From ed72380f2e930b495a866d6d1cfdbd09a646dac6 Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Thu, 22 Sep 2022 09:36:07 -0700 Subject: [PATCH 1/6] Create v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 56 ++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 RELEASENOTES/v2.0.0.alpha-4.MD diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD new file mode 100644 index 0000000..8eccf3e --- /dev/null +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -0,0 +1,56 @@ +# Notary v2 Alpha 4 Release + +## Overview +Notary v2 working group is pleased to announce the third release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts. + +- [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release) +- [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-go-v1.0.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Added in this release) +- [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.10.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) +- [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.10.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) +## Goal of the release +- Update Notary v2 specifications + - Community can use the updated specifications to develop their own implementation of Notary v2 in language/platforms of their choice, and/or contribute to Notation client development. + - Signature format (JWS) for signing and verification in RC-1. + - Updates on use of plugins for signing and verification. Plugins let vendors and users integrate base Notation client with their choice of Key Vaults and PKI. + - Update "Notation" (CLI client) implementation to match the latest specifications. With the new client, users can + - Besides the features from Alpha-3, this releases adds support for "self signed certificates" for use in non production use cases + +*We do not recommend this release for use in production environment. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). We suggest using it for testing and providing feedback to the Notary v2 working group only* + +## List of feature/capabilities added with this release +For detailed notes on each of the individual repositories (NotaryProject, Notation (for reference CLI implementation) and Notation libraries) users can refer to the individual release notes. A summary view is provided in this document. + +### Notary v2 specifications +Updated Trust Policy, Trust Store, Signature Verification and Signing workflows along with extensibility mechanisms via Notation plugins. +- A final JWS based [signature envelope format.](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md) +- Updated [Signature specfication](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md) with extensibility provisions for additional signature envelope format. +- Updated [signing and verification workflows](https://github.com/notaryproject/notaryproject/blob/main/signing-and-verification-workflow.md) +- Introducing a new [Signing scheme](https://github.com/notaryproject/notaryproject/blob/main/signing-scheme.md) to integrate Notation Client with Signing Services +- Updated [trust store and trust policy](https://github.com/notaryproject/notaryproject/blob/main/trust-store-trust-policy-specification.md) specification + +### Notation CLI Client +Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in [oras-artifacts-spec](https://github.com/oras-project/artifacts-spec/) compliant registries. Starting with this release of Notation, the trust store will be based on a directory structure and trust policy as a JSON document. Users can simply insert the public certificates inside pre-configured directories for configuring their trust store, and modify the trust policy document to granularly control the scope and behavior of the signature verification policies. The use of the existing CLI commands (introduced in the alpha-1 version of Notation client when the keys/certificates for signing and verifying were specified in a file) has been subsituted by use of a directory based trust store. Refer https://github.com/notaryproject/notation/blob/main/specs/notation-config.md. + +In this release of Notation command, the following CLI commands are supported. Refer (TBD - Getting started here) +- notation sign +- notation verify +- notation plugin list +- notation cert generate-test + +To start using Notation Refer: https://github.com/notaryproject/notation/blob/main/hello-signing.md + +### Notation Library +Written in the GO language the Library is divided up into two separate repos - [Notation-go](https://github.com/notaryproject/notation-go) and [Notation-core-go](https://github.com/notaryproject/notation-core-go) + +## List of fixed issues +Refer individual release notes. + +## Roadmap Guidance +*This is not an exhaustive list. Users should refer to the Notary v2 roadmap at https://github.com/notaryproject/roadmap#readme for seeing the plan for subsequent releases and refer to individual subprojects (repositories) releases notes for details* + +1. The current signature format JWS is the proposed format for RC-1 release. Notary v2 community plans to support additional signature formats ( such as COSE) +2. Revocation support via Notation client will come in a future release +3. Alternate signature storage schemes which can use OCI Distribution 1.0 based registries is under investigation for a future release + +### Backwards Compatibility +This version of Notation client is not compatible with any of the prior releases. From 64dc10bef0e29be1b3fe84e64e87fe99f329c267 Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Thu, 22 Sep 2022 12:15:42 -0700 Subject: [PATCH 2/6] Update v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD index 8eccf3e..e461418 100644 --- a/RELEASENOTES/v2.0.0.alpha-4.MD +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -13,7 +13,7 @@ Notary v2 working group is pleased to announce the third release, Alpha 4. Refer - Signature format (JWS) for signing and verification in RC-1. - Updates on use of plugins for signing and verification. Plugins let vendors and users integrate base Notation client with their choice of Key Vaults and PKI. - Update "Notation" (CLI client) implementation to match the latest specifications. With the new client, users can - - Besides the features from Alpha-3, this releases adds support for "self signed certificates" for use in non production use cases + - Besides the features from Alpha-3, this releases adds support for "self signed certificates". *We do not recommend this release for use in production environment. