err).Str("url", url).Msg("sync: failed to initialize http client")
 
-			continue
+			return err
 		}
 
 		if !service.client.Ping() {
@@ -355,7 +361,8 @@ func (service *BaseService) SyncRepo(ctx context.Context, repo string) error {
 	return nil
 }
 
-func (service *BaseService) syncTag(ctx context.Context, destinationRepo, remoteRepo, tag string) (digest.Digest, error) {
+func (service *BaseService) syncTag(ctx context.Context, destinationRepo, remoteRepo, tag string,
+) (digest.Digest, error) {
 	copyOptions := getCopyOptions(service.remote.GetContext(), service.destination.GetContext())
 
 	policyContext, err := getPolicyContext(service.log)
diff --git a/pkg/extensions/sync/sync_internal_test.go b/pkg/extensions/sync/sync_internal_test.go
index 538318c0cd..50c572ca14 100644
--- a/pkg/extensions/sync/sync_internal_test.go
+++ b/pkg/extensions/sync/sync_internal_test.go
@@ -185,7 +185,8 @@ func TestDestinationRegistry(t *testing.T) {
 		syncImgStore := local.NewImageStore(dir, true, true, log, metrics, nil, cacheDriver)
 		repoName := "repo"
 
-		registry := NewDestinationRegistry(storage.StoreController{DefaultStore: syncImgStore}, nil, nil, log)
+		storeController := storage.StoreController{DefaultStore: syncImgStore}
+		registry := NewDestinationRegistry(storeController, storeController, nil, log)
 		imageReference, err := registry.GetImageReference(repoName, "1.0")
 		So(err, ShouldBeNil)
 		So(imageReference, ShouldNotBeNil)
@@ -302,7 +303,8 @@ func TestDestinationRegistry(t *testing.T) {
 			syncImgStore := local.NewImageStore(dir, true, true, log, metrics, linter, cacheDriver)
 			repoName := "repo"
 
-			registry := NewDestinationRegistry(storage.StoreController{DefaultStore: syncImgStore}, nil, nil, log)
+			storeController := storage.StoreController{DefaultStore: syncImgStore}
+			registry := NewDestinationRegistry(storeController, storeController, nil, log)
 
 			err = registry.CommitImage(imageReference, repoName, "1.0")
 			So(err, ShouldBeNil)
@@ -336,7 +338,8 @@ func TestDestinationRegistry(t *testing.T) {
 		})
 
 		Convey("trigger metaDB error on index manifest in CommitImage()", func() {
-			registry := NewDestinationRegistry(storage.StoreController{DefaultStore: syncImgStore}, nil, mocks.MetaDBMock{
+			storeController := storage.StoreController{DefaultStore: syncImgStore}
+			registry := NewDestinationRegistry(storeController, storeController, mocks.MetaDBMock{
 				SetRepoReferenceFn: func(ctx context.Context, repo string, reference string, imageMeta mTypes.ImageMeta) error {
 					if reference == "1.0" {
 						return zerr.ErrRepoMetaNotFound
@@ -351,7 +354,8 @@ func TestDestinationRegistry(t *testing.T) {
 		})
 
 		Convey("trigger metaDB error on image manifest in CommitImage()", func() {
-			registry := NewDestinationRegistry(storage.StoreController{DefaultStore: syncImgStore}, nil, mocks.MetaDBMock{
+			storeController := storage.StoreController{DefaultStore: syncImgStore}
+			registry := NewDestinationRegistry(storeController, storeController, mocks.MetaDBMock{
 				SetRepoReferenceFn: func(ctx context.Context, repo, reference string, imageMeta mTypes.ImageMeta) error {
 					return zerr.ErrRepoMetaNotFound
 				},
diff --git a/test/blackbox/ci.sh b/test/blackbox/ci.sh
index 0859b69c88..63bc7d0367 100755
--- a/test/blackbox/ci.sh
+++ b/test/blackbox/ci.sh
@@ -9,7 +9,7 @@ PATH=$PATH:${SCRIPTPATH}/../../hack/tools/bin
 
 tests=("pushpull" "pushpull_authn" "delete_images" "referrers" "metadata" "anonymous_policy"
        "annotations" "detect_manifest_collision" "cve" "sync" "sync_docker" "sync_replica_cluster"
-       "scrub" "garbage_collect" "metrics" "metrics_minimal")
+       "sync_remote" "scrub" "garbage_collect" "metrics" "metrics_minimal")
 
