Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create v2.0.0.alpha-4.MD release notes #65

Merged
merged 6 commits into from
Oct 27, 2022
Merged
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions RELEASENOTES/v2.0.0.alpha-4.MD
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
# Notary v2 Alpha 4 Release

## Overview
Notary v2 working group is pleased to announce the fourth release, Alpha 4. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). This release includes updates to the [notaryproject/notaryproject](https://github.com/notaryproject/notaryproject) repo to provide the community with updated specifications and an updated implementation of Notation client for signing and verifying artifacts.

- [Notary v2 specifications](https://github.com/notaryproject/notaryproject) ***[(notaryproject-v1.0.0-draft.4)](https://github.com/notaryproject/notaryproject/releases/tag/v1.0.0-draft.4)*** (Updated in this release)
- [Notation Library 1](https://github.com/notaryproject/notation-core-go) ***[(notation-core-go-v0.1.0-alpha.4)](https://github.com/notaryproject/notation-core-go/releases/tag/v0.1.0-alpha.4)*** (Updated in this release)
- [Notation Library 2](https://github.com/notaryproject/notation-go) ***[(notation-go-v0.10.0-alpha.4)](https://github.com/notaryproject/notation-go/releases/tag/v0.10.0-alpha.4)*** (Updated in this release)
- [Notation CLI](https://github.com/notaryproject/notation) ***([notation-v0.10.0-alpha.4)](https://github.com/notaryproject/notation/releases/tag/v0.10.0-alpha.4)*** (Updated in this release)
iamsamirzon marked this conversation as resolved.
Show resolved Hide resolved
## Goal of the release
- Update Notary v2 specifications
iamsamirzon marked this conversation as resolved.
Show resolved Hide resolved
- Community can use the updated specifications to develop their own implementation of Notary v2 in language/platforms of their choice, and/or contribute to Notation client development.
- Signature format (JWS) for signing and verification in RC-1.
- Updates on use of plugins for signing and verification. Plugins let vendors and users integrate base Notation client with their choice of Key Vaults and PKI.
- Update "Notation" (CLI client) implementation to match the latest specifications. With the new client, users can
- Besides the features from Alpha-3, this releases adds support for "self signed certificates".

*We do not recommend this release for use in production environment. Refer release definitions [here](https://github.com/notaryproject/notation/blob/main/RELEASE_MANAGEMENT.md). We suggest using it for testing and providing feedback to the Notary v2 working group only*

## List of feature/capabilities added with this release
For detailed notes on each of the individual repositories (NotaryProject, Notation (for reference CLI implementation) and Notation libraries) users can refer to the individual release notes. A summary view is provided in this document.

### Notary v2 specifications
Updated Trust Policy, Trust Store, Signature Verification and Signing workflows along with extensibility mechanisms via Notation plugins.
- A final JWS based [signature envelope format.](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md)
- Updated [Signature specfication](https://github.com/notaryproject/notaryproject/blob/main/signature-envelope-jws.md) with extensibility provisions for additional signature envelope format.
- Updated [signing and verification workflows](https://github.com/notaryproject/notaryproject/blob/main/signing-and-verification-workflow.md)
- Introducing a new [Signing scheme](https://github.com/notaryproject/notaryproject/blob/main/signing-scheme.md) to integrate Notation Client with Signing Services
- Updated [trust store and trust policy](https://github.com/notaryproject/notaryproject/blob/main/trust-store-trust-policy-specification.md) specification

### Notation CLI Client
Notation is a standalone CLI client based on Notary v2 specs. It supports signing, verifying, and storing signatures in registries supporting signatures as references to images. Refer description below for Notation libraries on how to configure Trust store and trust policy to use with Notation client.

In this release of Notation command, the following CLI commands are supported. Refer (TBD - Getting started here)
- notation sign
iamsamirzon marked this conversation as resolved.
Show resolved Hide resolved
- notation verify
- notation plugin list
- notation cert generate-test

To start using Notation Refer: https://github.com/notaryproject/notation/blob/main/hello-signing.md

### Notation Library
Written in the GO language the Library is divided up into two separate repos - [Notation-go](https://github.com/notaryproject/notation-go) and [Notation-core-go](https://github.com/notaryproject/notation-core-go)

Starting with this release, the trust store will be based on a directory structure and trust policy as a JSON document. Users can simply insert the public certificates inside pre-configured directories for configuring their trust store, and modify the trust policy document to granularly control the scope and behavior of the signature verification policies. The use of the existing CLI commands (introduced in the alpha-1 version of Notation client when the keys/certificates for signing and verifying were specified in a file) has been subsituted by use of a directory based trust store. Refer https://github.com/notaryproject/notation/blob/main/specs/notation-config.md.

## List of fixed issues
Refer individual release notes.

## Roadmap Guidance
*This is not an exhaustive list. Users should refer to the Notary v2 roadmap at https://github.com/notaryproject/roadmap#readme for seeing the plan for subsequent releases and refer to individual subprojects (repositories) releases notes for details*

1. The current signature format JWS is the proposed format for RC-1 release. Notary v2 community plans to support additional signature formats ( such as COSE)
2. Revocation support via Notation client will come in a future release
3. Alternate signature storage schemes which can use OCI Distribution 1.0 based registries is under investigation for a future release

### Backwards Compatibility
This version of Notation client is not compatible with any of the prior releases.