test: e2e plugin test cases

go.mod

@@ -5,13 +5,13 @@ go 1.19
 require (
 	github.com/docker/docker-credential-helpers v0.7.0
 	github.com/notaryproject/notation-core-go v1.0.0-rc.1
-	github.com/notaryproject/notation-go v1.0.0-rc.1
+	github.com/notaryproject/notation-go v1.0.0-rc.1.0.20230202184312-32d23721c08f
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0-rc2
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
-	oras.land/oras-go/v2 v2.0.0-rc.6
+	oras.land/oras-go/v2 v2.0.0
 )
 
 require (
@@ -21,9 +21,10 @@ require (
 	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
 	github.com/golang-jwt/jwt/v4 v4.4.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/veraison/go-cose v1.0.0-rc.2 // indirect
+	github.com/veraison/go-cose v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/crypto v0.3.0 // indirect
+	golang.org/x/crypto v0.5.0 // indirect
+	golang.org/x/mod v0.7.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.2.0 // indirect
+	golang.org/x/sys v0.4.0 // indirect
 )

go.sum

@@ -20,8 +20,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/notaryproject/notation-core-go v1.0.0-rc.1 h1:ACi0gr6mD1bzp9+gu3P0meJ/N6iWHlyM9zgtdnooNAA=
 github.com/notaryproject/notation-core-go v1.0.0-rc.1/go.mod h1:n8Gbvl9sKa00KptkKEL5XKUyMTIALe74QipKauE2rj4=
-github.com/notaryproject/notation-go v1.0.0-rc.1 h1:WobIGCUPcPUDCD2qGMCccTfLm2J5y1bsh4SFVsyMIaA=
-github.com/notaryproject/notation-go v1.0.0-rc.1/go.mod h1:xk4q0GXqGfEiy7WmyHi3Om3OM2dgHk0OHL6NIiJv5vA=
+github.com/notaryproject/notation-go v1.0.0-rc.1.0.20230202184312-32d23721c08f h1:gobhG+XfoLJE4mn1+PyKrrdl3Xx77c3EG3u8Jcosz4g=
+github.com/notaryproject/notation-go v1.0.0-rc.1.0.20230202184312-32d23721c08f/go.mod h1:B/26FcjJ9GVXm1j7z+/pWKck80LdFi3KiX4Zu7gixB8=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
@@ -39,28 +39,30 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/veraison/go-cose v1.0.0-rc.2 h1:zH3QmP4N5kwpdGauceIT3aJm8iUyV9OqpUOb+7CF7rQ=
-github.com/veraison/go-cose v1.0.0-rc.2/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
+github.com/veraison/go-cose v1.0.0 h1:Jxirc0rl3gG7wUFgW+82tBQNeK8T8e2Bk1Vd298ob4A=
+github.com/veraison/go-cose v1.0.0/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
-golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
+golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
+golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0 h1:ljd4t30dBnAvMZaQCevtY0xLLD0A+bRZXbgLMLU1F/A=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18=
+golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-oras.land/oras-go/v2 v2.0.0-rc.6 h1:jGWysqm8flq+X0Vj8bZ6rkASAqTab5k18Mx9hEjFc8g=
-oras.land/oras-go/v2 v2.0.0-rc.6/go.mod h1:iVExH1NxrccIxjsiq17L91WCZ4KIw6jVQyCLsZsu1gc=
+oras.land/oras-go/v2 v2.0.0 h1:+LRAz92WF7AvYQsQjPEAIw3Xb2zPPhuydjpi4pIHmc0=
+oras.land/oras-go/v2 v2.0.0/go.mod h1:iVExH1NxrccIxjsiq17L91WCZ4KIw6jVQyCLsZsu1gc=