 for test in ${tests[*]}; do
     ${BATS} ${BATS_FLAGS} ${SCRIPTPATH}/${test}.bats > ${test}.log & pids+=($!)
diff --git a/test/blackbox/sync.bats b/test/blackbox/sync.bats
index 36b14722e3..9542e61526 100644
--- a/test/blackbox/sync.bats
+++ b/test/blackbox/sync.bats
@@ -58,21 +58,33 @@ function setup_file() {
 {
     "distSpecVersion": "1.1.0-dev",
     "storage": {
-        "rootDirectory": "${zot_sync_per_root_dir}"
+        "rootDirectory": "${zot_sync_per_root_dir}",
+        "dedupe": false,
+        "remoteCache": false,
+        "storageDriver": {
+            "name": "s3",
+            "rootdirectory": "/zot",
+            "region": "us-east-2",
+            "regionendpoint": "localhost:4566",
+            "bucket": "zot-storage",
+            "secure": false,
+            "skipverify": false
+        }
     },
     "http": {
         "address": "0.0.0.0",
-        "port": "${zot_port1}"
+        "port": "8081"
     },
     "log": {
         "level": "debug"
     },
     "extensions": {
         "sync": {
+            "tmpDir": "${zot_sync_per_root_dir}",
             "registries": [
                 {
                     "urls": [
-                        "http://localhost:${zot_port3}"
+                        "http://localhost:9000"
                     ],
                     "onDemand": false,
                     "tlsVerify": false,
@@ -94,20 +106,32 @@ EOF
     "distSpecVersion": "1.1.0-dev",
     "storage": {
         "rootDirectory": "${zot_sync_ondemand_root_dir}"
+        "dedupe": false,
+        "remoteCache": false,
+        "storageDriver": {
+            "name": "s3",
+            "rootdirectory": "/zot",
+            "region": "us-east-2",
+            "regionendpoint": "localhost:4566",
+            "bucket": "zot-storage",
+            "secure": false,
+            "skipverify": false
+        },
     },
     "http": {
         "address": "0.0.0.0",
-        "port": "${zot_port2}"
+        "port": "8082"
     },
     "log": {
         "level": "debug"
     },
     "extensions": {
         "sync": {
+            "tmpDir": "${zot_sync_per_root_dir}",
             "registries": [
                 {
                     "urls": [
-                        "http://localhost:${zot_port3}"
+                        "http://localhost:9000"
                     ],
                     "onDemand": true,
                     "tlsVerify": false,
diff --git a/test/blackbox/sync_remote.bats b/test/blackbox/sync_remote.bats
index 6a1ee20261..b794db0f96 100644
--- a/test/blackbox/sync_remote.bats
+++ b/test/blackbox/sync_remote.bats
@@ -1,3 +1,564 @@
+# Note: Intended to be run as "make run-blackbox-tests" or "make run-blackbox-ci"
+#       Makefile target installs & checks all necessary tooling
+#       Extra tools that are not covered in Makefile target needs to be added in verify_prerequisites()
+
+load helpers_zot
+load helpers_wait
+
+
+function verify_prerequisites() {
+    if [ ! $(command -v curl) ]; then
+        echo "you need to install curl as a prerequisite to running the tests" >&3
+        return 1
+    fi
+
+    if [ ! $(command -v jq) ]; then
+        echo "you need to install jq as a prerequisite to running the tests" >&3
+        return 1
+    fi
+
+    return 0
+}
+
+function setup_file() {
+    export COSIGN_PASSWORD=""
+    export COSIGN_OCI_EXPERIMENTAL=1
+    export COSIGN_EXPERIMENTAL=1
+
+    # Verify prerequisites are available
+    if ! $(verify_prerequisites); then
+        exit 1
+    fi
+
+    # Download test data to folder common for the entire suite, not just this file
+    skopeo --insecure-policy copy --format=oci docker://ghcr.io/project-zot/golang:1.20 oci:${TEST_DATA_DIR}/golang:1.20
+    # Setup zot server
+    local zot_sync_per_root_dir=${BATS_FILE_TMPDIR}/zot-per
+    local zot_sync_ondemand_root_dir=${BATS_FILE_TMPDIR}/zot-ondemand
+
+    local zot_sync_per_config_file=${BATS_FILE_TMPDIR}/zot_sync_per_config.json
+    local zot_sync_ondemand_config_file=${BATS_FILE_TMPDIR}/zot_sync_ondemand_config.json
+
+    local zot_minimal_root_dir=${BATS_FILE_TMPDIR}/zot-minimal
+    local zot_minimal_config_file=${BATS_FILE_TMPDIR}/zot_minimal_config.json
+
+    local oci_data_dir=${BATS_FILE_TMPDIR}/oci
+    mkdir -p ${zot_sync_per_root_dir}
+    mkdir -p ${zot_sync_ondemand_root_dir}
+    mkdir -p ${zot_minimal_root_dir}
+    mkdir -p ${oci_data_dir}
+    zot_port1=$(get_free_port)
+    echo ${zot_port1} > ${BATS_FILE_TMPDIR}/zot.port1
