feat: add primitive support for verify subject on local oci-store

[binbin-li]

1. This PR is more like a POC of validating the workflow of executor, verifier and store in an actual e2e scenario.
2. This PR implements a verify command to support validating an image in a local oci store.
3. The command flags could be updated for new user scenarios or better exeperience.
   Test:
   I use a local oci layout as the store to test the verify command. I built an image which is signed by Notation.
   The command to verify it:

./ratify verify --store ./local-oci-layout --subject oci-layout2/local-oci-layout@sha256:f2502800f0663995420b13214a0d20eae1ec9a3c072f99c462cef0132a684556 --config config.json

config.json:

{
    "name": "notation-verifier-1",
    "trustPolicyDoc": {
        "version": "1.0",
        "trustPolicies": [
            {
                "name": "default",
                "registryScopes": [
                    "*"
                ],
                "signatureVerification": {
                    "level": "strict"
                },
                "trustStores": [
                    "ca:ratify2"
                ],
                "trustedIdentities": [
                    "*"
                ]
            }
        ]
    },
    "trustStorePath": "/home/libinbin/.config/notation"
}

Note: the succeeded at root level is always false as we didn't set up the policy enforcer.
Validation result:

{
    "succeeded": false,
    "artifactReports": [
        {
            "subject": "oci-layout2/local-oci-layout@sha256:f2502800f0663995420b13214a0d20eae1ec9a3c072f99c462cef0132a684556",
            "artifact": "oci-layout2/local-oci-layout@sha256:8b9494d734b2c878eab7b4b5e21e7b13b93e10f564e3d2b382294c15cc711a08",
            "artifactType": "application/vnd.cncf.notary.signature",
            "results": [
                {
                    "succeeded": false,
                    "verifierName": "notation-verifier-1",
                    "verifierType": "notation",
                    "detail": "signature is not produced by a trusted signer"
                }
            ],
            "artifactReports": null
        },
        {
            "subject": "oci-layout2/local-oci-layout@sha256:f2502800f0663995420b13214a0d20eae1ec9a3c072f99c462cef0132a684556",
            "artifact": "oci-layout2/local-oci-layout@sha256:b3f6395ff2389b13a33f709f4e527530f16275d483b40a6a2712306b46722275",
            "artifactType": "application/vnd.cncf.notary.signature",
            "results": [
                {
                    "succeeded": true,
                    "description": "Notation signature verification succeeded",
                    "verifierName": "notation-verifier-1",
                    "verifierType": "notation",
                    "detail": {
                        "Issuer": "CN=ratify3,O=Notary,L=Seattle,ST=WA,C=US",
                        "SN": "CN=ratify3,O=Notary,L=Seattle,ST=WA,C=US"
                    }
                }
            ],
            "artifactReports": null
        }
    ]
}

[Copilot]

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Files not reviewed (1)

• go.mod: Language not supported

[shizhMSFT]

It's a good PoC. Let's discuss offline and iterate on this.