refactor:support new signer interface

Signed-off-by: zaihaoyin <[email protected]>

Author: zaihaoyin

go.mod

@@ -4,21 +4,18 @@ go 1.18
 
 require (
 	github.com/go-ldap/ldap/v3 v3.4.4
-	github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c
+	github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.0.2
 	github.com/oras-project/artifacts-spec v1.0.0-rc.2
-	github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83
 	oras.land/oras-go/v2 v2.0.0-rc.2
 )
 
 require (
 	github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
-	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
 	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
 	github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
 )

go.sum

@@ -2,16 +2,14 @@ github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft
 github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
-github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
 github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
 github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
 github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c h1:myIrd0sic/mu8PRt9/jvtkMmC/eVPsB2ufBGhbAM1hg=
-github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c/go.mod h1:cebNvAIpFQXqBGGJa8c13FS1ln47c5qd8E6WjeQDkAA=
+github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9 h1:XX6d8zEwuW+TLzxU1bGJ16fS2w8SWf5udR8Lt6n7+fQ=
+github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9/go.mod h1:mM4M9wPdu0CGgh8f3wOcu0XMiXwEKWQurjBG4nmqQ4g=
 github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86 h1:Oumw+lPnO8qNLTY2mrqPJZMoGExLi/0h/DdikoLTXVU=
 github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86/go.mod h1:aA4vdXRS8E1TG7pLZOz85InHi3BiPdErh8IpJN6E0x4=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -25,10 +23,6 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83 h1:g8vDfnNOPcGzg6mnlBGc0J5t5lAJkaepXqbc9qFRnFs=
-github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=

internal/mock/mocks.go

@@ -1,12 +1,10 @@
 package mock
 
 import (
+	"context"
 	_ "embed"
-	nsigner "github.com/notaryproject/notation-core-go/signer"
-)
 
-import (
-	"context"
+	"github.com/notaryproject/notation-core-go/signature"
 	"github.com/notaryproject/notation-go"
 	"github.com/notaryproject/notation-go/plugin"
 	"github.com/notaryproject/notation-go/plugin/manager"
@@ -54,7 +52,7 @@ var (
 		Size:        100,
 		Annotations: Annotations,
 	}
-	PluginExtendedCriticalAttribute = nsigner.Attribute{
+	PluginExtendedCriticalAttribute = signature.Attribute{
 		Key:      "SomeKey",
 		Critical: true,
 		Value:    "SomeValue",

notation.go

@@ -9,8 +9,13 @@ import (
 	"github.com/opencontainers/go-digest"
 )
 
-// SigningAgent is the unprotected header field used by signature
-const SigningAgent = "Notation/1.0.0"
+const (
+	// SigningAgent is the unprotected header field used by signature.
+	SigningAgent = "Notation/1.0.0"
+
+	// MediaTypePayloadV1 is the supported content type for signature's payload.
+	MediaTypePayloadV1 = "application/vnd.cncf.notary.payload.v1+json"
+)
 
 // Descriptor describes the artifact that needs to be signed.
 type Descriptor struct {

signature/envelope.go

@@ -4,19 +4,20 @@ import (
 	"errors"
 
 	"github.com/notaryproject/notation-core-go/signature"
-	"github.com/notaryproject/notation-core-go/signature/cose"
+	// "github.com/notaryproject/notation-core-go/signature/cose"
+
 	"github.com/notaryproject/notation-core-go/signature/jws"
-	gcose "github.com/veraison/go-cose"
 )
 
-// GuessSignatureEnvelopeFormat guesses envelope format by looping all builtin envelope format.
+// SpeculateSignatureEnvelopeFormat speculates envelope format by looping all builtin envelope format.
 //
-// TODO: need a better way to inspect the type of envelope.
-func GuessSignatureEnvelopeFormat(raw []byte) (string, error) {
-	var msg gcose.Sign1Message
-	if err := msg.UnmarshalCBOR(raw); err == nil {
-		return cose.MediaTypeEnvelope, nil
-	}
+// TODO: find a better way to inspect the type of envelope.
+// TODO: support inspecting cose format
+func SpeculateSignatureEnvelopeFormat(raw []byte) (string, error) {
+	// var msg gcose.Sign1Message
+	// if err := msg.UnmarshalCBOR(raw); err == nil {
+	// 	return cose.MediaTypeEnvelope, nil
+	// }
 	if len(raw) == 0 || raw[0] != '{' {
 		// very certain
 		return "", errors.New("unsupported signature format")

signature/envelope_test.go

@@ -5,9 +5,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/notaryproject/notation-core-go/signature/cose"
 	"github.com/notaryproject/notation-core-go/signature/jws"
-	gcose "github.com/veraison/go-cose"
+	// gcose "github.com/veraison/go-cose"
 )
 