+    zot_port2=$(get_free_port)
+    echo ${zot_port2} > ${BATS_FILE_TMPDIR}/zot.port2
+    zot_port3=$(get_free_port)
+    echo ${zot_port3} > ${BATS_FILE_TMPDIR}/zot.port3
+
+    cat >${zot_sync_per_config_file} <<EOF
+{
+    "distSpecVersion": "1.1.0-dev",
+    "storage": {
+        "rootDirectory": "${zot_sync_per_root_dir}"
+    },
+    "http": {
+        "address": "0.0.0.0",
+        "port": "${zot_port1}"
+    },
+    "log": {
+        "level": "debug"
+    },
+    "extensions": {
+        "sync": {
+            "registries": [
+                {
+                    "urls": [
+                        "http://localhost:${zot_port3}"
+                    ],
+                    "onDemand": false,
+                    "tlsVerify": false,
+                    "PollInterval": "1s",
+                    "content": [
+                        {
+                            "prefix": "**"
+                        }
+                    ]
+                }
+            ]
+        }
+    }
+}
+EOF
+
+    cat >${zot_sync_ondemand_config_file} <<EOF
+{
+    "distSpecVersion": "1.1.0-dev",
+    "storage": {
+        "rootDirectory": "${zot_sync_ondemand_root_dir}"
+    },
+    "http": {
+        "address": "0.0.0.0",
+        "port": "${zot_port2}"
+    },
+    "log": {
+        "level": "debug"
+    },
+    "extensions": {
+        "sync": {
+            "registries": [
+                {
+                    "urls": [
+                        "http://localhost:${zot_port3}"
+                    ],
+                    "onDemand": true,
+                    "tlsVerify": false,
+                    "content": [
+                        {
+                            "prefix": "**"
+                        }
+                    ]
+                }
+            ]
+        }
+    }
+}
+EOF
+    cat >${zot_minimal_config_file} <<EOF
+{
+    "distSpecVersion": "1.1.0-dev",
+    "storage": {
+        "rootDirectory": "${zot_minimal_root_dir}"
+    },
+    "http": {
+        "address": "0.0.0.0",
+        "port": "${zot_port3}"
+    },
+    "log": {
+        "level": "debug"
+    }
+}
+EOF
+    git -C ${BATS_FILE_TMPDIR} clone https://github.com/project-zot/helm-charts.git
+
+    zot_serve ${ZOT_PATH} ${zot_sync_per_config_file}
+    wait_zot_reachable ${zot_port1}
+
+    zot_serve ${ZOT_PATH} ${zot_sync_ondemand_config_file}
+    wait_zot_reachable ${zot_port2}
+
+    zot_serve ${ZOT_MINIMAL_PATH} ${zot_minimal_config_file}
+    wait_zot_reachable ${zot_port3}
+}
+
+function teardown_file() {
+    zot_stop_all
+    run rm -rf ${HOME}/.config/notation
+}
+
+# sync image
+@test "sync golang image periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run skopeo --insecure-policy copy --dest-tls-verify=false \
+        oci:${TEST_DATA_DIR}/golang:1.20 \
+        docker://127.0.0.1:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+    run curl http://127.0.0.1:${zot_port3}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+    run curl http://127.0.0.1:${zot_port1}/v2/_catalog
+    run curl http://127.0.0.1:${zot_port3}/v2/golang/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+
+    run sleep 20s
+
+    run curl http://127.0.0.1:${zot_port1}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+
+    run curl http://127.0.0.1:${zot_port1}/v2/golang/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+}
+
+@test "sync golang image ondemand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run skopeo --insecure-policy copy --dest-tls-verify=false \
+        oci:${TEST_DATA_DIR}/golang:1.20 \
+        docker://127.0.0.1:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+    run curl http://127.0.0.1:${zot_port3}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+
+    # sync golang on demand
+    run curl http://127.0.0.1:${zot_port2}/v2/golang/manifests/1.20
+    [ "$status" -eq 0 ]
+
+    run curl http://127.0.0.1:${zot_port3}/v2/golang/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+
+    run curl http://127.0.0.1:${zot_port2}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+
+    run curl http://127.0.0.1:${zot_port2}/v2/golang/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+}
+
+# sync index
+@test "sync image index periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    # --multi-arch below pushes an image index (containing many images) instead
+    # of an image manifest (single image)
