v1.0.0-rc.2

🚀Notation CLI v1.0.0-rc.2 is now available!

New Features

• New command for users to inspect signatures associated with signed artifacts
  • Example: notation inspect localhost:5000/net-monitor@sha256:xxx
• Support storing signatures in the registry using OCI image manifest
  • Example: notation sign --key mykey --signature-manifest image localhost:5000/net-monitor@sha256:xxx
• Support adding user defined metadata to signature payload
  • Example: notation sign --key mykey --user-metadata io.wabbit-networks.buildTime=1672944615 localhost:5000/net-monitor@sha256:xxx

Other Changes

• Introduced E2E testing framework and new E2E test cases
• Add --debug and --verbose flags for more commands
• Improved error messaging
• Bug fixes

Detailed Commits

• fix: add verification failed log by @JeyJeyGao in #469
• update: refactored notation list command by @patrickzheng200 in #481
• build(deps): bump oras.land/oras-go/v2 from 2.0.0-rc.5 to 2.0.0-rc.6 by @dependabot in #488
• build(deps): bump goreleaser/goreleaser-action from 3 to 4 by @dependabot in #487
• build(deps): bump dev-drprasad/delete-older-releases from 0.2.0 to 0.2.1 by @dependabot in #480
• build(deps): bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @dependabot in #486
• cleanup: clean up notation CLI by @patrickzheng200 in #485
• Fix: fixed notation cert command by @patrickzheng200 in #483
• update: added log to notation login and logout commands by @patrickzheng200 in #484
• update: added log to notation key and certificate commands by @patrickzheng200 in #478
• build(deps): Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @dependabot in #495
• doc: Remove outdated docs by @FeynmanZhou in #501
• test: e2e framework by @JeyJeyGao in #493
• build(deps): Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @dependabot in #504
• doc: update notation sign and verify spec for metadata by @byronchien in #498
• doc: update to support OCI image manifest by @yizha1 in #502
• doc: notation Inspect Command line Spec by @vaninrao10 in #500
• test: e2e quickstart test case by @JeyJeyGao in #494
• build(deps): Bump oras.land/oras-go/v2 from 2.0.0-rc.6 to 2.0.0 by @dependabot in #512
• chore: improve warning message when signing or verifying with tag by @priteshbandi in #497
• test: e2e plugin test cases by @JeyJeyGao in #510
• test: e2e sign/verify/trustpolicy test cases by @JeyJeyGao in #496
• test: add unit test for version & trace packages by @JeyJeyGao in #526
• test: add unit test for ioutil package by @JeyJeyGao in #534
• Use new methods introduced in keys.go by @priteshbandi in #529
• bump: go 1.19 to 1.20 by @mintbomb27 in #538
• fix: add error handling for LoadConfigOnce() by @JeyJeyGao in #520
• feat: add support for signed user metadata in notation sign and verify cmds by @byronchien in #507
• Dont access value of default pointer if it is nil by @priteshbandi in #541
• feat: support OCI image manifest by @patrickzheng200 in #509
• doc: update sign.md for OCI image manifest support by @yizha1 in #540
• feat: add support for json output for notation verify by @byronchien in #527
• chore: update sign command descriptions to align with the spec by @patrickzheng200 in #543
• Revert "feat: add support for json output for notation verify (#527)" by @priteshbandi in #551
• fix!: remove short commands by @priteshbandi in #552
• feat: add implementation for notation inspect by @byronchien in #528
• bump: update notation-go and notation-core-go dependency by @priteshbandi in #557
• Added CODEOWNERS and MAINTAINERS files by @toddysm in #542
• build: upgrade version to v1.0.0-rc.2 by @byronchien in #558

New Contributors

• @byronchien made their first contribution in #498
• @vaninrao10 made their first contribution in #500
• @mintbomb27 made their first contribution in #538

Full Changelog: v1.0.0-rc.1...v1.0.0-rc.2