Repository: deislabs/ratify
Pull request #247 (2022-07-12 23:44:18)

Update go releaser template to use go mod tidy 1.17 compat
Update go releaser yaml to user go mod tidy --compat=1.17


Patch:
diff --git a/.goreleaser.yml b/.goreleaser.yml
index b0f9f2b..e95af67 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,7 +1,7 @@
 # Check the documentation at https://goreleaser.com for more options
 before:
   hooks:
-    - go mod tidy
+    - go mod tidy -compat=1.17
 builds:
   - id: ratify
     dir: cmd/ratify
diff --git a/charts/ratify/templates/configmap.yaml b/charts/ratify/templates/configmap.yaml
index 44e5d38..775ddb3 100644
--- a/charts/ratify/templates/configmap.yaml
+++ b/charts/ratify/templates/configmap.yaml
@@ -8,31 +8,31 @@ data:
       "executor": {
         "requestTimeout": 6800
       },
-      "stores": {
+      "store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras"
                 {{- if .Values.cosign.enabled }}
                 ,
-                "cosign-enabled": true
+                "cosignEnabled": true
                 {{- end }}
                 {{- if .Values.oras.authProviders.azureWorkloadIdentityEnabled }}
                 ,
-                "auth-provider": {
-                    "name": "azure-wi"
+                "authProvider": {
+                    "name": "azureWorkloadIdentity"
                 }
                 {{- end }}
                 {{- if .Values.oras.authProviders.k8secretsEnabled }}
                 ,
-                "auth-provider": {
-                    "name": "k8s-secrets"
+                "authProvider": {
+                    "name": "k8Secrets"
                 }
                 {{- end }}
             }
         ]
       },
-      "policies": {
+      "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -41,7 +41,7 @@ data:
             }
         }
       },
-      "verifiers": {
+      "verifier": {
           "version": "1.0.0",
           "plugins": [
             {
diff --git a/config/config.go b/config/config.go
index e76ba76..51765cf 100644
--- a/config/config.go
+++ b/config/config.go
@@ -38,9 +38,9 @@ const (
 )
 
 type Config struct {
-	StoresConfig    rsConfig.StoresConfig    `json:"stores,omitempty"`
-	PoliciesConfig  pcConfig.PoliciesConfig  `json:"policies,omitempty"`
-	VerifiersConfig vfConfig.VerifiersConfig `json:"verifiers,omitempty"`
+	StoresConfig    rsConfig.StoresConfig    `json:"store,omitempty"`
+	PoliciesConfig  pcConfig.PoliciesConfig  `json:"policy,omitempty"`
+	VerifiersConfig vfConfig.VerifiersConfig `json:"verifier,omitempty"`
 	ExecutorConfig  exConfig.ExecutorConfig  `json:"executor,omitempty"`
 }
 