 var (
@@ -17,12 +16,12 @@ var (
 )
 
 func init() {
-	msg := gcose.Sign1Message{
-		Headers:   gcose.NewSign1Message().Headers,
-		Payload:   []byte("valid"),
-		Signature: []byte("valid"),
-	}
-	validCoseSignatureEnvelope, _ = msg.MarshalCBOR()
+	// msg := gcose.Sign1Message{
+	// 	Headers:   gcose.NewSign1Message().Headers,
+	// 	Payload:   []byte("valid"),
+	// 	Signature: []byte("valid"),
+	// }
+	// validCoseSignatureEnvelope, _ = msg.MarshalCBOR()
 }
 
 const invalidMediaType = "invalid"
@@ -37,7 +36,7 @@ func checkErrorEqual(expected, got error) bool {
 	return false
 }
 
-func TestGuessSignatureEnvelopeFormat(t *testing.T) {
+func TestSpeculateSignatureEnvelopeFormat(t *testing.T) {
 	tests := []struct {
 		name         string
 		raw          []byte
@@ -50,12 +49,12 @@ func TestGuessSignatureEnvelopeFormat(t *testing.T) {
 			expectedType: jws.MediaTypeEnvelope,
 			expectedErr:  nil,
 		},
-		{
-			name:         "cose signature media type",
-			raw:          validCoseSignatureEnvelope,
-			expectedType: cose.MediaTypeEnvelope,
-			expectedErr:  nil,
-		},
+		// {
+		// 	name:         "cose signature media type",
+		// 	raw:          validCoseSignatureEnvelope,
+		// 	expectedType: cose.MediaTypeEnvelope,
+		// 	expectedErr:  nil,
+		// },
 		{
 			name:         "invalid signature media type",
 			raw:          invalidSignatureEnvelope,
@@ -65,9 +64,9 @@ func TestGuessSignatureEnvelopeFormat(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			eType, err := GuessSignatureEnvelopeFormat(tt.raw)
+			eType, err := SpeculateSignatureEnvelopeFormat(tt.raw)
 			if !checkErrorEqual(tt.expectedErr, err) {
-				t.Fatalf("expected guess signature envelope format err: %v, got: %v", tt.expectedErr, err)
+				t.Fatalf("expected speculate signature envelope format err: %v, got: %v", tt.expectedErr, err)
 			}
 			if eType != tt.expectedType {
 				t.Fatalf("expected signature envelopeType: %v, got: %v", tt.expectedType, eType)
@@ -87,11 +86,11 @@ func TestValidateEnvelopeMediaType(t *testing.T) {
 			mediaType:   jws.MediaTypeEnvelope,
 			expectedErr: nil,
 		},
-		{
-			name:        "cose signature media type",
-			mediaType:   cose.MediaTypeEnvelope,
-			expectedErr: nil,
-		},
+		// {
+		// 	name:        "cose signature media type",
+		// 	mediaType:   cose.MediaTypeEnvelope,
+		// 	expectedErr: nil,
+		// },
 		{
 			name:        "invalid media type",
 			mediaType:   invalidMediaType,

signature/plugin.go

@@ -43,7 +43,7 @@ func NewSignerPlugin(runner plugin.Runner, keyID string, pluginConfig map[string
 	}, nil
 }
 
-// Sign signs the artifact described by its descriptor and returns the marshalled envelope
+// Sign signs the artifact described by its descriptor and returns the marshalled envelope.
 func (s *pluginSigner) Sign(ctx context.Context, desc notation.Descriptor, opts notation.SignOptions) ([]byte, error) {
 	metadata, err := s.getMetadata(ctx)
 	if err != nil {
@@ -119,7 +119,7 @@ func (s *pluginSigner) generateSignature(ctx context.Context, desc notation.Desc
 	s.sigProvider.SetConfig(config)
 	signReq := &signature.SignRequest{
 		Payload: signature.Payload{
-			ContentType: signature.MediaTypePayloadV1,
+			ContentType: notation.MediaTypePayloadV1,
 			Content:     payloadBytes,
 		},
 		Signer:                   s.sigProvider,
@@ -144,10 +144,13 @@ func (s *pluginSigner) generateSignature(ctx context.Context, desc notation.Desc
 		return nil, err
 	}
 
-	_, _, verErr := sigEnv.Verify()
+	envContent, verErr := sigEnv.Verify()
 	if verErr != nil {
 		return nil, fmt.Errorf("signature returned by generateSignature cannot be verified: %v", verErr)
 	}
+	if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
+		return nil, err
+	}
 
