Tracking issue for pending feedbacks/Issues in PR5

[priteshbandi]

Tracking issue for multiple comments/issues that were called out in #5 and needs to be resolved.

Issues marked with [Alpha], must to be resolved for alpha release.

Security

• [Alpha] We shouldn't automatically fetch and trust system certificates as user might not trust them for signature verification.
• [Alpha] JWS: We should add validation for list of supported algorithms(to avoid algorithm substitution and signature bypass attacks)
• [Alpha] We should add validation for codesigning certificate

Package Hygiene

• [Alpha] Remove all dead/unused code. For e.g.:
  • All example related modules. The default file based(read cert and key from disk) implementaion of Signer and verifier can act as example.
  • All Registry related modules and dependencies
  • type.go
  • Remove dependency on libtrust as its no longer maintained

Readability & Maintainability

• [Alpha] For better readability, we should to add documentation for important packages and exported names.
• [Alpha] Add unit tests. At minimum we need test which exercises positive scenario(successful signing and verification) to avoid breaking changes.

Signature(JWS)

• Signer and Verifier should be generic and signature agnostic.
• [Alpha] Move to JWS and as part of that we need to address following issues:
  • iat shoudnt be empty
  • nbf should be removed
  • Descriptor mediaType must not be empty
  • For notation alpha we can stick to only supporing x509 Cert; no need for keyId as its not actully getting used
• Add path is valid check while reading/writing cert and key from local disk:

[priteshbandi]

@shizhMSFT Addressed all the comments in PR #11