Abstract out signature generation and verification to SignatureEnvelope

[priteshbandi]

Change Log:

• Implements SignatureEnvelope struct that would be used by notation-go-lib to generate/verify the signature.
• SignatureEnvelope internally implements actual signature formats like jws(cose in future)
• Implemented JWS-JSON signature generation and verification code.

[qmuntal]

General comment before doing an in-depth review:

Could you take a look at notaryproject/notation-go#62? I've changes the data model of several notation types to fit the new signing spec and moved away from jwt.Token, which simplifies the encoding/decoding logic. I think this PR would also benefit from taking that approach, as I guess it is using that many maps just because jwt.Token.Header is a map instead of a typed struct.

[qmuntal]

There is no need to define all these getters. Just use the global variables wherever necessary.

[priteshbandi]

Having global gives less control than the function, because anyone can read or change the global variable at any time. Also, having function will allow us to change variable name/representation internally without affecting callers.

[rgnote]

LGTM

[shizhMSFT]

Why not make SignatureEnvelope an interface lile

type SignatureEnvelope interface {
    Sign(req SignRequest) ([]byte, error)
    Verify(trustedCerts []*x509.Certificate) (*x509.Certificate, *SignerInfo, error)
    GetSignerInfo() (*SignerInfo, error)
}

Then we can have stuffs simplified like

// NewSignatureEnvelope is used for signature generation workflow
func NewSignatureEnvelope(envelopeMediaType SignatureMediaType) (SignatureEnvelope, error) {
	switch envelopeMediaType {
	case MediaTypeJWSJSON:
		return &jwsEnvelope{}, nil
	case MediaTypeCOSE:
		return &coseEnvelope{}, nil
	}
	return nil, &ErrorUnsupportedSignatureFormat{mediaType: string(envelopeMediaType)}
}

[priteshbandi]

So basically we want to implement common validations(like input validations, cert chain validations, trust anchor related code, timestamping related code) in SignatureEnvelope's sign and verify method and let specific implementation only do the work of encoding/decoding/integrity validation signature format.
With the interface above things are not possible. Although there can be a workaround by creating helper methods then we need to make sure each implementation is calling them.

[shizhMSFT]

Then we can still have

// NewSignatureEnvelope is used for signature generation workflow
func NewSignatureEnvelope(envelopeMediaType SignatureMediaType) (SignatureEnvelope, error) {
	switch envelopeMediaType {
	case MediaTypeJWSJSON:
		return &someGenericValidation{&jwsEnvelope{}}, nil
	case MediaTypeCOSE:
		return &someGenericValidation{&coseEnvelope{}}, nil
	}
	return nil, &UnsupportedSignatureFormatError{mediaType: string(envelopeMediaType)}
}

That still works. With interfaces, it is easier to decouple code and do unit testing.

[shizhMSFT]

Then we can still have

// NewSignatureEnvelope is used for signature generation workflow
func NewSignatureEnvelope(envelopeMediaType SignatureMediaType) (SignatureEnvelope, error) {
	switch envelopeMediaType {
	case MediaTypeJWSJSON:
		return &someGenericValidation{&jwsEnvelope{}}, nil
	case MediaTypeCOSE:
		return &someGenericValidation{&coseEnvelope{}}, nil
	}
	return nil, &UnsupportedSignatureFormatError{mediaType: string(envelopeMediaType)}
}

That still works. With interfaces, it is easier to decouple code and do unit testing.

[shizhMSFT]

LGTM

[gokarnm]

Typo singerInfo, can be addressed in subsequent PR.

[gokarnm]

LGTM!

[gokarnm]

If this is the Notary v2 payload type, it's signature format agnostic and should be set to application/vnd.cncf.notary.payload.v1+json

https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#payload