test/e2e/go.mod

@@ -3,18 +3,25 @@ module github.com/notaryproject/notation/test/e2e
 go 1.19
 
 require (
+	github.com/notaryproject/notation-core-go v1.0.0-rc.1
+	github.com/notaryproject/notation/test/e2e/plugin v1.0.0
 	github.com/onsi/ginkgo/v2 v2.3.0
 	github.com/onsi/gomega v1.22.1
+	github.com/opencontainers/image-spec v1.1.0-rc2
 	oras.land/oras-go/v2 v2.0.0-rc.6
 )
 
 require (
+	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
+	github.com/veraison/go-cose v1.0.0-rc.2 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/net v0.1.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
 	golang.org/x/sys v0.1.0 // indirect
 	golang.org/x/text v0.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace github.com/notaryproject/notation/test/e2e/plugin => ./plugin

test/e2e/go.sum

@@ -1,6 +1,10 @@
+github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
+github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/notaryproject/notation-core-go v1.0.0-rc.1 h1:ACi0gr6mD1bzp9+gu3P0meJ/N6iWHlyM9zgtdnooNAA=
+github.com/notaryproject/notation-core-go v1.0.0-rc.1/go.mod h1:n8Gbvl9sKa00KptkKEL5XKUyMTIALe74QipKauE2rj4=
 github.com/onsi/ginkgo/v2 v2.3.0 h1:kUMoxMoQG3ogk/QWyKh3zibV7BKZ+xBpWil1cTylVqc=
 github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
 github.com/onsi/gomega v1.22.1 h1:pY8O4lBfsHKZHM/6nrxkhVPUznOlIu3quZcKP/M20KI=
@@ -9,6 +13,10 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0-rc2 h1:2zx/Stx4Wc5pIPDvIxHXvXtQFW/7XWJGmnM7r3wg034=
 github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
+github.com/veraison/go-cose v1.0.0-rc.2 h1:zH3QmP4N5kwpdGauceIT3aJm8iUyV9OqpUOb+7CF7rQ=
+github.com/veraison/go-cose v1.0.0-rc.2/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=

test/e2e/internal/notation/host.go

@@ -100,7 +100,7 @@ func AuthOption(username, password string) utils.HostOption {
 // the notation directory.
 func AddKeyOption(keyName, certName string) utils.HostOption {
 	return func(vhost *utils.VirtualHost) error {
-		return AddTestKeyPairs(vhost.AbsolutePath(NotationDirName), keyName, certName)
+		return AddKeyPairs(vhost.AbsolutePath(NotationDirName), keyName, certName)
 	}
 }
 
@@ -124,6 +124,26 @@ func AddTrustPolicyOption(trustpolicyName string) utils.HostOption {
 	}
 }
 
+func AddPlugin(pluginPath string) utils.HostOption {
+	return func(vhost *utils.VirtualHost) error {
+		// add pluginkeys.json configuration file for e2e-plugin
+		saveJSON(
+			generatePluginKeys(vhost.AbsolutePath(NotationDirName)),
+			vhost.AbsolutePath(NotationDirName, "pluginkeys.json"),
+		)
+
+		// install plugin
+		e2ePluginDir := vhost.AbsolutePath(NotationDirName, PluginDirName, PluginName)
+		if err := os.MkdirAll(e2ePluginDir, 0700); err != nil {
+			return err
+		}
+		return copyFile(
+			NotationE2EPluginPath,
+			filepath.Join(e2ePluginDir, "notation-"+PluginName),
+		)
+	}
+}
+
 // authEnv creates an auth info
 // (By setting $NOTATION_USERNAME and $NOTATION_PASSWORD)
 func authEnv(username, password string) map[string]string {

test/e2e/internal/notation/init.go

@@ -14,6 +14,8 @@ const (
 	TrustPolicyName   = "trustpolicy.json"
 	TrustStoreDirName = "truststore"
 	TrustStoreTypeCA  = "ca"
+	PluginDirName     = "plugins"
+	PluginName        = "e2e-plugin"
 )
 