diff --git a/config/config.json b/config/config.json
index 28623b7..fc538a9 100644
--- a/config/config.json
+++ b/config/config.json
@@ -1,5 +1,5 @@
 {
-    "stores": {
+    "store": {
         "version": "1.0.0",
         "plugins": [
             {
@@ -7,7 +7,7 @@
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -16,7 +16,7 @@
             }
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
diff --git a/docs/examples/ratify-on-aws.md b/docs/examples/ratify-on-aws.md
index 48a374f..2812298 100644
--- a/docs/examples/ratify-on-aws.md
+++ b/docs/examples/ratify-on-aws.md
@@ -111,17 +111,17 @@ but we can look at what will be generated below:
 
 ```json
 {
-    "stores": {
+    "store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras",
-                "cosign-enabled": true,
+                "cosignEnabled": true,
                 "localCachePath": "./local_oras_cache"
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -130,7 +130,7 @@ but we can look at what will be generated below:
             }
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [        
           {
diff --git a/docs/examples/ratify-verify-azure-cmd.md b/docs/examples/ratify-verify-azure-cmd.md
index 86d42d2..ebd647c 100644
--- a/docs/examples/ratify-verify-azure-cmd.md
+++ b/docs/examples/ratify-verify-azure-cmd.md
@@ -106,7 +106,7 @@ notation list $IMAGE
 ```bash
 cat <<EOF > ~/.ratify/config.json 
 { 
-    "stores": { 
+    "store": { 
         "version": "1.0.0", 
         "plugins": [ 
             { 
@@ -114,7 +114,7 @@ cat <<EOF > ~/.ratify/config.json
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -123,7 +123,7 @@ cat <<EOF > ~/.ratify/config.json
             }
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
@@ -189,7 +189,7 @@ notation sign $REPO@$SBOM_DIGEST
 ```bash
 cat <<EOF > ~/.ratify/config.json 
 { 
-    "stores": { 
+    "store": { 
         "version": "1.0.0", 
         "plugins": [ 
             { 
@@ -197,14 +197,14 @@ cat <<EOF > ~/.ratify/config.json
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "artifactVerificationPolicies": {
             "application/vnd.cncf.notary.v2.signature": "any",
             "sbom/example": "all"
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
diff --git a/docs/oras-auth-provider.md b/docs/oras-auth-provider.md
index 830937e..1df79b2 100644
--- a/docs/oras-auth-provider.md
+++ b/docs/oras-auth-provider.md
@@ -2,25 +2,34 @@
 
 ORAS handles all referrer operations using registry as the referrer store. It uses authentication credentials to authenticate to a registry and access referrer artifacts. Ratify contains many Authentication Providers to support different authentication scenarios. The user specifies which authentication provider to use in the configuration.
 
-The `auth-provider` section of configuration file specifies the authentication provider. The `name` field is REQUIRED for Ratify to bind to the correct provider implementation. 
+The `authProvider` section of configuration file specifies the authentication provider. The `name` field is REQUIRED for Ratify to bind to the correct provider implementation. 
 
 ## Example config.json
 ```
 {
-    "stores": {
+    "store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras",
                 "localCachePath": "./local_oras_cache",
-                "auth-provider": {
+                "authProvider": {
                     "name": "<auth provider name>",
                     <other provider specific fields>
                 }
             }
         ]
     },
-    "verifiers": {
+    "policy": {
+        "version": "1.0.0",
+        "plugin": {
+            "name": "configPolicy",
+            "artifactVerificationPolicies": {
+                "application/vnd.cncf.notary.v2.signature": "any"
+            }
+        }
+    },
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
@@ -41,19 +50,19 @@ NOTE: ORAS will attempt to use anonymous access if the authentication provider f
 ## Supported Providers
 
 ### 1. Docker Config
-This is the default authentication provider. Ratify attempts to look for credentials at the default docker configuration path ($HOME/.docker/config.json) if the `auth-provider` section is not specified.
+This is the default authentication provider. Ratify attempts to look for credentials at the default docker configuration path ($HOME/.docker/config.json) if the `authProvider` section is not specified.
 
-Specify the `configPath` field for the `docker-config` authentication provider to use a different docker config file path. 
+Specify the `configPath` field for the `dockerConfig` authentication provider to use a different docker config file path. 
 
 ```
-"stores": {
+"store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras",
                 "localCachePath": "./local_oras_cache",
-                "auth-provider": {
-                    "name": "docker-config",
+                "authProvider": {
+                    "name": "dockerConfig",
                     "configPath": <custom file path string>
                 }
             }
@@ -127,14 +136,14 @@ EOF
 
 #### Ratify Auth Provider Configuration
 ```
-"stores": {
+"store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras",
                 "localCachePath": "./local_oras_cache",
-                "auth-provider": {
-                    "name": "azure-wi"
+                "authProvider": {
+                    "name": "azureWorkloadIdentity"
                 }
             }
         ]
@@ -151,21 +160,21 @@ Ratify only supports the kubernetes.io/dockerconfigjson secret type or the legac
 
 #### Sample Configuration
 ```
-"stores": {
+"store": {
         "version": "1.0.0",
         "plugins": [
             {
                 "name": "oras",
                 "localCachePath": "./local_oras_cache",
-                "auth-provider": {
-                    "name": "k8s-secrets",
+                "authProvider": {
+                    "name": "k8Secrets",
                     "serviceAccountName": "ratify-sa", // will be 'default' if not specified
                     "secrets" : [
                         {
-                            "secretName": "artifact-pull-docker-config" // Ratify namespace will be used 
+                            "secretName": "artifact-pull-dockerConfig" // Ratify namespace will be used 
                         },
                         {
-                            "secretName": "artifact-pull-docker-config2",
+                            "secretName": "artifact-pull-dockerConfig2",
                             "namespace": "test"
                         }
                     ]
diff --git a/docs/policy-provider.md b/docs/policy-provider.md
index 1af1caa..9d52eaa 100644
--- a/docs/policy-provider.md
+++ b/docs/policy-provider.md
@@ -1,6 +1,6 @@
 # Policy Providers
 
-Ratify implements an extensible policy provider interface allowing for different policy providers to be created and registered. The policy provider to be used is determined by the policy plugin specified in the `policies` section of the configuration. 
+Ratify implements an extensible policy provider interface allowing for different policy providers to be created and registered. The policy provider to be used is determined by the policy plugin specified in the `policy` section of the configuration. 
 
 Currently, Ratify supports a Configuration based Policy Provider named `configPolicy`.
 
@@ -12,7 +12,7 @@ The executor is the "glue" that links all Ratify plugin-based components such as
 
