Repository: deislabs/ratify (go)

Issue:
Support configurable plugin directories for notaryv2 verifier
### What would you like to be added?

Users are able to use the Dynamic Plugins feature to download external plugins for use with the notation verifier. Plugins can be configured to be downloaded to a user-specified directory, but the notation verifier has no way of knowing where plugins have been downloaded to and only looks in the default plugin directory (`/.ratify/plugins`). Ideally, users should be able to download plugins to whatever location they choose, and the notation verifier should be able to get the locations of downloaded plugins outside of just the default directory.

### Anything else you would like to add?

Related links:
- https://github.com/deislabs/ratify/blob/main/docs/reference/dynamic-plugins.md
- https://github.com/deislabs/ratify/pull/804

### Are you willing to submit PRs to contribute to this feature?

- [ ] Yes, I am willing to implement it.

Pull request:
fix: update notation plugin manager directory
# Description

## What this PR does / why we need it:
- updates Verifier factory API to accept binary directory path in `Create`
- updates notation verifier plugin manager to use new directory path param

## Which issue(s) this PR fixes *(optional, using `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when the PR gets merged)*:
Fixes #810

## Type of change

Please delete options that are not relevant.

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] Helm Chart Change (any edit/addition/update that is necessary for changes merged to the `main` branch)
- [ ] This change requires a documentation update

# How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

- Added unit test

# Checklist:

- [x] Does the affected code have corresponding tests?
- [ ] Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
- [ ] Does this introduce breaking changes that would require an announcement or bumping the major version?
- [ ] Do all new files have appropriate license header?

# Post Merge Requirements
- [ ] MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates `Helm Chart Change`


Patch:
diff --git a/pkg/verifier/factory/factory.go b/pkg/verifier/factory/factory.go
index d7f6720..c6bb797 100644
--- a/pkg/verifier/factory/factory.go
+++ b/pkg/verifier/factory/factory.go
@@ -34,7 +34,7 @@ import (
 var builtInVerifiers = make(map[string]VerifierFactory)
 
 type VerifierFactory interface {
-	Create(version string, verifierConfig config.VerifierConfig) (verifier.ReferenceVerifier, error)
+	Create(version string, verifierConfig config.VerifierConfig, pluginDirectory string) (verifier.ReferenceVerifier, error)
 }
 
 func Register(name string, factory VerifierFactory) {
@@ -82,7 +82,7 @@ func CreateVerifierFromConfig(verifierConfig config.VerifierConfig, configVersio
 
 	verifierFactory, ok := builtInVerifiers[verifierNameStr]
 	if ok {
-		return verifierFactory.Create(configVersion, verifierConfig)
+		return verifierFactory.Create(configVersion, verifierConfig, pluginBinDir[0])
 	} else {
 		return plugin.NewVerifier(configVersion, verifierConfig, pluginBinDir)
 	}
diff --git a/pkg/verifier/notaryv2/notaryv2.go b/pkg/verifier/notaryv2/notaryv2.go
index 8f8779c..0a25aba 100644
--- a/pkg/verifier/notaryv2/notaryv2.go
+++ b/pkg/verifier/notaryv2/notaryv2.go
@@ -69,13 +69,13 @@ func init() {
 	factory.Register(verifierName, &notaryv2VerifierFactory{})
 }
 
-func (f *notaryv2VerifierFactory) Create(version string, verifierConfig config.VerifierConfig) (verifier.ReferenceVerifier, error) {
+func (f *notaryv2VerifierFactory) Create(version string, verifierConfig config.VerifierConfig, pluginDirectory string) (verifier.ReferenceVerifier, error) {
 	conf, err := parseVerifierConfig(verifierConfig)
 	if err != nil {
 		return nil, err
 	}
 
-	verfiyService, err := getVerifierService(conf)
+	verfiyService, err := getVerifierService(conf, pluginDirectory)
 	if err != nil {
 		return nil, err
 	}
@@ -148,13 +148,13 @@ func (v *notaryV2Verifier) Verify(ctx context.Context,
 	}, nil
 }
 