+    run skopeo --insecure-policy copy --format=oci --dest-tls-verify=false --multi-arch=all \
+        docker://public.ecr.aws/docker/library/busybox:latest \
+        docker://127.0.0.1:${zot_port3}/busybox:latest
+    [ "$status" -eq 0 ]
+    run curl http://127.0.0.1:${zot_port3}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[0]') = '"busybox"' ]
+    run curl http://127.0.0.1:${zot_port3}/v2/busybox/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"latest"' ]
+
+    run sleep 30s
+
+    run curl http://127.0.0.1:${zot_port1}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[0]') = '"busybox"' ]
+
+    run curl http://127.0.0.1:${zot_port1}/v2/busybox/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"latest"' ]
+}
+
+@test "sync image index on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    # --multi-arch below pushes an image index (containing many images) instead
+    # of an image manifest (single image)
+    run skopeo --insecure-policy copy --format=oci --dest-tls-verify=false --multi-arch=all \
+        docker://public.ecr.aws/docker/library/busybox:latest \
+        docker://127.0.0.1:${zot_port3}/busybox:latest
+    [ "$status" -eq 0 ]
+    run curl http://127.0.0.1:${zot_port3}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[1]') = '"golang"' ]
+    run curl http://127.0.0.1:${zot_port3}/v2/busybox/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"latest"' ]
+
+    # sync busybox index on demand
+    run curl http://127.0.0.1:${zot_port2}/v2/busybox/manifests/latest
+    [ "$status" -eq 0 ]
+
+    run curl http://127.0.0.1:${zot_port2}/v2/_catalog
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.repositories[1]') = '"golang"' ]
+
+    run curl http://127.0.0.1:${zot_port2}/v2/busybox/tags/list
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"latest"' ]
+}
+
+# sign signatures
+@test "sign/verify with cosign" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run cosign initialize
+    [ "$status" -eq 0 ]
+    run cosign generate-key-pair --output-key-prefix "${BATS_FILE_TMPDIR}/cosign-sign-sync-test"
+    [ "$status" -eq 0 ]
+    run cosign sign --key ${BATS_FILE_TMPDIR}/cosign-sign-sync-test.key localhost:${zot_port3}/golang:1.20 --yes
+    [ "$status" -eq 0 ]
+    run cosign sign --registry-referrers-mode=oci-1-1 --key ${BATS_FILE_TMPDIR}/cosign-sign-sync-test.key localhost:${zot_port3}/golang:1.20 --yes
+    [ "$status" -eq 0 ]
+    run cosign verify --key ${BATS_FILE_TMPDIR}/cosign-sign-sync-test.pub localhost:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+}
+
+@test "sign/verify with notation" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run notation cert generate-test "notation-sign-sync-test"
+    [ "$status" -eq 0 ]
+
+    local trust_policy_file=${HOME}/.config/notation/trustpolicy.json
+
+    cat >${trust_policy_file} <<EOF
+{
+    "version": "1.0",
+    "trustPolicies": [
+        {
+            "name": "notation-sign-sync-test",
+            "registryScopes": [ "*" ],
+            "signatureVerification": {
+                "level" : "strict"
+            },
+            "trustStores": [ "ca:notation-sign-sync-test" ],
+            "trustedIdentities": [
+                "*"
+            ]
+        }
+    ]
+}
+EOF
+
+    run notation sign --key "notation-sign-sync-test" --insecure-registry localhost:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+    run notation verify --insecure-registry localhost:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+    run notation list --insecure-registry localhost:${zot_port3}/golang:1.20
+    [ "$status" -eq 0 ]
+}
+
+@test "sync signatures periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    # wait for signatures to be copied
+    run sleep 15s
+
+    run notation verify --insecure-registry localhost:${zot_port1}/golang:1.20
+    [ "$status" -eq 0 ]
+
+    run cosign verify --key ${BATS_FILE_TMPDIR}/cosign-sign-sync-test.pub localhost:${zot_port1}/golang:1.20
+    [ "$status" -eq 0 ]
+}
+
+@test "sync signatures ondemand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    run notation verify --insecure-registry localhost:${zot_port2}/golang:1.20
+    [ "$status" -eq 0 ]
+
+    run cosign verify --key ${BATS_FILE_TMPDIR}/cosign-sign-sync-test.pub localhost:${zot_port2}/golang:1.20
+    [ "$status" -eq 0 ]
+}
+
+# sync oras artifacts
+@test "push oras artifact periodically" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    echo "{\"name\":\"foo\",\"value\":\"bar\"}" > config.json
