SignNotation signs an image(`rawRef`) using a notation key name (`keyNameRef`)
(rawRef string, keyNameRef string)
| 30 | |
| 31 | // SignNotation signs an image(`rawRef`) using a notation key name (`keyNameRef`) |
| 32 | func SignNotation(rawRef string, keyNameRef string) error { |
| 33 | notationExecutable, err := exec.LookPath("notation") |
| 34 | if err != nil { |
| 35 | log.L.WithError(err).Error("notation executable not found in path $PATH") |
| 36 | log.L.Info("you might consider installing notation from: https://notaryproject.dev/docs/installation/cli/") |
| 37 | return err |
| 38 | } |
| 39 | |
| 40 | notationCmd := exec.Command(notationExecutable, []string{"sign"}...) |
| 41 | notationCmd.Env = os.Environ() |
| 42 | |
| 43 | // If keyNameRef is empty, don't append --key to notation command. This will cause using the notation default key. |
| 44 | if keyNameRef != "" { |
| 45 | notationCmd.Args = append(notationCmd.Args, "--key", keyNameRef) |
| 46 | } |
| 47 | |
| 48 | notationCmd.Args = append(notationCmd.Args, rawRef) |
| 49 | |
| 50 | log.L.Debugf("running %s %v", notationExecutable, notationCmd.Args) |
| 51 | |
| 52 | err = processNotationIO(notationCmd) |
| 53 | if err != nil { |
| 54 | return err |
| 55 | } |
| 56 | |
| 57 | return notationCmd.Wait() |
| 58 | } |
| 59 | |
| 60 | // VerifyNotation verifies an image(`rawRef`) with the pre-configured notation trust policy |
| 61 | // `hostsDirs` are used to resolve image `rawRef` |