Update notation plug-in support to the updated plug-in spec

[SteveLasker]

The feat-kv-extensibility branch was created to validate an early version of the plug-in spec.
Now that the plug-in spec, is merged, we need to:

• Take the content from feat-kv-extensibility, and update to reflect the plug-in spec
  • Note: the feat-kv-extensibility branch should NOT be updated. It is being used for COSE validations, until COSE support is complete.
  • Updates from the feat-kv-extensibility branch should be PRd to main

To validate, use one of the plug-ins, such as the Azure Key Vault plug-in. Which also need to be updated to reflect the updated plug-in spec.

To complete this work, the following is ready for review:

• Implement generate signature plugin workflow #42
• Support managing plugin keys #168
• Add plugin sign capabaility #176
• Implement new signing spec #18

[SteveLasker]

I've taken the following branches and validated remote signing works with azure keyvault

• qmuntal/notation at feat-plugin

  git clone git@github.com:qmuntal/notation.git
  git checkout feat-plugin
  make install
  cp bin/notation ~/bin/

• qmuntal/notation-azure-kv at plugins

  git clone git@github.com:qmuntal/notation-azure-kv.git
  git checkout plugins
  go build ./cmd/notation-azure-kv
  cp notation-azure-kv ~/.config/notation/plugins/azure-kv

Then:

# Get the signing key from Azure Key Vault
KEY_ID=$(az keyvault certificate show --vault-name wabbit-networks \
                    --name wabbit-networks-io \
                    --query "kid" -o tsv)

# Add the key, note --plugin parameter, but --kms is no longer required
notation key add \
    --name wabbit-networks-io \
    --id $KEY_ID \
    --plugin azure-kv

# Sign the net-monitor image
notation sign --key "wabbit-networks-io" \
  wabbitnetworks.azurecr.io/net-monitor:v1

# View the image and its referers
oras discover -o tree wabbitnetworks.azurecr.io/net-monitor:v1
wabbitnetworks.azurecr.io/net-monitor:v1
└── application/vnd.cncf.notary.v2.signature
    └── sha256:66a3785439035a9b0d7631b2bca6bef0e3944761a9d5a3c28e6360b045ef91c5

# Add the public key for opt-in verification
notation cert add --name "wabbit-networks-io" ./wabbit-networks-io.pem

# verify the image
notation verify wabbitnetworks.azurecr.io/net-monitor:v1
sha256:81a768032a0dcf5fd0d571092d37f2ab31afcac481aa91bb8ea891b0cff8a6ec

[gokarnm]

This looks great! I've added a comment about cert add not being available in RC1 release here, so some of the steps will need updates for RC1.

[dtzar]

To try clarify order of PR merge operations - I think it should go:

1. Implement generate signature plugin workflow notation-go#42
2. Add plugin sign capabaility #176
   This doesn't depend on notation-go library (number 1 above)
3. Support managing plugin keys  #168
   All the above have to be merged for this one
4. Implement new signing spec Azure/notation-azure-kv#18

[qmuntal]

@SteveLasker can we close this issue? All work is done.

[dtzar]

Yes and now in the new release - great work thank you @qmuntal !