Spec : Notation directory structure

[gokarnm]

Spec for config location and dir structure. Should specify the directory structure for notation, paths for trust store, signing keys config, trust policy config, and plugins.

[gokarnm]

Any feedback on this directory structure.

• We should rename config.json which previously contained signing keys and verification certificates, to signingKeys.json as it only contains signing keys. Verification now uses trust store and trustPolicy.json
• Plugin install location should be relative to notation install location, instead of using a sub dir under $XDG_CONFIG_HOME/notation as plugins are not configuration.

$XDG_CONFIG_HOME/notation
    /trust-store/x509
        /ca
        /tsa
    trustPolicy.json
    signingKeys.json
    config.json

$NOTATION_PLUGIN_PATH
    /com.example.nv2plugin/notation-com.example.nv2plugin

(updated with new proposal for plugin dir)

cc: @shizhMSFT @SteveLasker @sajayantony @qmuntal @priteshbandi @rgnote

[SteveLasker]

👀

[shizhMSFT]

$NOTATION_INSTALL_DIR is a vague location. On Unix/Linux, notation might be installed to /usr/local/bin. It might not make sense to have a folder called /usr/local/bin/plugins.

[gokarnm]

$NOTATION_INSTALL_DIR is a vague location. On Unix/Linux, notation might be installed to /usr/local/bin. It might not make sense to have a folder called /usr/local/bin/plugins.

That makes sense for linux in terms of notation is a single binary file at the moment. For Windows it would likely be Program files/Notation or similar? Any alternates you can propose @shizhMSFT , the XDG_CONFIG_HOME location seemed odd to me install plugin binary and any additional dependencies.

We can keep the location relative to notation binary and fully qualify the folder name, something like /usr/local/bin/notation-plugins.

[SteveLasker]

I've added Balancing Security and Usability for reference