Notation CLI baseline by shizhMSFT · Pull Request #83 · notaryproject/notation

shizhMSFT · 2021-09-03T11:01:52Z

Notation CLI alpha based on notaryproject/notation-go#5 and the prototype-2 branch.

This PR is an accumulated contribution.

Resolves Add key generation support to nv2 #66
Closes Added certificates generate command #68
Resolves Add certificate management to nv2 docker plugin #69
Closes Added certificate management commands to the docker nv2 plugin. #70
0d29519 resolves notation pull peek --> notation list #84
07dada7 resolves Implement --plain-http as a configuration #85
9c5c749 resolves notation cert generate-test should not add to verification certs #86

Related PRs:

This is a joint commit of - Shiwei Zhang - Steve Lasker - Aviral Takkar Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Based on our [Notary v2 call this week](https://hackmd.io/_vrqBGAOSUC_VWvFzWruZw?view), we agreed to merge this into a `prototype-1` branch. This will give us a baseline to which we can open issues and submit new PRs.

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Distribution options for persistence & discovery Renaming the PR and file to capture the design discussions. As this fork represents a prototype, we'll merge this in, clearing the root README.md for the current implementation.

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Prototype 2 Demo Script

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

mnltejaswini · 2021-09-08T18:39:43Z

cmd/docker-notation/docker/manifest.go

+		return ocispec.Descriptor{}, err
+	}
+	insecure := config.IsRegistryInsecure(ref.Registry)
+	if host, _, _ := net.SplitHostPort(ref.Registry); host == "localhost" {


Do we need to include 127.0.0.1?

all loopback interfaces

mnltejaswini · 2021-09-08T18:41:55Z

cmd/docker-notation/docker/signature.go

+	}
+
+	insecure := config.IsRegistryInsecure(hostname)
+	if host, _, _ := net.SplitHostPort(hostname); host == "localhost" {


maybe worth having it as util for determining insecure property from hostname

Can we create an issue to track, and merge?

SteveLasker · 2021-09-08T19:01:48Z

Per the notation call today, we've agreed to merge this as a baseline to create issues and continue iterations.

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

priteshbandi

Some high-level comments:

For better readability, we need to add some documentation for packages and exported names.
We should also add unit tests. At minimum we need test which exercises positive scenario(successful signing and verification) to avoid breaking changes.
The Commit history doesn't look right; also, can we please update the commit message?
We need better error messages
The cli should exit with proper exit code(non zero for failures) Ref
The package structure should be reorganized for better readability.

cmd
  |->docker-generate --> contains cmd to generates docker artifact
  |->docker-notation --> 
       |->crypto     --> not a cli file but a implementation of signer and verifier; shouldn’t be inside cmd
       |->docker     --> contains docker related helper method; shouldn’t be inside cmd
       |->notation   --> contains docker pull,push,etc commands
internal
  |->docker          --> it’s a cli helper; should go to cmd
  |->io
  |->os
  |->version         --> it’s a cli helper; should go to cmd
pkg                  --> What's the difference between internal and pkg? 
  |->cache           --> contains signature related methods; why its named cache?
  |->config          --> contains user config
  |->docker          --> Docker related helper to get image; should this go to registry?
  |->registry        --> Docker related helper

Tracking issue #93

.github/workflows/golang.yml

.github/workflows/release-github.yml

cmd/docker-generate/manifest.go

cmd/docker-generate/metadata.go

cmd/docker-notation/crypto/service.go

cmd/docker-notation/sign.go

cmd/notation/list.go

cmd/notation/cache.go

cmd/notation/verify.go

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

priteshbandi · 2021-09-14T00:22:19Z

cmd/docker-notation/crypto/service.go

@@ -0,0 +1,40 @@
+package crypto


should service.go be added as default implementation in notation-lib?

