feat: add support for signed user metadata by byronchien · Pull Request #242 · notaryproject/notation-go

byronchien · 2023-01-13T01:33:21Z

Adds support for signed user metadata in notation sign and notation verify. Relevant spec

example sign usage:

chienb@a07817b52895 notation % notation sign $IMAGE --user-metadata io.wabbit-networks.buildId=123 --user-metadata io.wabbit-networks.buildTime=123
Warning: Always sign the artifact using digest(`@sha256:...`) rather than a tag(`:v1`) because tags are mutable and a tag reference can point to a different artifact than the one signed.
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before signing.
Successfully signed localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

example metadata displayed on verification (without metadata flag)

chienb@a07817b52895 notation % notation verify $IMAGE
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Successfully verified signature for localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

The artifact was signed with the following user metadata.

KEY                          VALUE
io.wabbit-networks.buildTime   123
io.wabbit-networks.buildId     123

example verification:

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata io.wabbit-networks.buildTime=123
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Successfully verified signature for localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

The artifact was signed with the following user metadata.

KEY                            VALUE
io.wabbit-networks.buildTime   123
io.wabbit-networks.buildId     123

example verification failure

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata foo=bar
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Error: signature verification failed: signature verification failed

Signed-off-by: Byron Chien chienb@amazon.com

Signed-off-by: Byron Chien <chienb@amazon.com>

byronchien · 2023-01-13T01:33:55Z

related: notaryproject/notation#507

codecov-commenter · 2023-01-13T09:13:42Z

Codecov Report

Merging #242 (ffaf954) into main (e11bfd8) will increase coverage by 0.03%.
The diff coverage is 57.74%.

@@            Coverage Diff             @@
##             main     #242      +/-   ##
==========================================
+ Coverage   73.31%   73.34%   +0.03%     
==========================================
  Files          23       23              
  Lines        1746     1827      +81     
==========================================
+ Hits         1280     1340      +60     
- Misses        372      390      +18     
- Partials       94       97       +3

Impacted Files	Coverage Δ
errors.go	`0.00% <0.00%> (ø)`
notation.go	`58.03% <50.98%> (-1.84%)`	⬇️
verifier/verifier.go	`76.75% <100.00%> (+3.28%)`	⬆️
registry/repository.go	`39.18% <0.00%> (+6.98%)`	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

signer/plugin.go

internal/mock/testdata/sig_env_with_metadata.json

notation.go

signer/signer.go

verifier/verifier.go

priteshbandi · 2023-01-13T10:18:37Z

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata foo=bar
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Error: signature verification failed: signature verification failed

Shouldn't the error message be something like, missing matching user-metadata in the signature. ?

Signed-off-by: Byron Chien <chienb@amazon.com>

verifier/verifier.go

notation.go

signer/signer.go

Signed-off-by: Byron Chien <chienb@amazon.com>

signer/signer.go

notation.go

signer/signer.go

notation.go

Signed-off-by: Byron Chien <chienb@amazon.com>

notation.go

Signed-off-by: Byron Chien <chienb@amazon.com>

priteshbandi

LGTM

errors.go

notation.go

verifier/verifier.go

Signed-off-by: Byron Chien <chienb@amazon.com>

example_remoteSign_test.go

patrickzheng200

LGTM with one comment

notation.go

Signed-off-by: Byron Chien <chienb@amazon.com>

yizha1 · 2023-02-07T07:39:50Z

@byronchien could you fix the conflicts?

byronchien · 2023-02-07T18:25:17Z

resolved conflict

shizhMSFT

LGTM

Adds support for signed user metadata

a6a6e72

Signed-off-by: Byron Chien <chienb@amazon.com>

byronchien mentioned this pull request Jan 13, 2023

feat: add support for signed user metadata in notation sign and verify cmds notaryproject/notation#507