 	// TODO: re-enable timestamping https://github.com/notaryproject/notation-go/issues/78
 	return sig, nil
@@ -178,7 +181,7 @@ func (s *pluginSigner) generateSignatureEnvelope(ctx context.Context, desc notat
 		KeyID:                 s.keyID,
 		Payload:               payloadBytes,
 		SignatureEnvelopeType: s.envelopeMediaType,
-		PayloadType:           signature.MediaTypePayloadV1,
+		PayloadType:           notation.MediaTypePayloadV1,
 		PluginConfig:          s.mergeConfig(opts.PluginConfig),
 	}
 	out, err := s.sigProvider.Run(ctx, req)
@@ -203,13 +206,16 @@ func (s *pluginSigner) generateSignatureEnvelope(ctx context.Context, desc notat
 		return nil, err
 	}
 
-	sigPayload, _, err := sigEnv.Verify()
+	envContent, err := sigEnv.Verify()
 	if err != nil {
 		return nil, err
 	}
+	if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
+		return nil, err
+	}
 
 	var signedPayload notation.Payload
-	if err = json.Unmarshal(sigPayload.Content, &signedPayload); err != nil {
+	if err = json.Unmarshal(envContent.Payload.Content, &signedPayload); err != nil {
 		return nil, fmt.Errorf("signed envelope payload can't be unmarshaled: %w", err)
 	}
 

signature/plugin_test.go

@@ -13,12 +13,11 @@ import (
 	"time"
 
 	"github.com/notaryproject/notation-core-go/signature"
-	"github.com/notaryproject/notation-core-go/signature/cose"
 	"github.com/notaryproject/notation-core-go/signature/jws"
 
 	"github.com/notaryproject/notation-go"
 	"github.com/notaryproject/notation-go/plugin"
-	gcose "github.com/veraison/go-cose"
+	// gcose "github.com/veraison/go-cose"
 )
 
 const unsupported = "unsupported"
@@ -33,10 +32,10 @@ var (
 	}
 	validSignDescriptor, validSignOpts = generateSigningContent(nil)
 	invalidJwsEnvelope, _              = json.Marshal(struct{}{})
-	invalidCoseEnvelope, _             = gcose.NewSign1Message().MarshalCBOR()
-	envelopeTypeToData                 = map[string][]byte{
-		jws.MediaTypeEnvelope:  invalidJwsEnvelope,
-		cose.MediaTypeEnvelope: invalidCoseEnvelope,
+	// invalidCoseEnvelope, _             = gcose.NewSign1Message().MarshalCBOR()
+	envelopeTypeToData = map[string][]byte{
+		jws.MediaTypeEnvelope: invalidJwsEnvelope,
+		// cose.MediaTypeEnvelope: invalidCoseEnvelope,
 	}
 )
 
@@ -488,12 +487,18 @@ func basicSignTest(t *testing.T, pluginSigner *pluginSigner) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	payload, signerInfo, err := env.Verify()
+	envContent, err := env.Verify()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if payload.ContentType != signature.MediaTypePayloadV1 {
-		t.Fatalf("Signer.Sign() Payload content type changed, expect: %v, got: %v", payload.ContentType, signature.MediaTypePayloadV1)
+
+	if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
+		t.Fatalf("verification failed. error = %v", err)
+	}
+
+	payload, signerInfo := envContent.Payload, envContent.SignerInfo
+	if payload.ContentType != notation.MediaTypePayloadV1 {
+		t.Fatalf("Signer.Sign() Payload content type changed, expect: %v, got: %v", payload.ContentType, notation.MediaTypePayloadV1)
 	}
 	var gotPayload notation.Payload
 	if err := json.Unmarshal(payload.Content, &gotPayload); err != nil {
@@ -503,7 +508,7 @@ func basicSignTest(t *testing.T, pluginSigner *pluginSigner) {
 		TargetArtifact: validSignDescriptor,
 	}
 	if !reflect.DeepEqual(expectedPayload, gotPayload) {
-		t.Fatalf("Signer.Sign() descriptor subject changed, expect: %v, got: %v", expectedPayload, *payload)
+		t.Fatalf("Signer.Sign() descriptor subject changed, expect: %v, got: %v", expectedPayload, payload)
 	}
 	if signerInfo.SignedAttributes.SigningScheme != signature.SigningSchemeX509 {
 		t.Fatalf("Signer.Sign() signing scheme changed, expect: %v, got: %v", signerInfo.SignedAttributes.SigningScheme, signature.SigningSchemeX509)
@@ -745,7 +750,7 @@ func TestPluginSigner_SignEnvelope_MalFormedEnvelope(t *testing.T) {
 				sigProvider:       p,
 				envelopeMediaType: envelopeType,
 			}
-			var expectedErr *signature.MalformedSignatureError
+			var expectedErr *signature.InvalidSignatureError
 			if _, err := signer.Sign(context.Background(), notation.Descriptor{}, notation.SignOptions{}); err == nil || !errors.As(err, &expectedErr) {
 				t.Fatalf("Signer.Sign() error = %v, want MalformedSignatureError", err)
 			}