feat: add support for signed user metadata

[byronchien]

Adds support for signed user metadata in notation sign and notation verify. Relevant spec

example sign usage:

chienb@a07817b52895 notation % notation sign $IMAGE --user-metadata io.wabbit-networks.buildId=123 --user-metadata io.wabbit-networks.buildTime=123
Warning: Always sign the artifact using digest(`@sha256:...`) rather than a tag(`:v1`) because tags are mutable and a tag reference can point to a different artifact than the one signed.
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before signing.
Successfully signed localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

example metadata displayed on verification (without metadata flag)

chienb@a07817b52895 notation % notation verify $IMAGE
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Successfully verified signature for localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

The artifact was signed with the following user metadata.

KEY                          VALUE
io.wabbit-networks.buildTime   123
io.wabbit-networks.buildId     123

example verification:

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata io.wabbit-networks.buildTime=123
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Successfully verified signature for localhost:5000/net-monitor@sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b

The artifact was signed with the following user metadata.

KEY                            VALUE
io.wabbit-networks.buildTime   123
io.wabbit-networks.buildId     123

example verification failure

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata foo=bar
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Error: signature verification failed: signature verification failed

Signed-off-by: Byron Chien [email protected]

[byronchien]

related: notaryproject/notation#507

[codecov-commenter]

Codecov Report

Merging #242 (ffaf954) into main (e11bfd8) will increase coverage by 0.03%.
The diff coverage is 57.74%.

@@            Coverage Diff             @@
##             main     #242      +/-   ##
==========================================
+ Coverage   73.31%   73.34%   +0.03%     
==========================================
  Files          23       23              
  Lines        1746     1827      +81     
==========================================
+ Hits         1280     1340      +60     
- Misses        372      390      +18     
- Partials       94       97       +3     

Impacted Files	Coverage Δ
errors.go	0.00% <0.00%> (ø)
notation.go	58.03% <50.98%> (-1.84%)	⬇️
verifier/verifier.go	76.75% <100.00%> (+3.28%)	⬆️
registry/repository.go	39.18% <0.00%> (+6.98%)	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[priteshbandi]

chienb@a07817b52895 notation % notation verify $IMAGE --user-metadata foo=bar
Resolved artifact tag `v1` to digest `sha256:5a07385af4e6b6af81b0ebfd435aedccdfa3507f0609c658209e1aba57159b2b` before verification.
Warning: The resolved digest may not point to the same signed artifact, since tags are mutable.
Error: signature verification failed: signature verification failed

Shouldn't the error message be something like, missing matching user-metadata in the signature. ?

[priteshbandi]

LGTM

[patrickzheng200]

LGTM with one comment

[yizha1]

@byronchien could you fix the conflicts?

[byronchien]

resolved conflict

[shizhMSFT]

LGTM