+    echo "hello world" > artifact.txt
+    run oras push --plain-http 127.0.0.1:${zot_port3}/hello-artifact:v2 \
+        --config config.json:application/vnd.acme.rocket.config.v1+json artifact.txt:text/plain -d -v
+    [ "$status" -eq 0 ]
+    rm -f artifact.txt
+    rm -f config.json
+}
+
+@test "sync oras artifact periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    # wait for oras artifact to be copied
+    run sleep 15s
+    run oras pull --plain-http 127.0.0.1:${zot_port1}/hello-artifact:v2 -d -v
+    [ "$status" -eq 0 ]
+    grep -q "hello world" artifact.txt
+    rm -f artifact.txt
+}
+
+@test "sync oras artifact on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    run oras pull --plain-http 127.0.0.1:${zot_port2}/hello-artifact:v2 -d -v
+    [ "$status" -eq 0 ]
+    grep -q "hello world" artifact.txt
+    rm -f artifact.txt
+}
+
+# sync helm chart
+@test "push helm chart" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run helm package ${BATS_FILE_TMPDIR}/helm-charts/charts/zot -d ${BATS_FILE_TMPDIR}
+    [ "$status" -eq 0 ]
+    local chart_version=$(awk '/version/{printf $2}' ${BATS_FILE_TMPDIR}/helm-charts/charts/zot/Chart.yaml)
+    run helm push ${BATS_FILE_TMPDIR}/zot-${chart_version}.tgz oci://localhost:${zot_port3}/zot-chart
+    [ "$status" -eq 0 ]
+}
+
+@test "sync helm chart periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+     # wait for helm chart to be copied
+    run sleep 15s
+
+    local chart_version=$(awk '/version/{printf $2}' ${BATS_FILE_TMPDIR}/helm-charts/charts/zot/Chart.yaml)
+    run helm pull oci://localhost:${zot_port1}/zot-chart/zot --version ${chart_version} -d ${BATS_FILE_TMPDIR}
+    [ "$status" -eq 0 ]
+}
+
+@test "sync helm chart on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    local chart_version=$(awk '/version/{printf $2}' ${BATS_FILE_TMPDIR}/helm-charts/charts/zot/Chart.yaml)
+    run helm pull oci://localhost:${zot_port2}/zot-chart/zot --version ${chart_version} -d ${BATS_FILE_TMPDIR}
+    [ "$status" -eq 0 ]
+}
+
+# sync OCI artifacts
+@test "push OCI artifact (oci image mediatype) with regclient" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run regctl registry set localhost:${zot_port3} --tls disabled
+    run regctl registry set localhost:${zot_port1} --tls disabled
+    run regctl registry set localhost:${zot_port2} --tls disabled
+
+    run regctl artifact put localhost:${zot_port3}/artifact:demo <<EOF
+this is an oci image artifact
+EOF
+    [ "$status" -eq 0 ]
+}
+
+@test "sync OCI artifact (oci image mediatype) periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    # wait for helm chart to be copied
+    run sleep 15s
+    run regctl manifest get localhost:${zot_port1}/artifact:demo
+    [ "$status" -eq 0 ]
+    run regctl artifact get localhost:${zot_port1}/artifact:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "this is an oci image artifact" ]
+}
+
+@test "sync OCI artifact (oci image mediatype) on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    run regctl manifest get localhost:${zot_port2}/artifact:demo
+    [ "$status" -eq 0 ]
+    run regctl artifact get localhost:${zot_port2}/artifact:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "this is an oci image artifact" ]
+}
+
+@test "push OCI artifact (oci artifact mediatype) with regclient" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run regctl artifact put --artifact-type "application/vnd.example.icecream.v1"  localhost:${zot_port3}/newartifact:demo <<EOF
+this is an oci artifact
+EOF
+    [ "$status" -eq 0 ]
+}
+
+@test "sync OCI artifact (oci artifact mediatype) periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    # wait for helm chart to be copied
+    run sleep 15s
+    run regctl manifest get localhost:${zot_port1}/newartifact:demo
+    [ "$status" -eq 0 ]
+    run regctl artifact get localhost:${zot_port1}/newartifact:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "this is an oci artifact" ]
+}
+
+@test "sync OCI artifact (oci artifact mediatype) on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    run regctl manifest get localhost:${zot_port2}/newartifact:demo
+    [ "$status" -eq 0 ]
+    run regctl artifact get localhost:${zot_port2}/newartifact:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "this is an oci artifact" ]
+}
+
+@test "push OCI artifact references with regclient" {
+    zot_port3=`cat ${BATS_FILE_TMPDIR}/zot.port3`
