Verification Plugin spec #165

gokarnm · 2022-07-06T00:48:24Z

Added verification plugin spec with new verify-signature plugin command.
Updated Notary v2 Signature spec and JWS signature spec for new attributes to support Signing Scheme and Verification plugin

Signed-off-by: Milind Gokarn gokarnm@amazon.com

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm · 2022-07-06T05:11:08Z

cc: @shizhMSFT @roywill @priteshbandi @rgnote for review

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

signing-scheme.md

specs/plugin-extensibility.md

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

signing-scheme.md

priteshbandi · 2022-07-07T21:41:09Z

specs/plugin-extensibility.md

+        2. Validate that plugin version is greater than or equal to *Verification plugin minimum version*
+        3. Fail signature verification if these validations fail
+    3. Validate if plugin capabilities contains any `SIGNATURE_VERIFIER` capabilities
+        1. Fail signature verification if a matching plugin with `SIGNATURE_VERIFIER` capability cannot be found. If signature envelope contains the *Verification Plugin Name* attribute, include it as a hint in error response.


If signature envelope contains the Verification Plugin Name attribute, include it as a hint in error response.

If plugin is invoked, doesnt that means signature envelope contains the Verification Plugin Name attribute?

Good point, updated the language Verification Plugin Name attribute will be always present.

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

specs/plugin-extensibility.md

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

signature-envelope-jws.md

signing-scheme.md

SteveLasker

I'm all for extensibility and flexibility, enabling various scenarios that don't require notary maintainers to be involved. The remote signing extensibility has proven to work really well, enabling various cloud providers to meet their product goals for how they support remote signing/key management solutions. This was a key for Notary v2 scenarios and requirements

I have general concerns about a verification plugin that could limit the portability of signatures, as this could be counter to our usability and platform/vendor neutrality goals.

signature-specification.md

signature-envelope-jws.md

SteveLasker · 2022-07-08T23:17:41Z

signature-envelope-jws.md

+
+See [Extended attributes for *Notation* Plugins](./signature-specification.md#extended-attributes-for-notation-plugins) for detailed description og these headers.
+
+- **`io.cncf.notary.verificationPlugin`**(*string*)(critical): An OPTIONAL header that specifies the name of the verification plugin that MAY be used to verify the signature.


Hmm, why do we think we need this?
The notary client should be able to verify any signature format supported. I haven't seen where we need plugins for verification.

SteveLasker · 2022-07-08T23:35:25Z

signature-specification.md

+
+#### Extended attributes
+
+Implementations of Notary v2 signature spec MAY include additional signed attributes in the signature envelope. These attributes MAY be marked critical, i.e. the attribute MUST be understood and processed by a verifier, unknown critical attributes MUST cause signature verification to fail.


This sounds like it would impose instability and inconsistency.
A primary goal of Notary v2 is cloud/location independence. If a user copies an image from MAR to their ecr, they shouldn't need any special Microsoft stuff to validate it.
I'm guessing you have some ideas around new headers. Can we discuss those and find a platform neutral way?

Are these the critical headers we are discussing here -

JSW - https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.11

COSE - https://datatracker.ietf.org/doc/html/rfc8152#appendix-C.1.4

Given the statement - basically it means that a signature with a critical header will put a requirement on the client environment to have the plugin available.

Yes, the links point to how criticality of signed attributes is implemented in JWS and COSE. If an extended attribute is marked critical (not all extended attributes need to be critical) the verifier must process it either using a plugin or equivalent verification logic.

signature-specification.md

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

SteveLasker · 2022-07-15T18:56:49Z

signature-envelope-jws.md

- **[`crit`](https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.11)**(*array of strings*): This OPTIONAL header lists the headers that implementation MUST understand and process. It MUST only contain headers apart from registered headers (e.g. `alg`, `cty`) in JWS specification, therefore this header is only present when the optional `io.cncf.notary.expiry` header is present in the protected headers collection.
-  If present, the value MUST be `["io.cncf.notary.expiry"]`.
+- **`io.cncf.notary.signingScheme`**(*string*)(critical): This REQUIRED header specifies the [Notary v2 Signing Scheme](./signing-scheme.md) used by the signature. Supported values are `notary.default.x509` and `notary.signingAuthority.x509`.
+- **`io.cncf.notary.signingTime`**(*string*): This header specifies the time at which the signature was generated. This is an untrusted timestamp, and therefore not used in trust decisions. Its value is a [RFC 3339][rfc3339] formatted date time, the optional fractional second ([time-secfrac][rfc3339][[1](https://datatracker.ietf.org/doc/html/rfc3339#section-5.3)]) SHOULD NOT be used. This claim is REQUIRED and only valid when signing scheme is `notary.default.x509`.


