Multiple signatures support

cmd/docker-nv2/config/path.go

@@ -1,7 +1,9 @@
 package config
 
 import (
+	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/docker/cli/cli/config"
 	"github.com/opencontainers/go-digest"
@@ -25,11 +27,62 @@ var (
 	SignatureStoreDirPath = filepath.Join(config.Dir(), SignatureStoreDirName)
 )
 
-// SignaturePath returns the path of a signature for a manifest
-func SignaturePath(manifestDigest digest.Digest) string {
+// SignatureRootPath returns the root path of signatures for a manifest
+func SignatureRootPath(manifestDigest digest.Digest) string {
 	return filepath.Join(
 		SignatureStoreDirPath,
 		manifestDigest.Algorithm().String(),
-		manifestDigest.Encoded()+SignatureExtension,
+		manifestDigest.Encoded(),
+	)
+}
+
+// SignaturePath returns the path of a signature for a manifest
+func SignaturePath(manifestDigest, signatureDigest digest.Digest) string {
+	return filepath.Join(
+		SignatureRootPath(manifestDigest),
+		signatureDigest.Algorithm().String(),
+		signatureDigest.Encoded()+SignatureExtension,
 	)
 }
+
+// SignatureDigests returns the digest of signatures for a manifest
+func SignatureDigests(manifestDigest digest.Digest) ([]digest.Digest, error) {
+	rootPath := SignatureRootPath(manifestDigest)
+	algorithmEntries, err := os.ReadDir(rootPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	var digests []digest.Digest
+	for _, algorithmEntry := range algorithmEntries {
+		if !algorithmEntry.Type().IsDir() {
+			continue
+		}
+
+		algorithm := algorithmEntry.Name()
+		signatureEntries, err := os.ReadDir(filepath.Join(rootPath, algorithm))
+		if err != nil {
+			return nil, err
+		}
+
+		for _, signatureEntry := range signatureEntries {
+			if !signatureEntry.Type().IsRegular() {
+				continue
+			}
+			encoded := signatureEntry.Name()
+			if !strings.HasSuffix(encoded, SignatureExtension) {
+				continue
+			}
+			encoded = strings.TrimSuffix(encoded, SignatureExtension)
+			digest := digest.NewDigestFromEncoded(digest.Algorithm(algorithm), encoded)
+			if err := digest.Validate(); err != nil {
+				return nil, err
+			}
+			digests = append(digests, digest)
+		}
+	}
+	return digests, nil
+}

cmd/docker-nv2/notary_sign.go

@@ -7,6 +7,7 @@ import (
 	"github.com/notaryproject/nv2/cmd/docker-nv2/crypto"
 	"github.com/notaryproject/nv2/cmd/docker-nv2/docker"
 	ios "github.com/notaryproject/nv2/internal/os"
+	"github.com/opencontainers/go-digest"
 	"github.com/urfave/cli/v2"
 )
 
@@ -57,7 +58,7 @@ func notarySign(ctx *cli.Context) error {
 	if err != nil {
 		return err
 	}
-	sigPath := config.SignaturePath(desc.Digest)
+	sigPath := config.SignaturePath(desc.Digest, digest.FromBytes(sig))
 	if err := ios.WriteFile(sigPath, sig); err != nil {
 		return err
 	}

cmd/docker-nv2/push.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"strconv"
@@ -37,29 +36,42 @@ func pushImage(ctx *cli.Context) error {
 	}
 
 	fmt.Println("Pushing signature")
-	sigPath := config.SignaturePath(desc.Digest)
-	sig, err := ioutil.ReadFile(sigPath)
+	sigDigests, err := config.SignatureDigests(desc.Digest)
 	if err != nil {
-		if os.IsNotExist(err) {
-			return errors.New("signature not found")
-		}
 		return err
 	}
+	if len(sigDigests) == 0 {
+		return errors.New("no signatures found")
+	}
 
 	client, err := docker.GetSignatureRepository(ctx.Context, ctx.Args().First())
 	if err != nil {
 		return err
 	}
-	sigDesc, err := client.Put(ctx.Context, sig)
-	if err != nil {
-		return err
-	}
+	pushSignature := func(sigDigest digest.Digest) error {
+		sigPath := config.SignaturePath(desc.Digest, sigDigest)
+		sig, err := os.ReadFile(sigPath)
+		if err != nil {
+			return err
+		}
 
-	artifactDesc, err := client.Link(ctx.Context, desc, sigDesc)
-	if err != nil {
-		return err
+		sigDesc, err := client.Put(ctx.Context, sig)
+		if err != nil {
+			return err
+		}
+
+		artifactDesc, err := client.Link(ctx.Context, desc, sigDesc)
+		if err != nil {
+			return err
+		}
+		fmt.Println("signature manifest digest:", artifactDesc.Digest, "size:", artifactDesc.Size)
+		return nil
+	}
+	for _, sigDigest := range sigDigests {
+		if err := pushSignature(sigDigest); err != nil {
+			return err
+		}
 	}
-	fmt.Println("signature manifest digest:", artifactDesc.Digest, "size:", artifactDesc.Size)
 
 	return nil
 }