-func getVerifierService(conf *NotaryV2VerifierConfig) (notation.Verifier, error) {
+func getVerifierService(conf *NotaryV2VerifierConfig, pluginDirectory string) (notation.Verifier, error) {
 	store := &trustStore{
 		certPaths:  conf.VerificationCerts,
 		certStores: conf.VerificationCertStores,
 	}
 
-	return notaryVerifier.New(&conf.TrustPolicyDoc, store, NewRatifyPluginManager(defaultPluginDirectory))
+	return notaryVerifier.New(&conf.TrustPolicyDoc, store, NewRatifyPluginManager(pluginDirectory))
 }
 
 func (v *notaryV2Verifier) verifySignature(ctx context.Context, subjectRef, mediaType string, subjectDesc oci.Descriptor, refBlob []byte) (*notation.VerificationOutcome, error) {


Test patch:
diff --git a/pkg/verifier/factory/factory_test.go b/pkg/verifier/factory/factory_test.go
index eae995a..04cfeda 100644
--- a/pkg/verifier/factory/factory_test.go
+++ b/pkg/verifier/factory/factory_test.go
@@ -28,7 +28,9 @@ import (
 	"github.com/deislabs/ratify/pkg/verifier/plugin"
 )
 
-type TestVerifier struct{}
+type TestVerifier struct {
+	verifierDirectory string
+}
 type TestVerifierFactory struct{}
 
 func (s *TestVerifier) Name() string {
@@ -50,8 +52,8 @@ func (s *TestVerifier) GetNestedReferences() []string {
 	return []string{}
 }
 
-func (f *TestVerifierFactory) Create(version string, verifierConfig config.VerifierConfig) (verifier.ReferenceVerifier, error) {
-	return &TestVerifier{}, nil
+func (f *TestVerifierFactory) Create(version string, verifierConfig config.VerifierConfig, pluginDirectory string) (verifier.ReferenceVerifier, error) {
+	return &TestVerifier{verifierDirectory: pluginDirectory}, nil
 }
 
 func TestCreateVerifiersFromConfig_BuiltInVerifiers_ReturnsExpected(t *testing.T) {
@@ -66,7 +68,7 @@ func TestCreateVerifiersFromConfig_BuiltInVerifiers_ReturnsExpected(t *testing.T
 		Verifiers: []config.VerifierConfig{verifierConfig},
 	}
 
-	verifiers, err := CreateVerifiersFromConfig(verifiersConfig, "")
+	verifiers, err := CreateVerifiersFromConfig(verifiersConfig, "test/dir")
 
 	if err != nil {
 		t.Fatalf("create verifiers failed with err %v", err)
@@ -83,6 +85,14 @@ func TestCreateVerifiersFromConfig_BuiltInVerifiers_ReturnsExpected(t *testing.T
 	if _, ok := verifiers[0].(*plugin.VerifierPlugin); ok {
 		t.Fatalf("type assertion failed expected a built in verifier")
 	}
+
+	if verifierTest, ok := verifiers[0].(*TestVerifier); !ok {
+		t.Fatalf("type assertion failed expected a test verifier")
+	} else {
+		if verifierTest.verifierDirectory != "test/dir" {
+			t.Fatalf("expected verifier directory to be empty")
+		}
+	}
 }
 
 func TestCreateVerifiersFromConfig_PluginVerifiers_ReturnsExpected(t *testing.T) {
diff --git a/pkg/verifier/notaryv2/notaryv2_test.go b/pkg/verifier/notaryv2/notaryv2_test.go
index db8f16a..05eb5d9 100644
--- a/pkg/verifier/notaryv2/notaryv2_test.go
+++ b/pkg/verifier/notaryv2/notaryv2_test.go
@@ -309,7 +309,7 @@ func TestCreate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			f := &notaryv2VerifierFactory{}
-			_, err := f.Create(testVersion, tt.configMap)
+			_, err := f.Create(testVersion, tt.configMap, "")
 
 			if (err != nil) != tt.expectErr {
 				t.Fatalf("error = %v, expectErr = %v", err, tt.expectErr)