r/ .default

SteveLasker · 2022-07-15T18:57:04Z

signature-specification.md

@@ -126,9 +126,24 @@ Notary v2 requires the signature envelope to support the following signed attrib

 #### Standard attributes

- **Signing time**: A REQUIRED claim that indicates the time at which the signature was generated. Though this claim is signed by the signing key, it’s considered unauthenticated as a signer can modify local time and manipulate this claim. More details [here](#signing-time).
+- **Signing Scheme** (critical): A REQUIRED claim that defines the [Notary v2 Signing Scheme](./signing-scheme.md) used by the signature. This attribute dictates the rest of signature schema - the set of signed and unsigned attributes to be included in the signature. Supported values are `notary.default.x509` and `notary.signingAuthority.x509`.
+- **Signing Time**: A claim that indicates the time at which the signature was generated. Though this claim is signed by the signing key, it’s considered unauthenticated as a signer can modify local time and manipulate this claim. More details [here](#signing-time). This claim is REQUIRED and only valid when signing scheme is `notary.default.x509` .


r/ .default

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm · 2022-07-18T23:55:03Z

Removed Signing scheme related spec updates in this PR which is now a separate PR (#175).

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

signature-specification.md

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm · 2022-07-22T20:42:14Z

Resolved merge conflicts.

SteveLasker · 2022-07-22T23:49:53Z

Thanks @gokarnm for the latest updates.
My LGTM still applies, and believe we should merge with the understanding that we should have time before rc.1 to test any implementation and verify we're happy with the results. This is a baseline to iterate and learn.

NiazFK

LGTM

gokarnm added 2 commits July 5, 2022 17:46

Verification Plugin and Signing Scheme spec

5f46150

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

Updated JWS envelope and other changes

a640929

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm requested review from shizhMSFT and a team July 6, 2022 05:08

gokarnm changed the title ~~[DRAFT] Verification Plugin and Signing Scheme spec~~ Verification Plugin and Signing Scheme spec Jul 6, 2022

gokarnm mentioned this pull request Jul 6, 2022

Verification Plugin interface API Spec notaryproject/roadmap#27

Closed

Added guidelines for Notary v2 and plugin implementors.

a3f6fda

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm force-pushed the verification-plugin branch from 84700cf to a3f6fda Compare July 6, 2022 05:40

Use relative links.

fac8134

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

letmaik reviewed Jul 7, 2022

View reviewed changes

signing-scheme.md Outdated Show resolved Hide resolved

qmuntal suggested changes Jul 7, 2022

View reviewed changes

specs/plugin-extensibility.md Outdated Show resolved Hide resolved

Updated Signing authority definition.

bbca7fb

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

priteshbandi reviewed Jul 7, 2022

View reviewed changes

gokarnm added 2 commits July 7, 2022 15:12

Review feedback.

d8f2a73

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

Updated FAQ

fe53ef5

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

qmuntal approved these changes Jul 8, 2022

View reviewed changes

shizhMSFT reviewed Jul 8, 2022

View reviewed changes

specs/plugin-extensibility.md Outdated Show resolved Hide resolved

specs/plugin-extensibility.md Show resolved Hide resolved

specs/plugin-extensibility.md Show resolved Hide resolved

Addressed review feedback.