priteshbandi · 2021-09-15T18:39:54Z

cmd/notation/common.go

+	passwordFlag = &cli.StringFlag{
+		Name:    "password",
+		Aliases: []string{"p"},
+		Usage:   "password for generic remote access",
+		EnvVars: []string{"NOTATION_PASSWORD"},
+	}


Taking password from cli in plain text is a security risk as its visible while typing and can be seen in shell history.

priteshbandi · 2021-09-15T18:47:11Z

pkg/config/config.go

+	VerificationCertificates VerificationCertificates `json:"verificationCerts"`
+	SigningKeys              SigningKeys              `json:"signingKeys,omitempty"`
+	InsecureRegistries       []string                 `json:"insecureRegistries"`


instead of exporting types can we export routines so that underlying implementation can be changed without affecting callers.

sajayantony

As per morning call we will have issues tracking things called out above by @mnltejaswini @priteshbandi and others.

NiazFK

Approving with comments tracked in issues.

* Initial prototype * Distribution api proposal * Formating fix * JWT based system (notaryproject#16) * Fix paging api link * Resolve spelling errors * Fix examples to include full descriptor * Use library implementation * refactor network transport * add makefile * update dependency * push signature support * pull signature support * integrate sign and push * no output on sign-then-push by default * better ux for signature info * make install better * update notary library * update dependencies * Multiple signatures support (notaryproject#52) * pull signatures when pulling images (notaryproject#54) * Explicit add original references when signing (notaryproject#57) * create parent folders before create config file (notaryproject#59) * Add git clone steps to building.md * Ci 2 (notaryproject#49) * Add basic workflow that compiles the binary * Add dependabot for Go dependencies * Add dependabot for github-actions * Update workflow to use Makefile * extract `list` from `pull --peek` * rename digest to sigDigests for code readability * update doc for building * refine doc for building * plain http in config * no default trust on generated cert * clean up media type * refine docker-notation * cached pull * refactor notation code * fix reference print * refactor docker-notation code * compare registry host case insensitively * refine docker-notation pull output * safer prune * prepare for v0.5.2 release * update notation-go-lib dependency * update release for go releaser * update notation-go-lib dependency * make github workflow consistent * output stderr for docker-generate * move implementations to the correct package * Include .editorconfig compatible with go fmt * Run CI on go 1.16 * Since go 1.16 some ioutil functions are deprecated and moved into the io package. Therefore can't build with previous versions of Go anymore * Add help task to Makefile * Add CI status badge * Notation CLI Alpha * bump notation-go-lib * prepare for 0.5.1 release * refine notation sign * Bump actions/cache from 2.1.4 to 2.1.6 * Bumps [actions/cache](https://github.com/actions/cache) from 2.1.4 to 2.1.6. * [Release notes](https://github.com/actions/cache/releases) * [Commits](actions/cache@v2.1.4...v2.1.6) This is a joint commit of - Shiwei Zhang - Aviral Takkar - Sajay Antony - Steve Lasker - Marco Franssen Signed-off-by: Steve Lasker <stevenlasker@hotmail.com> Signed-off-by: Shiwei Zhang <shizh@microsoft.com> Signed-off-by: Marco Franssen <marco.franssen@gmail.com>

shizhMSFT and others added 30 commits July 31, 2020 13:36

Initial prototype

efe151d

This is a joint commit of - Shiwei Zhang - Steve Lasker - Aviral Takkar Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Distribution api proposal

f494914

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Formating fix

230940d

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Formating fix

945c02c

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

JWT based system (#16)

a42acd8

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Update examples

02723c7

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Fix extra curly bracket

7902d29

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Fix extra curly bracket

a1b85a7

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Merge pull request #8 from shizhMSFT/main

f4765d1

Based on our [Notary v2 call this week](https://hackmd.io/_vrqBGAOSUC_VWvFzWruZw?view), we agreed to merge this into a `prototype-1` branch. This will give us a baseline to which we can open issues and submit new PRs.