 ```
 ...
-"policies": {
+"policy": {
     "version": "1.0.0",
     "plugin": {
         "name": "configPolicy",
@@ -34,7 +34,7 @@ The executor is the "glue" that links all Ratify plugin-based components such as
         
         ```
         ...
-        "policies": {
+        "policy": {
             "version": "1.0.0",
             "plugin": {
                 "name": "configPolicy",
@@ -50,7 +50,7 @@ The executor is the "glue" that links all Ratify plugin-based components such as
 - Require all reference artifacts associated with subject image to be verify successfully:
     ```
     ...
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy"
@@ -61,7 +61,7 @@ The executor is the "glue" that links all Ratify plugin-based components such as
 - Require at least one reference artifact of the same type to verify succesfully. (relaxes the default policy to 'any'):
     ```
     ...
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -75,7 +75,7 @@ The executor is the "glue" that links all Ratify plugin-based components such as
 - For a specific artifact type, relax requirement so only one success is needed for artifacts of that type:
     ```
     ...
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
diff --git a/docs/quickstart-cli.md b/docs/quickstart-cli.md
index 29ebf85..1c261db 100644
--- a/docs/quickstart-cli.md
+++ b/docs/quickstart-cli.md
@@ -114,7 +114,7 @@ This completes the creation of the supply chain graph.
 ```bash
 cat <<EOF > ~/.ratify/config.json 
 { 
-    "stores": { 
+    "store": { 
         "version": "1.0.0", 
         "plugins": [ 
             { 
@@ -122,7 +122,7 @@ cat <<EOF > ~/.ratify/config.json
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -132,7 +132,7 @@ cat <<EOF > ~/.ratify/config.json
             }
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
diff --git a/docs/working-with-spdx.md b/docs/working-with-spdx.md
index 8d272d1..668fb78 100644
--- a/docs/working-with-spdx.md
+++ b/docs/working-with-spdx.md
@@ -61,7 +61,7 @@ Next we will create the config file we will use for validation:
 ```shell
 cat <<'EOF' >> spdxconfig.json
 {
-    "stores": {
+    "store": {
         "version": "1.0.0",
         "plugins": [
             {
@@ -70,7 +70,7 @@ cat <<'EOF' >> spdxconfig.json
             }
         ]
     },
-    "policies": {
+    "policy": {
         "version": "1.0.0",
         "plugin": {
             "name": "configPolicy",
@@ -79,7 +79,7 @@ cat <<'EOF' >> spdxconfig.json
             }
         }
     },
-    "verifiers": {
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {
diff --git a/pkg/referrerstore/mocks/types.go b/pkg/referrerstore/mocks/types.go
index 3856940..397c0c7 100644
--- a/pkg/referrerstore/mocks/types.go
+++ b/pkg/referrerstore/mocks/types.go
@@ -33,7 +33,7 @@ type TestStore struct {
 }
 
 func (s *TestStore) Name() string {
-	return "test-store"
+	return "testStore"
 }
 
 func (s *TestStore) ListReferrers(ctx context.Context, subjectReference common.Reference, artifactTypes []string, nextToken string, subjectDesc *ocispecs.SubjectDescriptor) (referrerstore.ListReferrersResult, error) {
diff --git a/pkg/referrerstore/oras/authprovider/authprovider.go b/pkg/referrerstore/oras/authprovider/authprovider.go
index f0ddf5a..3603ba5 100644
--- a/pkg/referrerstore/oras/authprovider/authprovider.go
+++ b/pkg/referrerstore/oras/authprovider/authprovider.go
@@ -58,7 +58,7 @@ type defaultAuthProviderConf struct {
 	ConfigPath string `json:"configPath,omitempty"`
 }
 
-const DefaultAuthProviderName string = "docker-config"
+const DefaultAuthProviderName string = "dockerConfig"
 
