From 5cce6214717e6634f2960c2915b15c3e45680dab Mon Sep 17 00:00:00 2001
From: Wang Yan <wangyan@vmware.com>
Date: Thu, 13 Jul 2023 11:18:34 +0800
Subject: [PATCH] add notation support (#18909)

Accept and recognize the signature of notation client

Signed-off-by: wang yan <wangyan@vmware.com>
---
 icons/notation.png                            | Bin 0 -> 35770 bytes
 src/controller/icon/controller.go             |   4 +
 src/core/main.go                              |   1 +
 src/lib/icon/const.go                         |   7 +-
 src/pkg/accessory/manager.go                  |   5 +-
 src/pkg/accessory/model/accessory.go          |   3 +
 src/pkg/accessory/model/notation/notation.go  |  46 +++++++++++
 .../accessory/model/notation/notation_test.go |  73 ++++++++++++++++++
 src/server/middleware/subject/subject.go      |  12 ++-
 9 files changed, 145 insertions(+), 6 deletions(-)
 create mode 100644 icons/notation.png
 create mode 100644 src/pkg/accessory/model/notation/notation.go
 create mode 100644 src/pkg/accessory/model/notation/notation_test.go

diff --git a/icons/notation.png b/icons/notation.png
new file mode 100644
index 0000000000000000000000000000000000000000..7dda51605a06bacd63da7cce208ef8501907fa78
GIT binary patch
literal 35770
zcmeHQe@v8R9Dk03Bk2WKjtQyh*elFq2@@>iRHTmLjUU<xx4;GG6fT(1EzyhQ@RYX1
zG~^|s!yVc<Vt@ps0$S41k2xG*U9>PSxi%zko!~k`gCV`oaS(0&)tXEDZ0~LNy&rq;
zzVG+>etta9-BYq9>3LtD$9xDOzFeGKL5TMPdV5GBJi_=sv5XKs;p8#Nucte{Z_QQ3
zFwe%k*H&BasV&^w(Cm13fm3fkkic^MJwGh_llR{h37?YG31>em-5pNvllC|S$N}mA
zV*&jDJrTG7I0PjCEuv_MIzSFk2arjSicrW<$PW%27On9X)4r~Go8=UZLeSz2qJGp5
zV^gW-YCMJ<pbjt=&=1fPfeXM!@PqrBBU!>G_arRc!iZnIb<*>&aD1S9WtHNJ^!n#t
zjr0_2b_A05*G;GL!y>XvInlKuTj?cCV3s&ftjvC#n6qk^GkjKxz!mW#qySZbfq-6s
zcKG**&|wdm9<5-x=J6%Aw!h+s{<u`9=GhDVi*0SY)$_5Yqu!zo<}C3#QJzd2JP&g4
z7Gw+sgYklPF^`#}TLLVAm7oe>N`HD2Ac`Q0Ac`Q0Ac`Q0vko?RGI%n0GI%n0GI+9k
z3KKE`G66CHG66CHG66Edwa(|kQ%Ms$+TY0~hqebC%8o1@ugN^qyr?p%?4W0!r^piD
zMB0tA^2mim<*Z#U;Z94<i4~m@9G{-!)p65mFclDTJZvgFt|~>8*Dz+}_%TJOIrry2
zwpUCB3hi&jSWfw9w$_d&@TSVNIc_~1A5B+C&Cv@V&DC=eoRg3zGbXkli){3;CfjA@
zti4vLzuITys=P_d@0Nwdrc{61hc65oST5|Whjs5rf@M9?_f{4Ku)PiBsg#L6mV2Y#
ze{QzCbL<PcGHdpV;j7@PpujLz(817*fh#i$$^eldF78!^;9#JWAo<WMkX}%c(DtrX
z^{^@6xVV360rLpv5zHf)M=+0I9>F|<d4yRnOyFTIlKu!8%oxlV%oxlV%oxlV%=o{@
zjHes}t-b@{jQpD=i8ZY~FRk91_2!Xdk371<zgHn;e$v^FZo0FxbEw4h?S)ZhAcW)l
z8+y8kBeg95<B9?`xwUdLYaG$3%^Nx1q|Ee_s4gEil{fXs#QLy;Abb9(OguijG0r|E
zYuuH2Eszv;FXHO<4F<Ms=GpobL$PS!bdY^#sI!mQ;;ZALew^&n>x92fZMw9SF<1L@
zA=?aE3CZ|XZn0m}N*v`Zmy<HABIBpxqOM%}G=kjWL-?fIoe`=NvwyRyj<s|vhm9h0
z<@&Px^S6znNnvB4w2G$#^czC?q_#Dq48d2zRYKumETKK1i367awO|k6c%ZFd;t&_m
zOHj2C>i@)h_~l~sX9sGEhNnw|Y)3K-rP~B+BHAz*rn>y9ZJo;>*{Gp=1?xYVzaOHu
z%-wT@XUK@KX^hKZp@B8l?T^r)V|HU18fX@~?G_r?R=dp-8kk>pTOBmOiCkMVBXuYS
zm(NJkfMP%~pcw8`m~b4e$s^?9J)Ary86Y^bw>bC%ZD?RbGz$d9K(l~ipjkjM%<RYs
zt@Ljd!`(LZ#b6>1XFS)YJ?Ff!N)gyz|K$d&p9jY)%Vh!dG<qsV8@rb=G}uH_|J{(E
zga#)C0c**5ZDyO)uLWtFz4lzOOP}2kMDLj@YZrYL$rt2sTH=Vx6`U7@a#OH&2I#1=
u#c7bV|9z$XHYD?L`AF%)Si46@(M_-GJ#|rIQr~_$GP&3!`A5&F4*mfyhG885