Add examples of signing a multi-arch image

cbd9bfa

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Fix paging api link

4e392ca

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Resolve spelling errors

24207bb

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Fix examples to include full descriptor

276abe4

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

typo feedback

6298cd2

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Renamed as options to keep as reference. Updated digest references

578ecad

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Doc and Demo updates

73112f4

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Doc and Demo updates

a5bac5d

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

nv2 demo script updates

3a6d3a6

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

nv2 demo: cleanup steps

a7ae4eb

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Prototype-2 initial mocks

24fc5c5

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Prototype-2 initial mocks

9f54b68

Signed-off-by: Steve Lasker <stevenlasker@hotmail.com>

Merge pull request #42 from SteveLasker/prototype-2

bc042ea

Prototype 2 Demo Script

Use library implementation

7fbc45f

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

converge docker-generate

4a0a77d

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

converge docker-nv2

3d6c0a9

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

refactor network transport

545280e

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

add makefile

cd28c19

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

update dependency

41012fb

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

push signature support

62e2eee

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

shizhMSFT added 4 commits September 7, 2021 18:18

compare registry host case insensitively

2862bb4

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

refine docker-notation pull output

4c4a3c3

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

safer prune

8746d03

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

prepare for v0.5.2 release

379b37a

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

mnltejaswini reviewed Sep 8, 2021

View reviewed changes

update notation-go-lib dependency

46918e8

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

shizhMSFT force-pushed the main branch from f72ee47 to 46918e8 Compare September 10, 2021 15:52

shizhMSFT changed the title ~~Notation CLI Alpha~~ Notation CLI baseline Sep 13, 2021

priteshbandi reviewed Sep 13, 2021

View reviewed changes

update release for go releaser

68b632e

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

SteveLasker mentioned this pull request Sep 14, 2021

Cli commands #79

Closed

shizhMSFT added 5 commits September 15, 2021 10:38

update notation-go-lib dependency

b3b65a5

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

update authors

73d6fe0

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

make github workflow consistent

b75d34f

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

output stderr for docker-generate

33d34e6

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

move implementations to the correct package

875fadd

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

priteshbandi reviewed Sep 15, 2021

View reviewed changes

priteshbandi mentioned this pull request Sep 15, 2021

Tracking issue for pending feedbacks/Issues in PR83(Notation CLI baseline) #93

Closed

17 tasks

SteveLasker requested a review from NiazFK September 15, 2021 22:20

sajayantony approved these changes Sep 15, 2021

View reviewed changes

NiazFK approved these changes Sep 15, 2021

View reviewed changes

SteveLasker merged commit 387ae5c into notaryproject:main Sep 16, 2021

shizhMSFT deleted the main branch September 16, 2021 08:11

dtzar mentioned this pull request Jul 29, 2022

Export routines versus types #273

Closed

This was referenced Aug 4, 2022

Remove hardcoded reference to "localhost" #279

Closed

Whenever shelling out read both error and std streams for Notation client #280

Closed

Don't overwrite files if file exists unless explicitly indicated by user #281

Closed

Conversation

shizhMSFT commented Sep 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mnltejaswini Sep 8, 2021

Choose a reason for hiding this comment

Uh oh!

mnltejaswini Sep 9, 2021

Choose a reason for hiding this comment

Uh oh!

mnltejaswini Sep 8, 2021

Choose a reason for hiding this comment

Uh oh!

SteveLasker Sep 8, 2021

Choose a reason for hiding this comment

Uh oh!

SteveLasker commented Sep 8, 2021

Uh oh!

priteshbandi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

priteshbandi Sep 14, 2021

Choose a reason for hiding this comment

Uh oh!

priteshbandi Sep 15, 2021

Choose a reason for hiding this comment

Uh oh!

priteshbandi Sep 15, 2021

Choose a reason for hiding this comment

Uh oh!

sajayantony left a comment

Choose a reason for hiding this comment

Uh oh!

NiazFK left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Comments

shizhMSFT commented Sep 3, 2021 •

edited

Loading

priteshbandi left a comment •

edited

Loading