How do I use notation key add?

[noelbundick-msft]

I want to use notation to sign artifacts (an image & an SPDX SBOM) with a key that I've created via openssl. Effectively I want the same behavior as cert generate-test but I want it to be valid for longer than a single day, and I'd like to do just some basic operations.

Previously in 0.11.0-alpha.4, I was able to execute the following:

notation key add ~/.config/notation/localkeys/$REGISTRY.key ~/.config/notation/localkeys/$REGISTRY.crt --name $REGISTRY

That command has changed, and I'm not sure how to add and use my key in the latest revision. Ex:

@noelbundick-msft ➜ /workspaces/pipeline $ notation key add noelwcus.azurecr.io
Error: required flag(s) "plugin" not set

I'm not sure what a plugin is or why I need one

@noelbundick-msft ➜ /workspaces/pipeline $ notation key add noelwcus.azurecr.io --plugin=''
Error: plugin name cannot be empty

# just guessing at commands before diving into source/commit history
@noelbundick-msft ➜ /workspaces/pipeline $ notation key add noelwcus.azurecr.io --plugin='default' --id=noelwcus.azurecr.io
Error: plugin not found

I browsed for docs and came up short, and thought I'd ask here before delving deeply into the codebase. Thanks!

[yizha1]

notation doesn't support sign using local key for now. To use a plugin, you can follow this document https://hackmd.io/EMkTlPleSQqL-Ej03esL8w?view for Azure key vault plugin. There will be Azure official document later.

[cmaclaughlin]

roadmap issue 15 implies it will be re-added, is this prioritized?

[yizha1]

Is there a reason local key signing support was deprecated? Where is this decision documented?

The previous implementation was for a PoC (Proof of Concept). There are security issues, so this PoC was removed.

For roadmap issue 15, it is not planned in upcoming releases rc.1 and rc.2 release, but it is in our roadmap.

[noelbundick-msft]

I often use a wide range of tools. Is there a supported way to use Notation w/o Azure Key Vault or an alternate secret store?

[FeynmanZhou]

Not yet. I think it requires an external KMS plugin to support this kind of scenario.

[cmaclaughlin]

@FeynmanZhou are the KMS "sign" and "verify" functions being used? If so, are service limits considered when determining feasibility?