 const (
@@ -22,6 +24,7 @@ const (
 	envKeyRegistryPassword   = "NOTATION_E2E_REGISTRY_PASSWORD"
 	envKeyNotationBinPath    = "NOTATION_E2E_BINARY_PATH"
 	envKeyNotationOldBinPath = "NOTATION_E2E_OLD_BINARY_PATH"
+	envKeyNotationPluginPath = "NOTATION_E2E_PLUGIN_PATH"
 	envKeyNotationConfigPath = "NOTATION_E2E_CONFIG_PATH"
 	envKeyOCILayoutPath      = "NOTATION_E2E_OCI_LAYOUT_PATH"
 	envKeyTestRepo           = "NOTATION_E2E_TEST_REPO"
@@ -34,15 +37,17 @@ var (
 	// NotationOldBinPath is the path of an old version notation binary for
 	// testing forward compatibility.
 	NotationOldBinPath        string
+	NotationE2EPluginPath     string
 	NotationE2EConfigPath     string
 	NotationE2ELocalKeysDir   string
 	NotationE2ETrustPolicyDir string
 )
 
 var (
-	OCILayoutPath string
-	TestRepoUri   string
-	TestTag       string
+	OCILayoutPath       string
+	TestRepoUri         string
+	TestTag             string
+	RegistryStoragePath string
 )
 
 func init() {
@@ -66,6 +71,9 @@ func setUpNotationValues() {
 	setPathValue(envKeyNotationBinPath, &NotationBinPath)
 	setPathValue(envKeyNotationOldBinPath, &NotationOldBinPath)
 
+	// set Notation e2e-plugin path
+	setPathValue(envKeyNotationPluginPath, &NotationE2EPluginPath)
+
 	// set Notation configuration paths
 	setPathValue(envKeyNotationConfigPath, &NotationE2EConfigPath)
 	NotationE2ETrustPolicyDir = filepath.Join(NotationE2EConfigPath, "trustpolicys")

test/e2e/internal/notation/key.go

@@ -16,10 +16,19 @@ type X509KeyPair struct {
 	CertificatePath string `json:"certPath"`
 }
 
+// ExternalKey contains the necessary information to delegate
+// the signing operation to the named plugin.
+type ExternalKey struct {
+	ID           string            `json:"id,omitempty"`
+	PluginName   string            `json:"pluginName,omitempty"`
+	PluginConfig map[string]string `json:"pluginConfig,omitempty"`
+}
+
 // KeySuite is a named key suite.
 type KeySuite struct {
 	Name string `json:"name"`
 	*X509KeyPair
+	*ExternalKey
 }
 
 // SigningKeys reflects the signingkeys.json file.
@@ -28,12 +37,12 @@ type SigningKeys struct {
 	Keys    []KeySuite `json:"keys"`
 }
 
-// AddTestKeyPairs creates the signingkeys.json file and the localkeys directory
+// AddKeyPairs creates the signingkeys.json file and the localkeys directory
 // with e2e.key and e2e.crt
-func AddTestKeyPairs(dir, keyName, certName string) error {
+func AddKeyPairs(dir, keyName, certName string) error {
 	// create signingkeys.json files
 	if err := saveJSON(
-		genTestSigningKey(dir),
+		generateSigningKeys(dir),
 		filepath.Join(dir, SigningKeysFileName)); err != nil {
 		return err
 	}
@@ -49,7 +58,8 @@ func AddTestKeyPairs(dir, keyName, certName string) error {
 	return copyFile(filepath.Join(NotationE2ELocalKeysDir, certName), filepath.Join(localKeysDir, "e2e.crt"))
 }
 