Merged

priteshbandi requested a review from shizhMSFT January 13, 2023 09:09

priteshbandi reviewed Jan 13, 2023

View reviewed changes

priteshbandi requested a review from yizha1 January 13, 2023 10:18

Byron Chien and others added 2 commits January 13, 2023 13:42

Move metadata verification and return error message

ddea68e

Signed-off-by: Byron Chien <chienb@amazon.com>

Merge branch 'notaryproject:main' into user-metadata

e12c0ec

patrickzheng200 reviewed Jan 16, 2023

View reviewed changes

verifier/verifier.go Outdated Show resolved Hide resolved

verifier/verifier.go Outdated Show resolved Hide resolved

shizhMSFT reviewed Jan 17, 2023

View reviewed changes

notation.go Outdated Show resolved Hide resolved

notation.go Show resolved Hide resolved

notation.go Show resolved Hide resolved

signer/signer.go Outdated Show resolved Hide resolved

shizhMSFT changed the title ~~Adds support for signed user metadata~~ feat: add support for signed user metadata Jan 17, 2023

Update error messages and method arguments

72602fc

Signed-off-by: Byron Chien <chienb@amazon.com>

priteshbandi reviewed Jan 18, 2023

View reviewed changes

signer/signer.go Outdated Show resolved Hide resolved

notation.go Outdated Show resolved Hide resolved

signer/signer.go Outdated Show resolved Hide resolved

notation.go Outdated Show resolved Hide resolved

Add RemoteSignOptions, remove failed outcome array

c98f90a

Signed-off-by: Byron Chien <chienb@amazon.com>

priteshbandi reviewed Jan 19, 2023

View reviewed changes

notation.go Outdated Show resolved Hide resolved

notation.go Outdated Show resolved Hide resolved

Embed SignOptions in RemoteSignOptions

ffaf954

Signed-off-by: Byron Chien <chienb@amazon.com>

priteshbandi approved these changes Jan 19, 2023

View reviewed changes

Merge branch 'main' into user-metadata

211633a

shizhMSFT reviewed Jan 29, 2023

View reviewed changes

Improve options initialization, error docs, and UserMetadata()

960d73b

Signed-off-by: Byron Chien <chienb@amazon.com>

priteshbandi requested review from patrickzheng200 and shizhMSFT January 31, 2023 22:22

yizha1 added this to the RC-2 milestone Feb 1, 2023

patrickzheng200 reviewed Feb 1, 2023

View reviewed changes

example_remoteSign_test.go Outdated Show resolved Hide resolved

patrickzheng200 reviewed Feb 2, 2023

View reviewed changes

example_remoteSign_test.go Outdated Show resolved Hide resolved

patrickzheng200 approved these changes Feb 2, 2023

View reviewed changes

shizhMSFT reviewed Feb 6, 2023

View reviewed changes

notation.go Outdated Show resolved Hide resolved

Merge branch 'main' into user-metadata

74f6321

Signed-off-by: Byron Chien <chienb@amazon.com>

Byron Chien added 2 commits February 6, 2023 16:10

Fix test sign option initialization

350d88b

Signed-off-by: Byron Chien <chienb@amazon.com>

Return error in UserMetadata for nil envelopeContent

aa647a9

Signed-off-by: Byron Chien <chienb@amazon.com>

byronchien force-pushed the user-metadata branch from 6deec4a to aa647a9 Compare February 7, 2023 00:26

Merge branch 'main' into user-metadata

38b62da

yizha1 requested a review from shizhMSFT February 8, 2023 00:15

shizhMSFT approved these changes Feb 8, 2023

View reviewed changes

priteshbandi merged commit 6ef3544 into notaryproject:main Feb 8, 2023

Comments

Conversation

byronchien commented Jan 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

byronchien commented Jan 13, 2023

Uh oh!

codecov-commenter commented Jan 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

priteshbandi commented Jan 13, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

priteshbandi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

patrickzheng200 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yizha1 commented Feb 7, 2023

Uh oh!

byronchien commented Feb 7, 2023

Uh oh!

shizhMSFT left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

byronchien commented Jan 13, 2023 •

edited

Loading

codecov-commenter commented Jan 13, 2023 •

edited

Loading