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). We suggest using it for testing and providing feedback to the Notary v2 working group only* From c3465b0a5cdfecea6f62c53ce713c3c5dd220205 Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Tue, 4 Oct 2022 11:17:33 -0700 Subject: [PATCH 3/6] Update v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD index e461418..4217bdf 100644 --- a/RELEASENOTES/v2.0.0.alpha-4.MD +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -4,7 +4,7 @@ Notary v2 working group is pleased to announce the third release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts. - [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release) -- [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-go-v1.0.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Added in this release) +- [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-core-go-v0.1.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Updated in this release) - [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.10.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) - [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.10.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) ## Goal of the release @@ -29,7 +29,7 @@ Updated Trust Policy, Trust Store, Signature Verification and Signing workflows - Updated [trust store and trust policy](https://github.com/notaryproject/notaryproject/blob/main/trust-store-trust-policy-specification.md) specification ### Notation CLI Client -Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in [oras-artifacts-spec](https://github.com/oras-project/artifacts-spec/) compliant registries. Starting with this release of Notation, the trust store will be based on a directory structure and trust policy as a JSON document. Users can simply insert the public certificates inside pre-configured directories for configuring their trust store, and modify the trust policy document to granularly control the scope and behavior of the signature verification policies. The use of the existing CLI commands (introduced in the alpha-1 version of Notation client when the keys/certificates for signing and verifying were specified in a file) has been subsituted by use of a directory based trust store. Refer https://github.com/notaryproject/notation/blob/main/specs/notation-config.md. +Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in registries supporting signatures as references to images. Refer description below for Notation libraries on how to configure Trust store and trust policy to use with Notation client. In this release of Notation command, the following CLI commands are supported. Refer (TBD - Getting started here) - notation sign @@ -42,6 +42,8 @@ To start using Notation Refer: https://github.com/notaryproject/notation/blob/ma ### Notation Library Written in the GO language the Library is divided up into two separate repos - [Notation-go](https://github.com/notaryproject/notation-go) and [Notation-core-go](https://github.com/notaryproject/notation-core-go) +Starting with this release, the trust store will be based on a directory structure and trust policy as a JSON document. Users can simply insert the public certificates inside pre-configured directories for configuring their trust store, and modify the trust policy document to granularly control the scope and behavior of the signature verification policies. The use of the existing CLI commands (introduced in the alpha-1 version of Notation client when the keys/certificates for signing and verifying were specified in a file) has been subsituted by use of a directory based trust store. Refer https://github.com/notaryproject/notation/blob/main/specs/notation-config.md. + ## List of fixed issues Refer individual release notes. From 37d0ca984d7c83827473aeae0ae61c019f1a3b53 Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Tue, 4 Oct 2022 11:17:56 -0700 Subject: [PATCH 4/6] Update v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD index 4217bdf..ca314e6 100644 --- a/RELEASENOTES/v2.0.0.alpha-4.MD +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -1,7 +1,7 @@ # Notary v2 Alpha 4 Release ## Overview -Notary v2 working group is pleased to announce the third release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts. +Notary v2 working group is pleased to announce the fourth release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts. - [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release) - [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-core-go-v0.1.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Updated in this release) From 8a9f924e803be368d6f94ab775ecd8214f54180c Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Mon, 24 Oct 2022 17:06:05 -0700 Subject: [PATCH 5/6] Update v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD index ca314e6..2a48aa7 100644 --- a/RELEASENOTES/v2.0.0.alpha-4.MD +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -5,8 +5,8 @@ Notary v2 working group is pleased to announce the fourth release, Alpha 4. Refe - [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release) - [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-core-go-v0.1.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Updated in this release) -- [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.10.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) -- [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.10.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.4)*** (Updated in this release) +- [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.11.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.11.0-alpha.4)*** (Updated in this release) +- [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.11.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4)*** (Updated in this release) ## Goal of the release - Update Notary v2 specifications - Community can use the updated specifications to develop their own implementation of Notary v2 in language/platforms of their choice, and/or contribute to Notation client development. @@ -27,6 +27,7 @@ Updated Trust Policy, Trust Store, Signature Verification and Signing workflows - Updated [signing and verification workflows](https://github.com/notaryproject/notaryproject/blob/main/signing-and-verification-workflow.md) - Introducing a new [Signing scheme](https://github.com/notaryproject/notaryproject/blob/main/signing-scheme.md) to integrate Notation Client with Signing Services - Updated [trust store and trust policy](https://github.com/notaryproject/notaryproject/blob/main/trust-store-trust-policy-specification.md) specification +- COSE Signature evenvelope support is added. ### Notation CLI Client Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in registries supporting signatures as references to images. Refer description below for Notation libraries on how to configure Trust store and trust policy to use with Notation client. From bb47a98a2b1fc03c4b30e0bd7f85d15175b39c6e Mon Sep 17 00:00:00 2001 From: Samir Kakkar <83560495+iamsamirzon@users.noreply.github.com> Date: Wed, 26 Oct 2022 16:56:29 -0700 Subject: [PATCH 6/6] Update v2.0.0.alpha-4.MD --- RELEASENOTES/v2.0.0.alpha-4.MD | 34 +++++++++------------------------- 1 file changed, 9 insertions(+), 25 deletions(-) diff --git a/RELEASENOTES/v2.0.0.alpha-4.MD b/RELEASENOTES/v2.0.0.alpha-4.MD index 2a48aa7..89de60a 100644 --- a/RELEASENOTES/v2.0.0.alpha-4.MD +++ b/RELEASENOTES/v2.0.0.alpha-4.MD @@ -1,38 +1,25 @@ # Notary v2 Alpha 4 Release ## Overview -Notary v2 working group is pleased to announce the fourth release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts. +Notary v2 working group is pleased to announce the fourth release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release is just for Notation client and the two libraries that are used to build Notation client. -- [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release) - [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-core-go-v0.1.