4d20804

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

priteshbandi approved these changes Jul 8, 2022

View reviewed changes

roywill approved these changes Jul 8, 2022

View reviewed changes

signature-envelope-jws.md Outdated Show resolved Hide resolved

signing-scheme.md Outdated Show resolved Hide resolved

SteveLasker suggested changes Jul 8, 2022

View reviewed changes

gokarnm mentioned this pull request Jul 11, 2022

Basic Signature Verification notaryproject/notation-go#79

Merged

Addressed review feedback

e6f4222

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

priteshbandi mentioned this pull request Jul 12, 2022

Implement signing scheme. notaryproject/notation-core-go#17

Merged

iamsamirzon mentioned this pull request Jul 13, 2022

Signature Payload Format notaryproject/roadmap#2

Closed

gokarnm mentioned this pull request Jul 14, 2022

Support for Signing scheme #175

Merged

iamsamirzon added this to the RC-1 milestone Jul 14, 2022

iamsamirzon assigned gokarnm Jul 14, 2022

SteveLasker reviewed Jul 15, 2022

View reviewed changes

SteveLasker approved these changes Jul 15, 2022

View reviewed changes

Removed signing scheme related content

813d759

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

gokarnm changed the title ~~Verification Plugin and Signing Scheme spec~~ Verification Plugin spec Jul 18, 2022

Added details for Signature Portability

df68f07

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

SteveLasker reviewed Jul 21, 2022

View reviewed changes

signature-specification.md Outdated Show resolved Hide resolved

SteveLasker reviewed Jul 21, 2022

View reviewed changes

signature-specification.md Outdated Show resolved Hide resolved

SteveLasker reviewed Jul 21, 2022

View reviewed changes

signature-specification.md Outdated Show resolved Hide resolved

gokarnm added 3 commits July 21, 2022 16:54

Addressed review feedback.

072e4ba

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

Updated wording for private artifacts

7510952

Signed-off-by: Milind Gokarn <gokarnm@amazon.com>

Merge branch 'main' into verification-plugin

635ebd7

NiazFK approved these changes Jul 25, 2022

View reviewed changes

NiazFK merged commit c4400eb into notaryproject:main Jul 25, 2022

rgnote mentioned this pull request Jul 28, 2022

Implement Verification Plugin Spec notaryproject/notation-go#95

Closed

dtzar modified the milestones: RC-1, alpha-3 Jul 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verification Plugin spec #165

Verification Plugin spec #165

gokarnm commented Jul 6, 2022 •

edited

Loading

gokarnm commented Jul 6, 2022

priteshbandi Jul 7, 2022

gokarnm Jul 8, 2022

SteveLasker left a comment

SteveLasker Jul 8, 2022

SteveLasker Jul 8, 2022

sajayantony Jul 12, 2022 •

edited

Loading

gokarnm Jul 13, 2022

SteveLasker Jul 15, 2022

SteveLasker Jul 15, 2022

gokarnm commented Jul 18, 2022

gokarnm commented Jul 22, 2022

SteveLasker commented Jul 22, 2022

NiazFK left a comment


		See [Extended attributes for Notation Plugins](./signature-specification.md#extended-attributes-for-notation-plugins) for detailed description og these headers.

		- `io.cncf.notary.verificationPlugin`(string)(critical): An OPTIONAL header that specifies the name of the verification plugin that MAY be used to verify the signature.


		#### Extended attributes

		Implementations of Notary v2 signature spec MAY include additional signed attributes in the signature envelope. These attributes MAY be marked critical, i.e. the attribute MUST be understood and processed by a verifier, unknown critical attributes MUST cause signature verification to fail.

Verification Plugin spec #165

Verification Plugin spec #165

Conversation

gokarnm commented Jul 6, 2022 • edited Loading

gokarnm commented Jul 6, 2022

priteshbandi Jul 7, 2022

Choose a reason for hiding this comment

gokarnm Jul 8, 2022

Choose a reason for hiding this comment

SteveLasker left a comment

Choose a reason for hiding this comment

SteveLasker Jul 8, 2022

Choose a reason for hiding this comment

SteveLasker Jul 8, 2022

Choose a reason for hiding this comment

sajayantony Jul 12, 2022 • edited Loading

Choose a reason for hiding this comment

gokarnm Jul 13, 2022

Choose a reason for hiding this comment

SteveLasker Jul 15, 2022

Choose a reason for hiding this comment

SteveLasker Jul 15, 2022

Choose a reason for hiding this comment

gokarnm commented Jul 18, 2022

gokarnm commented Jul 22, 2022

SteveLasker commented Jul 22, 2022

NiazFK left a comment

Choose a reason for hiding this comment

gokarnm commented Jul 6, 2022 •

edited

Loading

sajayantony Jul 12, 2022 •

edited

Loading