 // init calls Register for our default provider, which simply reads the .dockercfg file.
 func init() {
diff --git a/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity.go b/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity.go
index 0a77486..cfcc310 100644
--- a/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity.go
+++ b/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity.go
@@ -41,7 +41,7 @@ type azureWIAuthProviderConf struct {
 }
 
 const (
-	azureWIAuthProviderName      string = "azure-wi"
+	azureWIAuthProviderName      string = "azureWorkloadIdentity"
 	dockerTokenLoginUsernameGUID string = "00000000-0000-0000-0000-000000000000"
 	AADResource                  string = "https://containerregistry.azure.net/.default"
 )
diff --git a/pkg/referrerstore/oras/authprovider/k8secret_authprovider.go b/pkg/referrerstore/oras/authprovider/k8secret_authprovider.go
index 58ca26b..3b76b57 100644
--- a/pkg/referrerstore/oras/authprovider/k8secret_authprovider.go
+++ b/pkg/referrerstore/oras/authprovider/k8secret_authprovider.go
@@ -57,9 +57,9 @@ const secretTimeout = time.Hour * 12
 
 var ErrorNoMatchingCredential = errors.New("no matching credential found for k8 secret")
 
-// init calls Register for our k8s-secrets provider
+// init calls Register for our k8Secrets provider
 func init() {
-	Register("k8s-secrets", &k8SecretProviderFactory{})
+	Register("k8Secrets", &k8SecretProviderFactory{})
 }
 
 // Create returns a k8AuthProvider instance after parsing auth config and resolving
diff --git a/pkg/referrerstore/oras/oras.go b/pkg/referrerstore/oras/oras.go
index c97a900..cc54da5 100644
--- a/pkg/referrerstore/oras/oras.go
+++ b/pkg/referrerstore/oras/oras.go
@@ -57,8 +57,8 @@ const (
 type OrasStoreConf struct {
 	Name           string                          `json:"name"`
 	UseHttp        bool                            `json:"useHttp,omitempty"`
-	CosignEnabled  bool                            `json:"cosign-enabled,omitempty"`
-	AuthProvider   authprovider.AuthProviderConfig `json:"auth-provider,omitempty"`
+	CosignEnabled  bool                            `json:"cosignEnabled,omitempty"`
+	AuthProvider   authprovider.AuthProviderConfig `json:"authProvider,omitempty"`
 	LocalCachePath string                          `json:"localCachePath,omitempty"`
 }
 