-func genTestSigningKey(dir string) *SigningKeys {
+// generateSigningKeys generates the signingkeys.json for notation.
+func generateSigningKeys(dir string) *SigningKeys {
 	return &SigningKeys{
 		Default: "e2e",
 		Keys: []KeySuite{
@@ -63,3 +73,22 @@ func genTestSigningKey(dir string) *SigningKeys {
 		},
 	}
 }
+
+// generatePluginKeys generates pluginkeys.json for e2e-plugin.
+func generatePluginKeys(dir string) *SigningKeys {
+	return &SigningKeys{
+		Keys: []KeySuite{
+			{
+				Name: "e2e-plugin",
+				X509KeyPair: &X509KeyPair{
+					KeyPath:         filepath.Join(dir, "localkeys", "e2e.key"),
+					CertificatePath: filepath.Join(dir, "localkeys", "e2e.crt"),
+				},
+				ExternalKey: &ExternalKey{
+					ID:         "key1",
+					PluginName: PluginName,
+				},
+			},
+		},
+	}
+}

test/e2e/internal/notation/registry.go

@@ -8,13 +8,16 @@ import (
 	"os"
 	"path/filepath"
 
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"oras.land/oras-go/v2"
 	"oras.land/oras-go/v2/content/oci"
 	"oras.land/oras-go/v2/registry"
 	"oras.land/oras-go/v2/registry/remote"
 	"oras.land/oras-go/v2/registry/remote/auth"
 )
 
+const ArtifactTypeNotation = "application/vnd.cncf.notary.signature"
+
 type Registry struct {
 	Host     string
 	Username string
@@ -98,6 +101,31 @@ func (r *Artifact) ReferenceWithDigest() string {
 	return fmt.Sprintf("%s/%s@%s", r.Host, r.Repo, r.Digest)
 }
 
+// SignatureManifest returns the manifest of the artifact.
+func (r *Artifact) SignatureDescriptors() ([]ocispec.Descriptor, error) {
+	ctx := context.Background()
+	repo, err := newRepository(r.ReferenceWithDigest())
+	if err != nil {
+		return nil, err
+	}
+
+	// get manifest descriptor
+	desc, err := repo.Manifests().Resolve(ctx, r.ReferenceWithDigest())
+	if err != nil {
+		return nil, err
+	}
+
+	// get signature descriptors
+	var descriptors []ocispec.Descriptor
+	if err := repo.Referrers(context.Background(), desc, ArtifactTypeNotation, func(referrers []ocispec.Descriptor) error {
+		descriptors = append(descriptors, referrers...)
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return descriptors, nil
+}
+
 func newRepoName() string {
 	var newRepo string
 	seed := maphash.MakeSeed()

test/e2e/plugin/README.md

@@ -0,0 +1,39 @@
+# Notation E2E Plugin
+The package implement a simple plugin for Notation plugin extensibility E2E test.
+
+## Commands
+It support following commands:
+- get-plugin-metadata (the plugin information)
+- describe-key (the keySpec)
+- generate-signature (signing a payload with protected data)
+- generate-envelope (signing a payload with a descriptor and generate the envelope)
+- verify-signature (fake verifier for testing the plugin protocol)
+
+the `SIGNATURE_GENERATOR.RAW` and `SIGNATURE_GENERATOR.ENVELOPE` capabilities are hidden by default. `SIGNATURE_VERIFIER.TRUSTED_IDENTITY` and `SIGNATURE_VERIFIER.REVOCATION_CHECK` are shown all the time in the response of `get-plugin-metadata` command.
+
+You can enable one of signing capability by passing the enable flag in PluginConfig for `get-plugin-metadata` command:
+```json
+{
+    "pluginConfig": {
+        "SIGNATURE_GENERATOR.RAW": "true"
+    }
+}
+```
+> Notation only uses one of `SIGNATURE_GENERATOR.RAW` or `SIGNATURE_GENERATOR.ENVELOPE` capability for a signing operation.
+
+## Config
+It reads the $NOTATION_CONFIG_DIR/pluginkeys.json to get the key and cert info.
+
+example pluginkey.json file
+```json
+{
+    "keys": [
+        {
+            "name": "e2e",
+            "id": "keyid",
+            "keyPath": "/home/username/.config/notation/localkeys/e2e.key",
+            "certPath": "/home/username/.config/notation/localkeys/e2e.crt"
+        }
+    ]
+}
+```