+    run regctl artifact put localhost:${zot_port3}/manifest-ref:demo <<EOF
+test artifact
+EOF
+    [ "$status" -eq 0 ]
+    run regctl artifact list localhost:${zot_port3}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+    run regctl artifact put --annotation  demo=true --annotation format=oci --artifact-type "application/vnd.example.icecream.v1" --subject localhost:${zot_port3}/manifest-ref:demo << EOF
+test reference
+EOF
+    [ "$status" -eq 0 ]
+    # with artifact media-type
+    run regctl artifact put localhost:${zot_port3}/artifact-ref:demo <<EOF
+test artifact
+EOF
+    [ "$status" -eq 0 ]
+    run regctl artifact list localhost:${zot_port3}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+    run regctl artifact put --annotation  demo=true --annotation format=oci --artifact-type "application/vnd.example.icecream.v1" --subject localhost:${zot_port3}/artifact-ref:demo << EOF
+test reference
+EOF
+    [ "$status" -eq 0 ]
+}
+
+@test "sync OCI artifact references periodically" {
+    zot_port1=`cat ${BATS_FILE_TMPDIR}/zot.port1`
+    # wait for OCI artifacts to be copied
+    run sleep 20
+    run regctl artifact get localhost:${zot_port1}/manifest-ref:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "test artifact" ]
+    run regctl artifact list localhost:${zot_port1}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/vnd.example.icecream.v1" localhost:${zot_port1}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/invalid" localhost:${zot_port1}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+    # with artifact media-type
+    run regctl artifact get localhost:${zot_port1}/artifact-ref:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "test artifact" ]
+    run regctl artifact list localhost:${zot_port1}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/vnd.example.icecream.v1" localhost:${zot_port1}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/invalid" localhost:${zot_port1}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+}
+
+@test "sync OCI artifact references on demand" {
+    zot_port2=`cat ${BATS_FILE_TMPDIR}/zot.port2`
+    run regctl artifact get localhost:${zot_port2}/manifest-ref:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "test artifact" ]
+    run regctl artifact list localhost:${zot_port2}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/vnd.example.icecream.v1" localhost:${zot_port2}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/invalid" localhost:${zot_port2}/manifest-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+    # with artifact media-type
+    run regctl artifact get localhost:${zot_port2}/artifact-ref:demo
+    [ "$status" -eq 0 ]
+    [ "${lines[-1]}" == "test artifact" ]
+    run regctl artifact list localhost:${zot_port2}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/vnd.example.icecream.v1" localhost:${zot_port2}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 1 ]
+    run regctl artifact list --filter-artifact-type "application/invalid" localhost:${zot_port2}/artifact-ref:demo --format raw-body
+    [ "$status" -eq 0 ]
+    [ $(echo "${lines[-1]}" | jq '.manifests | length') -eq 0 ]
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 # Note: Intended to be run as "make run-blackbox-tests" or "make run-blackbox-ci"
 #       Makefile target installs & checks all necessary tooling
 #       Extra tools that are not covered in Makefile target needs to be added in verify_prerequisites()
@@ -77,6 +638,7 @@ function setup_file() {
     },
     "extensions": {
         "sync": {
+            "tmpDir": "${zot_sync_per_root_dir}",
             "registries": [
                 {
                     "urls": [
@@ -101,7 +663,7 @@ EOF
 {
     "distSpecVersion": "1.1.0-dev",
     "storage": {
-        "rootDirectory": "${zot_sync_ondemand_root_dir}"
+        "rootDirectory": "${zot_sync_ondemand_root_dir}",
         "dedupe": false,
         "remoteCache": false,
         "storageDriver": {
@@ -112,7 +674,7 @@ EOF
             "bucket": "zot-storage",
             "secure": false,
             "skipverify": false
-        },
+        }
     },
     "http": {
         "address": "0.0.0.0",
@@ -123,6 +685,7 @@ EOF
     },
     "extensions": {
         "sync": {
+            "tmpDir": "${zot_sync_per_root_dir}",
             "registries": [
                 {
                     "urls": [
@@ -175,9 +738,9 @@ function teardown_file() {
 
