Skip to content

Use new methods introduced in keys.go#529

Merged
priteshbandi merged 14 commits intonotaryproject:mainfrom
priteshbandi:signingkey-fix
Feb 3, 2023
Merged

Use new methods introduced in keys.go#529
priteshbandi merged 14 commits intonotaryproject:mainfrom
priteshbandi:signingkey-fix

Conversation

@priteshbandi
Copy link
Copy Markdown
Contributor

@priteshbandi priteshbandi commented Feb 2, 2023

This PR depends on notaryproject/notation-go#246 so please review notaryproject/notation-go#246 first.

patrickzheng200
patrickzheng200 reviewed Feb 2, 2023
View reviewed changes
@priteshbandi priteshbandi added this to the RC-2 milestone Feb 2, 2023
patrickzheng200
patrickzheng200 reviewed Feb 2, 2023
View reviewed changes
patrickzheng200
patrickzheng200 reviewed Feb 2, 2023
View reviewed changes
patrickzheng200
patrickzheng200 approved these changes Feb 3, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@patrickzheng200 patrickzheng200 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with one nit comment

JeyJeyGao and others added 10 commits February 2, 2023 19:09
@JeyJeyGao
test: e2e quickstart test case (notaryproject#494)
1ee2aa4 
Signed-off-by: Junjie Gao <junjiegao@microsoft.com>
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
fixes
7e283e6 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
fixes
d9cd066 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
Updates after refactor keys.go
1b8860c 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
@dependabot
build(deps): Bump oras.land/oras-go/v2 from 2.0.0-rc.6 to 2.0.0 (nota…
c1d4c05 
…ryproject#512)

