notation roadmap discussion

[yizha1]

Status on Jan 16, 2023 ==> check rc.2 status in new discussion #238

Notation v1.0.0-rc.2, target date Jan 17, 2023

• [mandatory]Metadata for signatures - PR review
  • feat: add support for signed user metadata notation-go#242
• [mandatory]Semantic versioning - PR review
  • feat: plugin version comparison functionality notation-go#237
• [mandatory]CLI flag to force legacy manifest - PR review
  • feat: support OCI image manifest notation-go#241 (review first)
  • feat: support OCI image manifest notation#509
• [mandatory]E2E testing - phase 1 - PR review
  • test: e2e quickstart test case notation#494
  • test: e2e sign/verify/trustpolicy test cases notation#496
  • test: e2e plugin test cases notation#510
• [spec] CLI to manage trust policy - PR review
  • doc: CLI spec for trust policy management (DO NOT REVIEW) notation#505
• Notation-core-go source code clean-up - PR review
  • remove!: clean up time stamping code notation-core-go#102
• doc: troubleshooting guide - PR review
  • DO NOT MERGE: doc: create troubleshooting guide notaryproject.dev#125
• Notation API document - Done
• [spec] notation inspect command - Done
• Add debug logs for all CLI commands - Done

==> Based on current feature completion status and upcoming one-week holidays, suggest moving rc.2 release to Feb 6, 2023

Notation v1.0.0-rc.3, target date Mar 6th, 2023 (Proposal)

• [Impl]notation inspect command
• Automatic fallback to OCI image manifest
• certificate revocation
• E2E testing - phase 2 (other cases)
• Offline signing and verification, [User Story] - notation sign/verify Offline/Local artifacts roadmap#15
  • Risky: need break-down, Large size feature (including spec)
• [Impl] CLI to manage trust policy
• Improved installation and configuration experience
  • GitHub actions
  • Improved notation login/logout experience
  • plugin installation
  • Installation package (MacOS homebrew, Windows MSI, Container image, Linux script, offline packages

Notation v1.0.0-rc.4, target date Mar 27, 2023 (Tentative)

• rc.3 leftovers
• code clean-up
• Documentation
• Bug fixing

Notation v1.0.0, target date Apr 3rd (Proposal)

• Bug fixing

Notation post-v1.0.0 (Proposal)

• Timestamping signatures, Notation CLI support for Timestamp Authority signatures roadmap#59
• Signatures filtering, Implementing signature filtering notation-go#70
• Signature revocation, Signature revocation roadmap#12
• Add Hashicope key vault provider, HashiCorp Key Vault provider roadmap#54
• sign using local key, Spec for signing with local key roadmap#44
• notation CLI UX improvements: for example, JSON output

Actions:

Once the scope is aligned,

• Create issues for missing features
• Update milestones for existing features
• Update project dashboard

[FeynmanZhou]

As Notation RC.3 is the majority release with some key work items planned as above, I discussed with @shizhMSFT about the cost estimation for each item in RC.3. This would be a reference to confirm the ETA date and scope for RC.3.

Feature	Cost estimation   (Spec + Dev + PR review)	Size
Notation CLI command to manage trust policy	Spec design 2w + 2w dev + 2w review	M
Implement Notation inspect command	TBD	TBD
Certificate revocation	TBD	TBD
Sign offline artifacts (Spec)	Spec design 2w + 2w dev + 2w review	M
Verify offline signatures (Spec+Dev)	Spec design 2w + 1w dev + 2w review	M
Improve Notation installation - Installation packages - GitHub Actions - Plugin installation	Scenario investigation 1-2w + spec design 1-2w + dev 1w + 2w review	M
Improve Notation configuration - notation login/logout experience and Credential helper configuration - System directory configuration - OCI manifest fallback solution	1w spec design + 3-4w dev + 2w review	L

Note: E2E testing is suggested to be included alongside each item's development so there is no individual item for E2E testing.

cc @yizha1 @vaninrao10 @iamsamirzon @toddysm

[yizha1]

This discussion was mixed with rc.2 status and roadmap. So, I will create a new thread for rc.2 status check-in and keep this thread for roadmap discussion

[yizha1]

New proposal for rc.3/1.0/post 1.0 (Considered @vaninrao10 proposal https://hackmd.io/WVFhrhvYSFutJpnY6JTDuQ)

v1.0.0-rc.3, March

• notation inspect (leftover from rc.2)
• certificate revocation
• Sign/verify offline artifacts
• improve installation
• thread model document
• Fuzzing test and security audit support

v1.0.0, End of March

• bug fixes

post 1.0

• using CLI command to manage trust policy
• configuration improvement
• Other notation CLI UX improvements: for example, JSON output
• Notary v2 payload validation
• Timeout Implementation for signature verification
• Timestamping signatures, Notation CLI support for Timestamp Authority signatures roadmap#59
• Signatures filtering, Implementing signature filtering notation-go#70
• Signature revocation, Signature revocation roadmap#12
• Tag signing
• Add Hashicope key vault provider, HashiCorp Key Vault provider roadmap#54
• sign using local key, Spec for signing with local key roadmap#44