 # sync image
 @test "sync golang image periodically" {
-run skopeo --insecure-policy copy --dest-tls-verify=false \
-    oci:${TEST_DATA_DIR}/golang:1.20 \
-    docker://127.0.0.1:9000/golang:1.20
+    run skopeo --insecure-policy copy --dest-tls-verify=false \
+        oci:${TEST_DATA_DIR}/golang:1.20 \
+        docker://127.0.0.1:9000/golang:1.20
     [ "$status" -eq 0 ]
     run curl http://127.0.0.1:9000/v2/_catalog
     [ "$status" -eq 0 ]
@@ -199,29 +762,29 @@ run skopeo --insecure-policy copy --dest-tls-verify=false \
 }
 
 @test "sync golang image ondemand" {
-run skopeo --insecure-policy copy --dest-tls-verify=false \
-    oci:${TEST_DATA_DIR}/golang:1.20 \
-    docker://127.0.0.1:9000/golang:1.20
-    [ "$status" -eq 0 ]
-    run curl http://127.0.0.1:9000/v2/_catalog
-    [ "$status" -eq 0 ]
-    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+    run skopeo --insecure-policy copy --dest-tls-verify=false \
+        oci:${TEST_DATA_DIR}/golang:1.20 \
+        docker://127.0.0.1:9000/golang:1.20
+        [ "$status" -eq 0 ]
+        run curl http://127.0.0.1:9000/v2/_catalog
+        [ "$status" -eq 0 ]
+        [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
 
-    # sync golang on demand
-    run curl http://127.0.0.1:8082/v2/golang/manifests/1.20
-    [ "$status" -eq 0 ]
+        # sync golang on demand
+        run curl http://127.0.0.1:8082/v2/golang/manifests/1.20
+        [ "$status" -eq 0 ]
 
-    run curl http://127.0.0.1:9000/v2/golang/tags/list
-    [ "$status" -eq 0 ]
-    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+        run curl http://127.0.0.1:9000/v2/golang/tags/list
+        [ "$status" -eq 0 ]
+        [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
 
-    run curl http://127.0.0.1:8082/v2/_catalog
-    [ "$status" -eq 0 ]
-    [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
+        run curl http://127.0.0.1:8082/v2/_catalog
+        [ "$status" -eq 0 ]
+        [ $(echo "${lines[-1]}" | jq '.repositories[]') = '"golang"' ]
 
-    run curl http://127.0.0.1:8082/v2/golang/tags/list
-    [ "$status" -eq 0 ]
-    [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
+        run curl http://127.0.0.1:8082/v2/golang/tags/list
+        [ "$status" -eq 0 ]
+        [ $(echo "${lines[-1]}" | jq '.tags[]') = '"1.20"' ]
 }
 
 # sync index