Notation rc.1 release check-in since 11/17/2022

[yizha1]

Notation rc.1 status on 11/17/2022, check comments column of rc.1-notdone for details.

• Unblock Ratify, done (verified by ratify team)

  • Using Verifier without a repository notation-go#143

• Notation-go refactoring, 2 days delay, 2 PRs left, request re-review

  • Sign interface: update: Package signature refactoring notation-go#200
  • fix: update plugin to add ContractVersion notation-go#207

• Notation cli update to notation-go interface, on track

  • update: update notation CLI with notation-go refactoring notation#445

• Notation using OCI artifact manifest to store signatures, on track

  • Notation-go is done
  • Notation cli ongoing, update: update notation CLI with notation-go refactoring notation#445

• Using timeout as the restricting mechanism fo signature verification, risky

  • Using timeout as the restricting mechanism fo signature verification notation-go#201
  • Can we support "Max Signature Attempts" first for rc.1? We also need to discuss where to put the configuration (new flag for verify command, or new configuration parameter or both)

• Tag to digest UX improvements, risky

  • [User Story] - Notation sign/verify Tag to Digest translation roadmap#61
  • Spec is still under PR review (cover part of debug options)
  • Implementation pending

• Debug options, risky

  • Add --debug option to Notation CLI Sign and Verify commands to help with troubleshooting and logging notation#300
  • Partly covered by "Tag to digest UX improvements"
  • Need align the next step. Maybe this issue can be shared by two teams, since it is just to add debug info in the code.

• E2E testing (suggest removing from rc.1)

  • E2E Automation Testing for CLI commands roadmap#47

• Documentation:

  • Trust policy document (Toddy could you share the right link)
  • Other documentations are less important for rc.1

[vaninrao10]

1. Tag to digest UX improvements, risky
   • [User Story] - Notation sign/verify Tag to Digest translation roadmap#61 - We can complete the Spec and get the PR to closure and move the
     implementation to POST rc.1
2. Add Expiry in generate envelop to be passed to plugin.
   • GenerateEnvelope plugin request doesnot have expiry. notation#443 - Should be part of rc.1
3. Certificate Revocation
   • Key Management - Rescinding Certificates #72 - Should be part of rc.1
4. Using timeout as the restricting mechanism for signature verification,
   • Using timeout as the restricting mechanism fo signature verification notation-go#201 - Updated the issue as per the discussion. Define the CLI behavior and
     defaults in RC1.
5. E2E testing (suggest moving to post rc.1)
   • E2E Automation Testing for CLI commands roadmap#47
6. TODOs in signature Package
   • Tracks multiple TODOs in signature package notation-go#80 - This is the PR review stage and hence can probably make it to rc.1
7. Deadcode clean up
   • Dead code cleanup and other quality improvements notation#392 - This can be moved to post rc.1
8. Debug options
   • Can be moved to Post rc.1 if no concerns.
9. We also need to talk about the fall back logic to be in the ORAS Lib or Notation Client. - Still not discussed ? and this should be part of rc.1 ?

[yizha1]

@priteshbandi any update on this issue? notaryproject/notation#443. The spec need to be updated by you.

@vaninrao10 per last discussion, fallback to image manifest will be the scope of rc.2. We can confirm this again on Nov 21 community call

[yizha1]

/cc @shizhMSFT @FeynmanZhou @toddysm for rc.1 release discussion thread.

[yizha1]

Notation CLI

• update: update notation CLI with notation-go refactoring notation#445, +1 by one org
• spec: update cli verify spec for UX improvement notation#440, request re-review
• spec: update cli sign spec for tag to digest translation notation#439, request re-review
• doc: add CLI help doc to notation key, cert, and notation plugin in RC.1 notation#394, ongoing

Notation-go

• Add: added set data structure notation-go#210,
• update: check SignatureMediaType in notation.Verify notation-go#208, request re-review
• fix: update plugin to add ContractVersion notation-go#207,
• update: replaced strings.Index with strings.Cut notation-go#211,
• Add additional header validation for payload notation-go#178, removed from rc.1 scope
• update: updated MaxSignatureAttempts logic notation-go#213, request re-review

Notation-core-go

• update: enabled cose to verify time in Tag1 Datetime format notation-core-go#95,

notaryproject

• spec: move certificate chain discussion to a new issue #209, done
• spec: update signature spec for OCI artifact manifest #203, done
• COSE envelope signature spec updates #148, done

[FeynmanZhou]

For the CLI help doc in RC.1, apart from notaryproject/notation#394, I will raise a new PR to update the command notation sign and verify later.

[yizha1]

Status on Nov 29.

Summary

It is proposed to postpone rc.1 release for a week. The new date is Dec 5, 2022

PR Status

• notation-core-go, done
• notatoryproject
  • Pass expiry to generate-envelope plugin, ==>ready to merge
• notation-go
  • update: bump up dependencies, ready to merge
• notation CLI
  • update: update notation CLI with notation-go refactoring notation#445, ==>approved by one org, under review
  • verify spec: spec: update cli verify spec for UX improvement notation#440, ==>request re-review
  • sign spec: spec: update cli sign spec for tag to digest translation notation#439, ==>request re-review
  • CLI command help doc
    • doc: update CLI help doc for notation sign and verify in RC.1 notation#454, ==>under review
    • doc: add CLI help doc to notation key, cert, and notation plugin in RC.1 notation#394, ==>under review

What's more

Add back work item: debug logs for notation sign and verify commands, because it's hard to do troubleshooting for some verification failures, see results notaryproject/notation#452

Maybe we cannot complete all the debug logs we want to add, but make sure we add necessary ones. We can complete all in rc.2 release.