Repository: notaryproject/notation (go)

Issue:
Clarify LibEx directory on Windows
The [directory structure spec](https://github.com/notaryproject/notation/blob/main/specs/directory.md#system-level) calls out LibEx files to be placed in the root of `%ProgramFiles%`.
Windows uses nested folders to isolate binaries and config specific to each executable. This includes configuration as well.

This spec seems to call ou BIN is under a subfolder, but LIBEXEC and CONFIG are not.

| Directory | Unix           | Windows                       | Darwin                         |
| --------- | -------------- | ----------------------------- | ------------------------------ |
| `BIN`     | `/usr/bin`     | `%ProgramFiles%/notation/bin` | `/usr/local/bin`               |
| `LIBEXEC` | `/usr/libexec` | `%ProgramFiles%`              | `/usr/local/lib`               |
| `CONFIG`  | `/etc`         | `%ProgramData%`               | `/Library/Application Support` |

This issue clarifies that all notation components should be under a sub-directory on Windows, not just the BIN.

Suggesting the following:

| Directory | Unix           | Windows                       | Darwin                         |
| --------- | -------------- | ----------------------------- | ------------------------------ |
| `BIN`     | `/usr/bin`     | `%ProgramFiles%/notation/bin` | `/usr/local/bin`               |
| `LIBEXEC` | `/usr/libexec` | `%ProgramFiles%/notation/bin` | `/usr/local/lib`               |
| `CONFIG`  | `/etc`         | `%ProgramData%/notation/`     | `/Library/Application Support` |


The [Windows examples](https://github.com/notaryproject/notation/blob/main/specs/directory.md#windows) section seems to imply these are sub directories, so it looks like the above just needs a bit more consistency across platforms as each platform stores notation in a sub-directory.

Pull request description:
doc: improve readability of directory spec
Improve readability of directory spec without changing the underlying directory structures.

Resolves #220
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>

Patch:
diff --git a/README.md b/README.md
index 97fb9d8..f38481b 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 [![codecov](https://codecov.io/gh/notaryproject/notation/branch/main/graph/badge.svg)](https://codecov.io/gh/notaryproject/notation)
 
-Notation is a project to add signatures as standard items in the registry ecosystem, and to build a set of simple tooling for signing and verifying these signatures. This should be viewed as similar security to checking git commit signatures, although the signatures are generic and can be used for additional purposes. Notation is an implementation of the [Notary V2 specifications][notaryv2-specs].
+Notation is a CLI project to add signatures as standard items in the registry ecosystem, and to build a set of simple tooling for signing and verifying these signatures. This should be viewed as similar security to checking git commit signatures, although the signatures are generic and can be used for additional purposes. Notation is an implementation of the [Notary V2 specifications][notaryv2-specs].
 
 ## Table of Contents
 
@@ -19,7 +19,7 @@ Notation is a project to add signatures as standard items in the registry ecosys
 
 - Install the Notation CLI from [Notation Releases][notation-releases]
     ```bash
-    curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/v0.9.0-alpha.1/notation_0.9.0-alpha.1_linux_amd64.tar.gz
+    curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/download/v0.10.0-alpha.3/notation_0.10.0-alpha.3_linux_amd64.tar.gz
     tar xvzf notation.tar.gz -C ~/bin notation
     ```
 - Run a local instance of the [CNCF Distribution Registry][cncf-distribution], with [ORAS Artifacts][artifact-manifest] support.
@@ -41,18 +41,28 @@ Notation is a project to add signatures as standard items in the registry ecosys
 
 Signatures are persisted as [ORAS Artifacts manifests][artifact-manifest].
 
-For more detailed samples, see [hello-signing](docs/hello-signing.md)
 
-## Core Documents
+## Documents
+
+- [Hello World for Notation: Local signing and verification](docs/hello-signing.md)
+- [Build, sign, and verify container images using Notary and Azure Key Vault](https://docs.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push)
 
-- [Governance for Notation](https://github.com/notaryproject/notary/blob/master/GOVERNANCE.md)
-- [Maintainers and reviewers list](https://github.com/notaryproject/notary/blob/master/MAINTAINERS)
 
 ## Community
 
+### Development and Contributing
+
+- [Build Notation from source code](/building.md)
+- [Governance for Notation](https://github.com/notaryproject/notary/blob/master/GOVERNANCE.md)
+- [Maintainers and reviewers list](https://github.com/notaryproject/notary/blob/master/MAINTAINERS)
 - Regular conversations for Notation occur on the [Cloud Native Computing Slack](https://slack.cncf.io/) **notary-v2** channel.
-- Please see the [CNCF Calendar](https://www.cncf.io/calendar/) for community meeting details.
-- Meeting notes are captured on [hackmd.io](https://hackmd.io/_vrqBGAOSUC_VWvFzWruZw).
+
+### Notary v2 Community Meeting
+
+- Mondays 5-6pm pacific time, 8-9pm US Eastern, 8-9am Shanghai
+- Thursdays 9-10am pacific time, 12pm US Eastern, 5pm UK
+
+Join us at [Zoom Dial-in link](https://zoom.us/my/cncfnotaryproject) / Passcode: 77777. Please see the [CNCF Calendar](https://www.cncf.io/calendar/) for community meeting details. Meeting notes are captured on [hackmd.io](https://hackmd.io/_vrqBGAOSUC_VWvFzWruZw).
 