diff --git a/plugins/verifier/cosign/README.md b/plugins/verifier/cosign/README.md
index 3e60577..237422d 100644
--- a/plugins/verifier/cosign/README.md
+++ b/plugins/verifier/cosign/README.md
@@ -12,7 +12,7 @@ The only configuration that is needed for cosign verifier is the path to the pub
 
 ```json
 {
-    "stores": {
+    "store": {
         "version": "1.0.0",
         "plugins": [
             {
@@ -21,7 +21,16 @@ The only configuration that is needed for cosign verifier is the path to the pub
             }
         ]
     },
-    "verifiers": {
+    "policy": {
+        "version": "1.0.0",
+        "plugin": {
+            "name": "configPolicy",
+            "artifactVerificationPolicies": {
+                "application/vnd.cncf.notary.v2.signature": "any"
+            }
+        }
+    },
+    "verifier": {
         "version": "1.0.0",
         "plugins": [
             {


Test patch:
diff --git a/config/config_test.go b/config/config_test.go
index fabeb65..cf865be 100644
--- a/config/config_test.go
+++ b/config/config_test.go
@@ -35,7 +35,7 @@ func TestLoad_FromDefaultPath(t *testing.T) {
 	defer os.Unsetenv("RATIFY_CONFIG")
 
 	fileName := filepath.Join(tmpDir, ConfigFileName)
-	content := []byte(`{"stores":  { "version": "1.0.0" }}`)
+	content := []byte(`{"store":  { "version": "1.0.0" }}`)
 	err = ioutil.WriteFile(fileName, content, 0644)
 	if err != nil {
 		t.Fatalf("config file creation failed %v", err)
@@ -65,7 +65,7 @@ func TestLoad_FromGiventPath(t *testing.T) {
 	defer os.RemoveAll(tmpDir)
 
 	fileName := filepath.Join(tmpDir, ConfigFileName)
-	content := []byte(`{"stores":  { "version": "1.0.0" }}`)
+	content := []byte(`{"store":  { "version": "1.0.0" }}`)
 	err = ioutil.WriteFile(fileName, content, 0644)
 	if err != nil {
 		t.Fatalf("config file creation failed %v", err)
@@ -134,7 +134,7 @@ func TestLoad_InvalidConfigFile(t *testing.T) {
 	defer os.RemoveAll(tmpDir)
 
 	fileName := filepath.Join(tmpDir, ConfigFileName)
-	content := []byte(`"stores":  { "version": "1.0.0" }}`)
+	content := []byte(`"store":  { "version": "1.0.0" }}`)
 	err = ioutil.WriteFile(fileName, content, 0644)
 	if err != nil {
 		t.Fatalf("config file creation failed %v", err)
diff --git a/pkg/referrerstore/factory/factory_test.go b/pkg/referrerstore/factory/factory_test.go
index 6c837b7..b7d7bc0 100644
--- a/pkg/referrerstore/factory/factory_test.go
+++ b/pkg/referrerstore/factory/factory_test.go
@@ -32,12 +32,12 @@ func (f *TestStoreFactory) Create(version string, storesConfig config.StorePlugi
 
 func TestCreateStoresFromConfig_BuiltInStores_ReturnsExpected(t *testing.T) {
 	builtInStores = map[string]StoreFactory{
-		"test-store": &TestStoreFactory{},
+		"testStore": &TestStoreFactory{},
 	}
 
 	var storeConfig config.StorePluginConfig
 	storeConfig = map[string]interface{}{
-		"name": "test-store",
+		"name": "testStore",
 	}
 	storesConfig := config.StoresConfig{
 		Stores: []config.StorePluginConfig{storeConfig},
@@ -53,7 +53,7 @@ func TestCreateStoresFromConfig_BuiltInStores_ReturnsExpected(t *testing.T) {
 		t.Fatalf("expected to have %d stores, actual count %d", 1, len(stores))
 	}
 
-	if stores[0].Name() != "test-store" {
+	if stores[0].Name() != "testStore" {
 		t.Fatalf("expected to create test store")
 	}
 
diff --git a/pkg/referrerstore/oras/authprovider/authproviderfactory_test.go b/pkg/referrerstore/oras/authprovider/authproviderfactory_test.go
index e649059..ce33b62 100644
--- a/pkg/referrerstore/oras/authprovider/authproviderfactory_test.go
+++ b/pkg/referrerstore/oras/authprovider/authproviderfactory_test.go
@@ -29,11 +29,11 @@ func (f *TestAuthProviderFactory) Create(authProviderConfig AuthProviderConfig)
 // Checks the correct registered auth provider is invoked based on config
 func TestCreateAuthProvidersFromConfig_BuiltInAuthProviders_ReturnsExpected(t *testing.T) {
 	builtInAuthProviders = map[string]AuthProviderFactory{
-		"test-authprovider": &TestAuthProviderFactory{},
+		"testAuthProvider": &TestAuthProviderFactory{},
 	}
 
 	authProviderConfig := map[string]interface{}{
-		"name": "test-authprovider",
+		"name": "testAuthProvider",
 	}
 
 	authProvider, err := CreateAuthProviderFromConfig(authProviderConfig)
@@ -55,7 +55,7 @@ func TestCreateAuthProvidersFromConfig_BuiltInAuthProviders_ReturnsExpected(t *t
 // Checks the auth provider creation fails if auth provider specified does not exist
 func TestCreateAuthProvidersFromConfig_NonexistentAuthProviders_ReturnsExpected(t *testing.T) {
 	builtInAuthProviders = map[string]AuthProviderFactory{
-		"docker-config": &defaultProviderFactory{},
+		"dockerConfig": &defaultProviderFactory{},
 	}
 
 	authProviderConfig := map[string]interface{}{
@@ -73,7 +73,7 @@ func TestCreateAuthProvidersFromConfig_NonexistentAuthProviders_ReturnsExpected(
 // specified in config
 func TestCreateAuthProvidersFromConfig_NullAuthProviders_ReturnsExpected(t *testing.T) {
 	builtInAuthProviders = map[string]AuthProviderFactory{
-		"docker-config": &defaultProviderFactory{},
+		"dockerConfig": &defaultProviderFactory{},
 	}
 
 	authProvider, err := CreateAuthProviderFromConfig(nil)
diff --git a/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity_test.go b/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity_test.go
index 8f05218..bc61fb9 100644
--- a/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity_test.go
+++ b/pkg/referrerstore/oras/authprovider/azure/azureworkloadidentity_test.go
@@ -55,7 +55,7 @@ func TestAzureWIEnabled_ExpectedResults(t *testing.T) {
 // environment variables are properly set
 func TestAzureWIValidation_EnvironmentVariables_ExpectedResults(t *testing.T) {
 	authProviderConfig := map[string]interface{}{
-		"name": "azure-wi",
+		"name": "azureWorkloadIdentity",
 	}
 
 	err := os.Setenv("AZURE_TENANT_ID", "")