Skip to content

Comments

Directory Structure Spec#175

Merged
shizhMSFT merged 12 commits intonotaryproject:mainfrom
shizhMSFT:location
Jun 15, 2022
Merged

Directory Structure Spec#175
shizhMSFT merged 12 commits intonotaryproject:mainfrom
shizhMSFT:location

Conversation

@shizhMSFT
Copy link
Contributor

Resolves #167

Signed-off-by: Shiwei Zhang shizh@microsoft.com

@shizhMSFT shizhMSFT requested a review from a team May 12, 2022 15:58
@SteveLasker
Copy link
Contributor

I've added Balancing Security and Usability for reference

Based on the PR, it looks like we are securing the configuration and policy files to directories a normal user would be unable to configure. We should also assure the notation client doesn't allow the user to override the configuration files with non-admin directories or files.
There may be some configurations that are less secure, and more usability, for instance reducing the number of parameters the user must enter every time. However, anything that implies security, MUST be placed in a directory requiring admin rights for write access.

shizhMSFT added 7 commits June 8, 2022 11:39
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
shizhMSFT added 2 commits June 8, 2022 20:50
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Although it is recommended to install `notation` with its plugins and default configurations at the system level, it is possible to install at the user level.

On Unix systems, `notation` follows [Filesystem Hierarchy Standard][FHS] for system level directories and [XDG Base Directory Specification][XDG] for user level directories. On Windows, [Known Folders][KF] and [App Settings][AS] are followed equivalently. On Darwin, [macOS File System][macOS_FS] with [System Integrity Protection][SIP] is followed equivalently. If a file with the same name exists at the system level and the user level, the file at the user level takes over the priority.
Copy link
Contributor

@gokarnm gokarnm Jun 13, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes sense from a usability perspective for certain components like configuration settings, signing key and plugin config, and local keys, but seems inverse of what is desired for trust store and trust policy.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
On Unix systems, `notation` follows [Filesystem Hierarchy Standard][FHS] for system level directories and [XDG Base Directory Specification][XDG] for user level directories. On Windows, [Known Folders][KF] and [App Settings][AS] are followed equivalently. On Darwin, [macOS File System][macOS_FS] with [System Integrity Protection][SIP] is followed equivalently. If a file with the same name exists at the system level and the user level, the file at the user level takes over the priority.
On Unix systems, `notation` follows [Filesystem Hierarchy Standard][FHS] for system level directories and [XDG Base Directory Specification][XDG] for user level directories. On Windows, [Known Folders][KF] and [App Settings][AS] are followed equivalently. On Darwin, [macOS File System][macOS_FS] with [System Integrity Protection][SIP] is followed equivalently.
**TODO** : If a file with the same name exists at the system level and the user level, the mechanism to resolve priority needs to be defined (tracked in #203).

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Copy link
Contributor

@gokarnm gokarnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Created an issue (#203) and added a suggestion to track precedence of system vs user files. Rest looks great!

@shizhMSFT shizhMSFT merged commit 5f4de13 into notaryproject:main Jun 15, 2022
@shizhMSFT shizhMSFT deleted the location branch June 15, 2022 04:34
7h3-3mp7y-m4n pushed a commit to 7h3-3mp7y-m4n/notation that referenced this pull request Mar 29, 2025
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Spec : Notation directory structure

6 participants