 ## Release Management
 
@@ -70,7 +80,7 @@ This project has adopted the [CNCF Code of Conduct](https://github.com/cncf/foun
 
 This project is covered under the Apache 2.0 license. You can read the license [here](LICENSE).
 
-[notation-releases]:      https://github.com/notaryproject/notation/releases
-[notaryv2-specs]:         https://github.com/notaryproject/notaryproject
-[artifact-manifest]:      https://github.com/oras-project/artifacts-spec/blob/main/artifact-manifest.md
-[cncf-distribution]:      https://github.com/oras-project/distribution
+[Notation Releases]:      https://github.com/notaryproject/notation/releases
+[Notary v2 Specs]:         https://github.com/notaryproject/notaryproject
+[ORAS artifact-manifest]:      https://github.com/oras-project/artifacts-spec/blob/main/artifact-manifest.md
+[CNCF Distribution]:      https://github.com/oras-project/distribution
diff --git a/cmd/notation/cert.go b/cmd/notation/cert.go
index 7cb92cd..510cc20 100644
--- a/cmd/notation/cert.go
+++ b/cmd/notation/cert.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"time"
 
 	"github.com/notaryproject/notation-core-go/x509"
 	"github.com/notaryproject/notation-go/config"
@@ -27,7 +26,6 @@ type certRemoveOpts struct {
 type certGenerateTestOpts struct {
 	name      string
 	bits      int
-	expiry    time.Duration
 	trust     bool
 	hosts     []string
 	isDefault bool
@@ -119,7 +117,6 @@ func certGenerateTestCommand(opts *certGenerateTestOpts) *cobra.Command {
 
 	command.Flags().StringVarP(&opts.name, "name", "n", "", "key and certificate name")
 	command.Flags().IntVarP(&opts.bits, "bits", "b", 2048, "RSA key bits")
-	command.Flags().DurationVarP(&opts.expiry, "expiry", "e", 365*24*time.Hour, "certificate expiry")
 	command.Flags().BoolVar(&opts.trust, "trust", false, "add the generated certificate to the verification list")
 	setKeyDefaultFlag(command.Flags(), &opts.isDefault)
 	return command
diff --git a/specs/directory.md b/specs/directory.md
index 074b1cc..461f142 100644
--- a/specs/directory.md
+++ b/specs/directory.md
@@ -16,12 +16,12 @@ This documentation specifies the recommended directory structure for those compo
 
 The directories for various components are classified into the following catagories.
 
-| Alias     | Description                                                                         |
-| --------- | ----------------------------------------------------------------------------------- |
-| `BIN`     | Directory for executable binaries                                                   |
-| `LIBEXEC` | Directory for binaries not meant to be executed directly by users' shell or scripts |
-| `CONFIG`  | Directory for configurations                                                        |
-| `CACHE`   | Directory for user-specific cache                                                   |
+| Alias              | Description                                                                         |
+| ------------------ | ----------------------------------------------------------------------------------- |
+| `NOTATION_BIN`     | Directory for executable binaries                                                   |
+| `NOTATION_LIBEXEC` | Directory for binaries not meant to be executed directly by users' shell or scripts |
+| `NOTATION_CONFIG`  | Directory for configurations                                                        |
+| `NOTATION_CACHE`   | Directory for user-specific cache                                                   |
 
 Although it is recommended to install `notation` with its plugins and default configurations at the system level, it is possible to install at the user level.
 
@@ -31,59 +31,56 @@ On Unix systems, `notation` follows [Filesystem Hierarchy Standard][FHS] for sys
 
 Default directory paths for various operating systems at system level are specified as below.
 
-| Directory | Unix           | Windows                       | Darwin                         |
-| --------- | -------------- | ----------------------------- | ------------------------------ |
-| `BIN`     | `/usr/bin`     | `%ProgramFiles%/notation/bin` | `/usr/local/bin`               |
-| `LIBEXEC` | `/usr/libexec` | `%ProgramFiles%`              | `/usr/local/lib`               |
-| `CONFIG`  | `/etc`         | `%ProgramData%`               | `/Library/Application Support` |
+| Directory          | Unix                    | Windows                       | Darwin                                  |
+| ------------------ | ----------------------- | ----------------------------- | --------------------------------------- |
+| `NOTATION_BIN`     | `/usr/bin`              | `%ProgramFiles%/notation/bin` | `/usr/local/bin`                        |
+| `NOTATION_LIBEXEC` | `/usr/libexec/notation` | `%ProgramFiles%/notation`     | `/usr/local/lib/notation`               |
+| `NOTATION_CONFIG`  | `/etc/notation`         | `%ProgramData%/notation`      | `/Library/Application Support/notation` |
 
-`CACHE` is omitted since it is user specific.
+`NOTATION_CACHE` is omitted since it is user specific.
 
