feat: add notation config environment variable

cmd/notation/main.go

@@ -16,6 +16,7 @@ package main
 import (
 	"os"
 
+	"github.com/notaryproject/notation-go/dir"
 	"github.com/notaryproject/notation/cmd/notation/cert"
 	"github.com/notaryproject/notation/cmd/notation/policy"
 	"github.com/spf13/cobra"
@@ -31,6 +32,16 @@ func main() {
 			// to avoid leaking credentials
 			os.Unsetenv(defaultUsernameEnv)
 			os.Unsetenv(defaultPasswordEnv)
+
+			// update Notation config directory
+			if notationConfig := os.Getenv("NOTATION_CONFIG"); notationConfig != "" {
+				dir.UserConfigDir = notationConfig
+			}
+
+			// update Notation Libexec directory (for plugins)
+			if notationLibexec := os.Getenv("NOTATION_LIBEXEC"); notationLibexec != "" {
+				dir.UserLibexecDir = notationLibexec
+			}
 		},
 	}
 	cmd.AddCommand(

test/e2e/suite/command/verify.go

@@ -155,4 +155,26 @@ var _ = Describe("notation verify", func() {
 				NoMatchErrKeyWords(HTTPSRequest)
 		})
 	})
+
+	It("incorrect NOTATION_CONFIG path", func() {
+		Host(BaseOptions(), func(notation *utils.ExecOpts, artifact *Artifact, vhost *utils.VirtualHost) {
+			notation.Exec("sign", artifact.ReferenceWithDigest()).
+				MatchKeyWords(SignSuccessfully)
+
+			vhost.UpdateEnv(map[string]string{"NOTATION_CONFIG": "/not/exist"})
+			notation.ExpectFailure().Exec("verify", artifact.ReferenceWithDigest(), "-v").
+				MatchErrKeyWords("trust policy is not present")
+		})
+	})
+
+	It("correct NOTATION_CONFIG path", func() {
+		Host(BaseOptions(), func(notation *utils.ExecOpts, artifact *Artifact, vhost *utils.VirtualHost) {
+			notation.Exec("sign", artifact.ReferenceWithDigest()).
+				MatchKeyWords(SignSuccessfully)
+
+			vhost.UpdateEnv(map[string]string{"NOTATION_CONFIG": vhost.AbsolutePath(NotationDirName)})
+			notation.Exec("verify", artifact.ReferenceWithDigest(), "-v").
+				MatchKeyWords(VerifySuccessfully)
+		})
+	})
 })

test/e2e/suite/plugin/sign.go

@@ -265,4 +265,38 @@ var _ = Describe("notation plugin sign", func() {
 			Expect(descriptors[0].Annotations).Should(HaveKeyWithValue("k1", "v1"))
 		})
 	})
+
+	It("incorrect NOTATION_LIBEXEC path", func() {
+		Host(BaseOptions(), func(notation *utils.ExecOpts, artifact *Artifact, vhost *utils.VirtualHost) {
+			// setup incorrect NOTATION_LIBEXEC path
+			vhost.SetOption(AddPlugin(NotationE2EPluginPath))
+			notation.Exec("key", "add", "plugin-key", "--id", "key1", "--plugin", "e2e-plugin",
+				"--plugin-config", string(CapabilityEnvelopeGenerator)+"=true",
+				"--plugin-config", TamperAnnotation+"=k1=v1").
+				MatchKeyWords("plugin-key")
+
+			vhost.UpdateEnv(map[string]string{"NOTATION_LIBEXEC": "/not/exist"})
+
+			// run signing
+			notation.ExpectFailure().Exec("sign", artifact.ReferenceWithDigest(), "--key", "plugin-key", "-d").
+				MatchErrKeyWords("no such file or directory")
+		})
+	})
+
+	It("correct NOTATION_LIBEXEC path", func() {
+		Host(BaseOptions(), func(notation *utils.ExecOpts, artifact *Artifact, vhost *utils.VirtualHost) {
+			// setup incorrect NOTATION_LIBEXEC path
+			vhost.SetOption(AddPlugin(NotationE2EPluginPath))
+			notation.Exec("key", "add", "plugin-key", "--id", "key1", "--plugin", "e2e-plugin",
+				"--plugin-config", string(CapabilityEnvelopeGenerator)+"=true",
+				"--plugin-config", TamperAnnotation+"=k1=v1").
+				MatchKeyWords("plugin-key")
+
+			vhost.UpdateEnv(map[string]string{"NOTATION_LIBEXEC": vhost.AbsolutePath(NotationDirName)})
+
+			// run signing
+			notation.Exec("sign", artifact.ReferenceWithDigest(), "--key", "plugin-key", "-d").
+				MatchKeyWords("Successfully signed")
+		})
+	})
 })