Bumps [oras.land/oras-go/v2](https://github.com/oras-project/oras-go)
from 2.0.0-rc.6 to 2.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oras-project/oras-go/releases">oras.land/oras-go/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.0</h2>
<h1>Brand New V2 Library</h1>
<h2>What's New</h2>
<p>In version <code>v2</code>, ORAS Go library has been completely
refreshed with:</p>
<ul>
<li>More unified interfaces</li>
<li>Notably fewer dependencies</li>
<li>Higher test coverage</li>
<li>Better documentation</li>
<li>Balanced security and performance</li>
</ul>
<p>Besides, ORAS Go <code>v2</code> is now a registry client conforming
<a
href="https://github.com/opencontainers/image-spec/releases/tag/v1.1.0-rc2">image-spec
v1.1.0-rc.2</a> and <a
href="https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc1/spec.md">distribution-spec
v1.1.0-rc1</a>.</p>
<p>In ORAS Go <code>v2</code>, artifacts are modeled as Directed Acyclic
Graphs (DAGs) stored in Content-Addressable Storages (CASs). Copying
artifacts across repositories or generic <a
href="https://oras.land/client_libraries/#targets">targets</a> is
implemented as copying single-rooted DAGs across CASs. By <a
href="https://oras.land/client_libraries/#extended-copy">extending the
copy operation</a>, ORAS Go <code>v2</code> further supports copying
underlying DAGs identified by a specific node. For instance, copying a
signed artifact with its signatures across repositories.</p>
<p>Documentation and examples are available at <a
href="https://pkg.go.dev/oras.land/oras-go/v2">pkg.go.dev</a>.</p>
<h2>Deprecation</h2>
<p>Docker based key management is no longer supported. Credentials are
required to be supplied to <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry/remote/auth#Client"><code>auth.Client</code></a>
for authentication. Related discussion can be found at <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/413">#413</a>.</p>
<h2>Migration From <code>v1</code></h2>
<p>See <a
href="https://github.com/oras-project/oras-go/blob/main/MIGRATION_GUIDE.md">MIGRATION_GUIDE.md</a>.</p>
<h1>What's Changed Since RC.6</h1>
<h2>New Features</h2>
<ul>
<li>Implement <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry#TagLister"><code>registry.TagLister</code></a>
for package <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/oci"><code>content/oci</code></a></li>
<li>Add package <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry/remote/retry"><code>registry/remote/retry</code></a>
which provides a default http client with automatic retries</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/395">#395</a>:
<code>oras.Tag()</code> and <code>oras.TagN()</code> should return a
descriptor</li>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/402">#402</a>:
<code>file.Store</code> fails to extract folder containing symbolic
links</li>
<li>fix <a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/404">#404</a>:
<code>oci.Store</code> and <code>file.Store</code> should record an
absolute path instead of a relative path for root</li>
</ul>
<h2>Deprecation</h2>
<ul>
<li><strong>BREAKING CHANGE</strong>: Interface
<code>registry.ReferrerFinder</code> is renamed to <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/registry#ReferrerLister"><code>registry.ReferrerLister</code></a></li>
<li><strong>BREAKING CHANGE</strong>: Remove
<code>file.PackFiles()</code></li>
</ul>
<h2>Other Changes</h2>
<ul>
<li><strong>BREAKING CHANGE</strong>: <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0#Tag"><code>oras.Tag()</code></a>
and <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0#TagN"><code>oras.TagsN()</code></a>
return a descriptor</li>
<li><strong>BREAKING CHANGE</strong>: <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#New"><code>file.New()</code></a>,
<a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#NewWithFallbackLimit"><code>file.NewWithFallbackLimit()</code></a>
and <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/file#NewWithFallbackStorage"><code>file.NewWithFallbackStorage()</code></a>
return an error</li>
<li><strong>BREAKING CHANGE</strong>: <a
href="https://pkg.go.dev/oras.land/oras-go/v2@v2.0.0/content/oci#NewStorage"><code>oci.NewStorage()</code></a>
returns an error</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oras-project/oras-go/commit/96a37c2b359ac1305f70dc31b28c789688d77d0f"><code>96a37c2</code></a>
doc: Update README and clean up godoc comments (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/418">#418</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/5a2e692d45aeb3856583003924cf73e32b62aaf6"><code>5a2e692</code></a>
feat!: retryable http client (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/398">#398</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/39ce054f8c3f1c36064beff059ea54490d5431f0"><code>39ce054</code></a>
test: improve the symlink unit tests for file store (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/414">#414</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/05595ebecd17dc826ceaf661a9e636f1d1020aec"><code>05595eb</code></a>
fix!: use absolute path for OCI root (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/412">#412</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/9867c6a091e2f948abfab8fed33003d21e8bad1a"><code>9867c6a</code></a>
fix!: fix error when extracting folder containing symbolic links (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/411">#411</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/1484139e64f7a1f5f32185432d72d67511414644"><code>1484139</code></a>
build: add dependabot for <code>v1</code> branch, add GitHub Actions (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/399">#399</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/76382aaa94873ad14fddacdbff0f5ed32f43c3aa"><code>76382aa</code></a>
doc: Remove <a href="https://github.com/main"><code>@​main</code></a>
from the godoc URLs in README (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/403">#403</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/29509026fb7f4f5e3fb95d2a2537d28db3e43f66"><code>2950902</code></a>
remove!: Remove <code>file.PackFiles()</code> and add an example instead
(<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/400">#400</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/aa4bd09faaf937860e9400c9d39a1dca031a2274"><code>aa4bd09</code></a>
refactor: optimize performance for Extended Copy (<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/397">#397</a>)</li>
<li><a
href="https://github.com/oras-project/oras-go/commit/7ec22cb11bec16c8f2b53a29023bdffc5e9ac020"><code>7ec22cb</code></a>
feat!: implement <code>Tags</code> for package <code>content/oci</code>
(<a
href="https://github-redirect.dependabot.com/oras-project/oras-go/issues/394">#394</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/oras-project/oras-go/compare/v2.0.0-rc.6...v2.0.0">compare
view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oras.land/oras-go/v2&package-manager=go_modules&previous-version=2.0.0-rc.6&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
@priteshbandi
chore: improve warning message when signing or verifying with tag (no…
7041b60 
…taryproject#497)

### Old
➜  notation git:(main) ✗ ./notation sign $IMAGE
Warning: Always sign the artifact using digest(`@sha256:...`) rather
than a tag(`:v1`) because tags are mutable and a tag reference can point
to a different artifact than the one signed.
Resolved artifact tag `v1` to digest
`sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059`
before signing.
Successfully signed
localhost:6000/net-monitor@sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059