literal 0
HcmV?d00001

diff --git a/src/controller/icon/controller.go b/src/controller/icon/controller.go
index 8927aa136..81af7f6f7 100644
--- a/src/controller/icon/controller.go
+++ b/src/controller/icon/controller.go
@@ -57,6 +57,10 @@ var (
 			path:   "./icons/cosign.png",
 			resize: false,
 		},
+		icon.DigestOfIconAccNotation: {
+			path:   "./icons/notation.png",
+			resize: false,
+		},
 		icon.DigestOfIconAccNydus: {
 			path:   "./icons/nydus.png",
 			resize: false,
diff --git a/src/core/main.go b/src/core/main.go
index 58482dbbe..bf68a8497 100644
--- a/src/core/main.go
+++ b/src/core/main.go
@@ -58,6 +58,7 @@ import (
 	"github.com/goharbor/harbor/src/migration"
 	_ "github.com/goharbor/harbor/src/pkg/accessory/model/base"
 	_ "github.com/goharbor/harbor/src/pkg/accessory/model/cosign"
+	_ "github.com/goharbor/harbor/src/pkg/accessory/model/notation"
 	_ "github.com/goharbor/harbor/src/pkg/accessory/model/subject"
 	"github.com/goharbor/harbor/src/pkg/audit"
 	dbCfg "github.com/goharbor/harbor/src/pkg/config/db"
diff --git a/src/lib/icon/const.go b/src/lib/icon/const.go
index 029202674..adaabc144 100644
--- a/src/lib/icon/const.go
+++ b/src/lib/icon/const.go
@@ -23,7 +23,8 @@ const (
 	DigestOfIconWASM    = "sha256:badd7693bcaf115be202748241dd0ea6ee3b0524bfab9ac22d1e1c43721afec6"
 
 	// ToDo add the accessories images
-	DigestOfIconAccDefault = ""
-	DigestOfIconAccCosign  = "sha256:20401d5b3a0f6dbc607c8d732eb08471af4ae6b19811a4efce8c6a724aed2882"
-	DigestOfIconAccNydus   = "sha256:dfcb6617cd9c144358dc1b305b87bbe34f0b619f1e329116e6aee2e41f2e34cf"
+	DigestOfIconAccDefault  = ""
+	DigestOfIconAccCosign   = "sha256:20401d5b3a0f6dbc607c8d732eb08471af4ae6b19811a4efce8c6a724aed2882"
+	DigestOfIconAccNotation = "sha256:3ac706e102bbe9362b400aa162df58135d35e66b9c3bee2165de92022d25fe34"
+	DigestOfIconAccNydus    = "sha256:dfcb6617cd9c144358dc1b305b87bbe34f0b619f1e329116e6aee2e41f2e34cf"
 )
diff --git a/src/pkg/accessory/manager.go b/src/pkg/accessory/manager.go
index f2bf3edc8..6c1d68d27 100644
--- a/src/pkg/accessory/manager.go
+++ b/src/pkg/accessory/manager.go
@@ -30,8 +30,9 @@ var (
 
 	// icon digests for each known type
 	defaultIcons = map[string]string{
-		model.TypeCosignSignature:  icon.DigestOfIconAccCosign,
-		model.TypeNydusAccelerator: icon.DigestOfIconAccNydus,
+		model.TypeCosignSignature:   icon.DigestOfIconAccCosign,
+		model.TypeNotationSignature: icon.DigestOfIconAccNotation,
+		model.TypeNydusAccelerator:  icon.DigestOfIconAccNydus,
 	}
 )
 
diff --git a/src/pkg/accessory/model/accessory.go b/src/pkg/accessory/model/accessory.go
index a960a75a2..4d6052532 100644
--- a/src/pkg/accessory/model/accessory.go
+++ b/src/pkg/accessory/model/accessory.go
@@ -68,6 +68,9 @@ const (
 	// TypeCosignSignature ...
 	TypeCosignSignature = "signature.cosign"
 