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Updated in this release) - [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.11.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.11.0-alpha.4)*** (Updated in this release) - [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.11.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.11.0-alpha.4)*** (Updated in this release) ## Goal of the release -- Update Notary v2 specifications - - Community can use the updated specifications to develop their own implementation of Notary v2 in language/platforms of their choice, and/or contribute to Notation client development. - - Signature format (JWS) for signing and verification in RC-1. - - Updates on use of plugins for signing and verification. Plugins let vendors and users integrate base Notation client with their choice of Key Vaults and PKI. - - Update "Notation" (CLI client) implementation to match the latest specifications. With the new client, users can - - Besides the features from Alpha-3, this releases adds support for "self signed certificates". +- Update "Notation" (CLI client) implementation to match the latest specifications. With the new client, users can sign and verify OCI artifacts. + - Besides the features from Alpha-3, this releases adds support for "self signed certificates" and an additional signature envelope format, "COSE". + - Added support for "Verfication" Plugins *We do not recommend this release for use in production environment. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). We suggest using it for testing and providing feedback to the Notary v2 working group only* ## List of feature/capabilities added with this release -For detailed notes on each of the individual repositories (NotaryProject, Notation (for reference CLI implementation) and Notation libraries) users can refer to the individual release notes. A summary view is provided in this document. - -### Notary v2 specifications -Updated Trust Policy, Trust Store, Signature Verification and Signing workflows along with extensibility mechanisms via Notation plugins. -- A final JWS based [signature envelope format.](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md) -- Updated [Signature specfication](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md) with extensibility provisions for additional signature envelope format. -- Updated [signing and verification workflows](https://github.com/notaryproject/notaryproject/blob/main/signing-and-verification-workflow.md) -- Introducing a new [Signing scheme](https://github.com/notaryproject/notaryproject/blob/main/signing-scheme.md) to integrate Notation Client with Signing Services -- Updated [trust store and trust policy](https://github.com/notaryproject/notaryproject/blob/main/trust-store-trust-policy-specification.md) specification -- COSE Signature evenvelope support is added. +For detailed notes on each of the individual repositories (Notation (for reference CLI implementation) and Notation libraries) users can refer to the individual release notes. A summary view is provided in this document. ### Notation CLI Client -Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in registries supporting signatures as references to images. Refer description below for Notation libraries on how to configure Trust store and trust policy to use with Notation client. +Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in registries supporting signatures as references to images. -In this release of Notation command, the following CLI commands are supported. Refer (TBD - Getting started here) +In this release of Notation command, the following CLI commands are supported. - notation sign - notation verify - notation plugin list @@ -43,17 +30,14 @@ To start using Notation Refer: https://github.com/notaryproject/notation/blob/ma ### Notation Library Written in the GO language the Library is divided up into two separate repos - [Notation-go](https://github.com/notaryproject/notation-go) and [Notation-core-go](https://github.com/notaryproject/notation-core-go) -Starting with this release, the trust store will be based on a directory structure and trust policy as a JSON document. Users can simply insert the public certificates inside pre-configured directories for configuring their trust store, and modify the trust policy document to granularly control the scope and behavior of the signature verification policies. The use of the existing CLI commands (introduced in the alpha-1 version of Notation client when the keys/certificates for signing and verifying were specified in a file) has been subsituted by use of a directory based trust store. Refer https://github.com/notaryproject/notation/blob/main/specs/notation-config.md. - ## List of fixed issues Refer individual release notes. ## Roadmap Guidance *This is not an exhaustive list. Users should refer to the Notary v2 roadmap at https://github.com/notaryproject/roadmap#readme for seeing the plan for subsequent releases and refer to individual subprojects (repositories) releases notes for details* -1. The current signature format JWS is the proposed format for RC-1 release. Notary v2 community plans to support additional signature formats ( such as COSE) -2. Revocation support via Notation client will come in a future release -3. Alternate signature storage schemes which can use OCI Distribution 1.0 based registries is under investigation for a future release +1. Revocation support via Notation client will come in a future release +2. Alternate signature storage schemes which can use OCI Distribution 1.0 based registries is under investigation for a future release ### Backwards Compatibility This version of Notation client is not compatible with any of the prior releases.