➜  notation git:(main) ✗ ./notation verify $IMAGE
Resolved artifact tag `v1` to digest
`sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059`
before verification.
Warning: The resolved digest may not point to the same signed artifact,
since tags are mutable.
Successfully verified signature for
localhost:6000/net-monitor@sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059

### New

➜ notation git:(main) ✗ ./notation sign $IMAGE
Warning: Always sign the artifact using digest(@sha256:...) rather than a tag(:v1) because tags are mutable and a tag reference can point to a different artifact than the one signed.
Successfully signed localhost:6000/net-monitor@sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059

➜ notation git:(main) ✗ ./notation verify $IMAGE
Warning: Always verify the artifact using digest(@sha256:...) rather than a tag(:v1) because resolved digest may not point to the same signed artifact, as tags are mutable.
Successfully verified signature for localhost:6000/net-monitor@sha256:36ca4d6834ed680362327811238b97c687e77c5cf4a04a74d0853d3c0c17e059

Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
fixes
5c5254a 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
@priteshbandi
Update cmd/notation/key.go
9955cf9 
Co-authored-by: Patrick Zheng <patrickzheng@microsoft.com>
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
fixes
5ce498a 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
@priteshbandi
Update cmd/notation/key.go
3cada08 
Co-authored-by: Patrick Zheng <patrickzheng@microsoft.com>
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
priteshbandi and others added 2 commits February 2, 2023 19:11
@priteshbandi
Merge branch 'notaryproject:main' into signingkey-fix
117a8b0
update deps
4be9cf2 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
update more deps
3f4c666 
Signed-off-by: Pritesh Bandi <pritesb@amazon.com>
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Feb 3, 2023

Codecov Report

Merging #529 (3f4c666) into main (375a701) will increase coverage by 1.26%.
The diff coverage is 0.00%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@            Coverage Diff             @@
##             main     #529      +/-   ##
==========================================
+ Coverage   29.61%   30.87%   +1.26%     
==========================================
  Files          26       25       -1     
  Lines        1513     1399     -114     
==========================================
- Hits          448      432      -16     
+ Misses       1048      950      -98     
  Partials       17       17
Impacted Files Coverage Δ
cmd/notation/cert/generateTest.go 20.43% <0.00%> (+3.90%) ⬆️
cmd/notation/key.go 31.95% <0.00%> (+9.07%) ⬆️
pkg/configutil/once.go 100.00% <ø> (ø)
pkg/configutil/util.go 0.00% <0.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@priteshbandi priteshbandi merged commit f463f0c into notaryproject:main Feb 3, 2023
@priteshbandi priteshbandi mentioned this pull request Feb 7, 2023
Merged
7h3-3mp7y-m4n pushed a commit to 7h3-3mp7y-m4n/notation that referenced this pull request Mar 29, 2025
@priteshbandi @7h3-3mp7y-m4n
Use new methods introduced in keys.go (notaryproject#529)
be05063 
This PR depends on notaryproject/notation-go#246 so please review notaryproject/notation-go#246 first.

Signed-off-by: Pritesh Bandi <pritesb@amazon.com
FeynmanZhou pushed a commit to FeynmanZhou/notation that referenced this pull request May 15, 2025
@priteshbandi @FeynmanZhou
Use new methods introduced in keys.go (notaryproject#529)
996a93b 
This PR depends on notaryproject/notation-go#246 so please review notaryproject/notation-go#246 first.

Signed-off-by: Pritesh Bandi <pritesb@amazon.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rgnote rgnote rgnote approved these changes

@shizhMSFT shizhMSFT Awaiting requested review from shizhMSFT shizhMSFT is a code owner

+1 more reviewer

@patrickzheng200 patrickzheng200 patrickzheng200 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

RC-2

Development

Successfully merging this pull request may close these issues.

5 participants

@priteshbandi @codecov-commenter @rgnote @patrickzheng200 @JeyJeyGao