 ### User Level
 
 Default directory paths for various operating systems at user level are specified as below.
 
-| Directory | Unix               | Windows          | Darwin                          |
-| --------- | ------------------ | ---------------- | ------------------------------- |
-| `LIBEXEC` | `$XDG_CONFIG_HOME` | `%AppData%`      | `~/Library/Application Support` |
-| `CONFIG`  | `$XDG_CONFIG_HOME` | `%AppData%`      | `~/Library/Application Support` |
-| `CACHE`   | `$XDG_CACHE_HOME`  | `%LocalAppData%` | `~/Library/Caches`              |
+| Directory          | Unix                        | Windows                   | Darwin                                   |
+| ------------------ | --------------------------- | ------------------------- | ---------------------------------------- |
+| `NOTATION_LIBEXEC` | `$XDG_CONFIG_HOME/notation` | `%AppData%/notation`      | `~/Library/Application Support/notation` |
+| `NOTATION_CONFIG`  | `$XDG_CONFIG_HOME/notation` | `%AppData%/notation`      | `~/Library/Application Support/notation` |
+| `NOTATION_CACHE`   | `$XDG_CACHE_HOME/notation`  | `%LocalAppData%/notation` | `~/Library/Caches/notation`              |
 
 On Unix, `$XDG_CONFIG_HOME` is default to `~/.config` and `$XDG_CACHE_HOME` is default to `~/.cache` if XDG environment variables are empty.
 
-There is no default `BIN` path at user level since the `notation` binary can be put anywhere as long as it in the `PATH` environment variable. Common directories on Unix/Darwin are `~/bin` and `~/.local/bin` where manual `PATH` update by users may be required.
+There is no default `NOTATION_BIN` path at user level since the `notation` binary can be put anywhere as long as it in the `PATH` environment variable. Common directories on Unix/Darwin are `~/bin` and `~/.local/bin` where manual `PATH` update by users may be required.
 
 ## Structure
 
 The overall directory structure for `notation` is summarized as follows.
 
 ```
-{BIN}
+{NOTATION_BIN}
 └── notation
-{CACHE}
-└── notation
-    └── signatures
-        └── {manifest-digest-algorithm}
-            └── {manifest-digest}
-                └── {signature-blob-digest-algorithm}
-                    └── {signature-digest}.sig
-{CONFIG}
-└── notation
-    ├── config.json
-    ├── localkeys
-    │   ├── {key-name}.crt
-    │   └── {key-name}.pem
-    ├── signingkeys.json
-    ├── trustpolicy.json
-    └── truststore
-        └── {trust-store-type}
-            └── {named-store}
-                └── {cert-file}
-{LIBEXEC}
-└── notation
-    └── plugins
-        └── {plugin-name}
-            └── notation-{plugin-name}
+{NOTATION_CACHE}
+└── signatures
+    └── {manifest-digest-algorithm}
+        └── {manifest-digest}
+            └── {signature-blob-digest-algorithm}
+                └── {signature-digest}.sig
+{NOTATION_CONFIG}
+├── config.json
+├── localkeys
+│   ├── {key-name}.crt
+│   └── {key-name}.pem
+├── signingkeys.json
+├── trustpolicy.json
+└── truststore
+    └── {trust-store-type}
+        └── {named-store}
+            └── {cert-file}
+{NOTATION_LIBEXEC}
+└── plugins
+    └── {plugin-name}
+        └── notation-{plugin-name}
 ```
 
 ### Notation Binary
@@ -91,13 +88,13 @@ The overall directory structure for `notation` is summarized as follows.
 The path for the `notation` binary is
 
 ```
-{BIN}/notation
+{NOTATION_BIN}/notation
 ```
 
 On Windows, the `.exe` extension is required for executables.
 
 ```
-{BIN}/notation.exe
+{NOTATION_BIN}/notation.exe
 ```
 
 ### Plugin
@@ -105,13 +102,13 @@ On Windows, the `.exe` extension is required for executables.
 [Plugins][Plugin] are binaries not meant to be executed directly by users' shell or scripts. The path of a plugin follows the pattern below.
 
 ```
-{LIBEXEC}/notation/plugins/{plugin-name}/notation-{plugin-name}
+{NOTATION_LIBEXEC}/plugins/{plugin-name}/notation-{plugin-name}
 ```
 