+	// TypeNotationSignature ...
+	TypeNotationSignature = "signature.notation"
+
 	// TypeNydusAccelerator ...
 	TypeNydusAccelerator = "accelerator.nydus"
 
diff --git a/src/pkg/accessory/model/notation/notation.go b/src/pkg/accessory/model/notation/notation.go
new file mode 100644
index 000000000..832384234
--- /dev/null
+++ b/src/pkg/accessory/model/notation/notation.go
@@ -0,0 +1,46 @@
+// Copyright Project Harbor Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package notation
+
+import (
+	"github.com/goharbor/harbor/src/pkg/accessory/model"
+	"github.com/goharbor/harbor/src/pkg/accessory/model/base"
+)
+
+// Signature signature model
+type Signature struct {
+	base.Default
+}
+
+// Kind gives the reference type of notation signature.
+func (c *Signature) Kind() string {
+	return model.RefHard
+}
+
+// IsHard ...
+func (c *Signature) IsHard() bool {
+	return true
+}
+
+// New returns notation signature
+func New(data model.AccessoryData) model.Accessory {
+	return &Signature{base.Default{
+		Data: data,
+	}}
+}
+
+func init() {
+	model.Register(model.TypeNotationSignature, New)
+}
diff --git a/src/pkg/accessory/model/notation/notation_test.go b/src/pkg/accessory/model/notation/notation_test.go
new file mode 100644
index 000000000..d15ea6425
--- /dev/null
+++ b/src/pkg/accessory/model/notation/notation_test.go
@@ -0,0 +1,73 @@
+package notation
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+
+	"github.com/goharbor/harbor/src/pkg/accessory/model"
+	htesting "github.com/goharbor/harbor/src/testing"
+)
+
+type NotationTestSuite struct {
+	htesting.Suite
+	accessory model.Accessory
+	digest    string
+	subDigest string
+}
+
+func (suite *NotationTestSuite) SetupSuite() {
+	suite.digest = suite.DigestString()
+	suite.subDigest = suite.DigestString()
+	suite.accessory, _ = model.New(model.TypeNotationSignature,
+		model.AccessoryData{
+			ArtifactID:        1,
+			SubArtifactDigest: suite.subDigest,
+			Size:              4321,
+			Digest:            suite.digest,
+		})
+}
+
+func (suite *NotationTestSuite) TestGetID() {
+	suite.Equal(int64(0), suite.accessory.GetData().ID)
+}
+
+func (suite *NotationTestSuite) TestGetArtID() {
+	suite.Equal(int64(1), suite.accessory.GetData().ArtifactID)
+}
+
+func (suite *NotationTestSuite) TestSubGetArtID() {
+	suite.Equal(suite.subDigest, suite.accessory.GetData().SubArtifactDigest)
+}
+
+func (suite *NotationTestSuite) TestSubGetSize() {
+	suite.Equal(int64(4321), suite.accessory.GetData().Size)
+}
+
+func (suite *NotationTestSuite) TestSubGetDigest() {
+	suite.Equal(suite.digest, suite.accessory.GetData().Digest)
+}
+
+func (suite *NotationTestSuite) TestSubGetType() {
+	suite.Equal(model.TypeNotationSignature, suite.accessory.GetData().Type)
+}
+
+func (suite *NotationTestSuite) TestSubGetRefType() {
+	suite.Equal(model.RefHard, suite.accessory.Kind())
+}
+
+func (suite *NotationTestSuite) TestIsSoft() {
+	suite.False(suite.accessory.IsSoft())
+}
+
+func (suite *NotationTestSuite) TestIsHard() {
+	suite.True(suite.accessory.IsHard())
+}
+
+func (suite *NotationTestSuite) TestDisplay() {
+	suite.False(suite.accessory.Display())
+}
+
+func TestCacheTestSuite(t *testing.T) {
+	suite.Run(t, new(NotationTestSuite))
+}
diff --git a/src/server/middleware/subject/subject.go b/src/server/middleware/subject/subject.go
index cc7dac862..9aa344698 100644
--- a/src/server/middleware/subject/subject.go
+++ b/src/server/middleware/subject/subject.go
@@ -32,6 +32,11 @@ import (
 	"github.com/goharbor/harbor/src/server/middleware"
 )
 
+var (
+	// the media type of notation signature layer
+	mediaTypeNotationLayer = "application/vnd.cncf.notary.signature"
+)
+
 /*
 	{
 	  "schemaVersion": 2,
@@ -115,7 +120,12 @@ func Middleware() func(http.Handler) http.Handler {
 				SubArtifactDigest: mf.Subject.Digest.String(),
 				Size:              art.Size,
 				Digest:            art.Digest,
-				Type:              model.TypeSubject,
+			}
+			switch mf.Config.MediaType {
+			case mediaTypeNotationLayer:
+				accData.Type = model.TypeNotationSignature
+			default:
+				accData.Type = model.TypeSubject
 			}
 			if subjectArt != nil {
 				accData.SubArtifactID = subjectArt.ID