Add key generation support to nv2

[lachie83]

The nv2 binary doesn't currently have a way to generate a key pair for signing which makes it harder than it needs to be for new users to use nv2. Please add a subcommand that generates a keypair.

I suggest nv2 keygen as a subcommand. At a minimum, it needs to perform the functional equivalent of the following as mentioned here.

openssl req \
  -x509 \
  -sha256 \
  -nodes \
  -newkey rsa:2048 \
  -days 365 \
  -subj "/CN=${REGISTRY}/O=wabbit-networks inc/C=US/ST=Washington/L=Seattle" \
  -addext "subjectAltName=DNS:${REGISTRY}" \
  -keyout ./wabbit-networks.key \
  -out ./wabbit-networks.crt

[SteveLasker]

big 👍

[lachie83]

We might also want to put the keypair in a default location like ~/.notary/keys/ for example so that it can be picked up as a default for other commands for example.

docker notary sign \
  --key ./wabbit-networks.key \
  --cert ./wabbit-networks.crt \
  $IMAGE

I would expect that the command could be simplified to docker notary sign $IMAGE

[SteveLasker]

to be more generic, we might want to keep with nv2 sign, which could reference any artifact (image, sbom, wasm, scan result)

[dlorenc]

It's worth calling out that this openssl command does not generate a key, it generates a certificate (which contains a key). If the certificate is self-signed like it is in this case, there's not much value in having it over just a keypair, which can come from something like:

openssl genrsa -out myprivate.pem 512

for the private key and

openssl pkcs8 -topk8 -in myprivate.pem  -nocrypt'

for the public key.

I'm not sure about this line:

-addext "subjectAltName=DNS:${REGISTRY}" \

It seems to put the registry itself into the cert as a SAN field. I'm not sure how this could be used. What's the trust model/use-case for someone to check this value in the cert?

-nodes \

This like means the private key will not be encrypted at all, meaning it may not be safe to store on disk.