 On Windows, the `.exe` extension is required for executables.
 
 ```
-{LIBEXEC}/notation/plugins/{plugin-name}/notation-{plugin-name}.exe
+{NOTATION_LIBEXEC}/plugins/{plugin-name}/notation-{plugin-name}.exe
 ```
 
 ### General Configuration
@@ -119,7 +116,7 @@ On Windows, the `.exe` extension is required for executables.
 The path of the general configuration file of the `notation` CLI is
 
 ```
-{CONFIG}/notation/config.json
+{NOTATION_CONFIG}/config.json
 ```
 
 ### Trust Store
@@ -127,7 +124,7 @@ The path of the general configuration file of the `notation` CLI is
 The path of a certificate file in a [Trust Store][TS] follows the pattern of
 
 ```
-{CONFIG}/notation/truststore/{trust-store-type}/{named-store}/{cert-file}
+{NOTATION_CONFIG}/truststore/{trust-store-type}/{named-store}/{cert-file}
 ```
 
 ### Trust Policy
@@ -135,7 +132,7 @@ The path of a certificate file in a [Trust Store][TS] follows the pattern of
 The path of the [Trust Policy][TP] file is
 
 ```
-{CONFIG}/notation/trustpolicy.json
+{NOTATION_CONFIG}/trustpolicy.json
 ```
 
 ### Signature Caches
@@ -143,19 +140,18 @@ The path of the [Trust Policy][TP] file is
 The signatures are cached to optimize the network traffic. The path of cached signatures for a certain target manifest (e.g. an image manifest) follows the pattern below.
 
 ```
-{CACHE}/notation/signatures/{manifest-digest-algorithm}/{manifest-digest}/{signature-blob-digest-algorithm}/{signature-digest}.sig
+{NOTATION_CACHE}/signatures/{manifest-digest-algorithm}/{manifest-digest}/{signature-blob-digest-algorithm}/{signature-digest}.sig
 ```
 
 or in a hierarchical view
 
 ```
-{CACHE}
-└── notation
-    └── signatures
-        └── {manifest-digest-algorithm}
-            └── {manifest-digest}
-                └── {signature-blob-digest-algorithm}
-                    └── {signature-digest}.sig
+{NOTATION_CACHE}
+└── signatures
+    └── {manifest-digest-algorithm}
+        └── {manifest-digest}
+            └── {signature-blob-digest-algorithm}
+                └── {signature-digest}.sig
 ```
 
 ### Signing Key Store
@@ -163,16 +159,16 @@ or in a hierarchical view
 Developers sign artifacts using local private keys with associated certificate chain. The signing key information is tracked in a JSON file at
 
 ```
-{CONFIG}/notation/signingkeys.json
+{NOTATION_CONFIG}/signingkeys.json
 ```
 
-Since the signing key store is user-specific, the system level `{CONFIG}` is not recommended. Developers SHOULD consider safe places to store the passphrase-protected key and certificate pairs, or opt to remote signing.
+Since the signing key store is user-specific, the system level `{NOTATION_CONFIG}` is not recommended. Developers SHOULD consider safe places to store the passphrase-protected key and certificate pairs, or opt to remote signing.
 
 For testing purpose, the following directory structure is suggested.
 
 ```
-{CONFIG}/notation/localkeys/{key-name}.crt
-{CONFIG}/notation/localkeys/{key-name}.pem
+{NOTATION_CONFIG}/localkeys/{key-name}.crt
+{NOTATION_CONFIG}/localkeys/{key-name}.pem
 ```
 
 Since `signingkeys.json` takes references in absolute paths, it is not required to copy the private keys and certificates used for signing to the above directory structure.


Test patch:
diff --git a/cmd/notation/cert_test.go b/cmd/notation/cert_test.go
index fb468a6..50c2b7e 100644
--- a/cmd/notation/cert_test.go
+++ b/cmd/notation/cert_test.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"reflect"
 	"testing"
-	"time"
 )
 
 func TestCertAddCommand_BasicArgs(t *testing.T) {
@@ -64,7 +63,7 @@ func TestCertRemoveCommand_MissingArgs(t *testing.T) {
 	}
 }
 
-func TestCertGenerateCommand_WithExpiry(t *testing.T) {
+func TestCertGenerateCommand(t *testing.T) {
 	opts := &certGenerateTestOpts{}
 	cmd := certGenerateTestCommand(opts)
 	expected := &certGenerateTestOpts{
@@ -72,7 +71,6 @@ func TestCertGenerateCommand_WithExpiry(t *testing.T) {
 		name:      "name",
 		bits:      2048,
 		isDefault: true,
-		expiry:    365 * 24 * time.Hour,
 	}
 	if err := cmd.ParseFlags([]string{
 		"host0", "host1",