notation login CLI

[SteveLasker]

Updates for #119
Signed-off-by: Steve Lasker [email protected]

[shizhMSFT]

/cc @binbin-li for comments

[shizhMSFT]

LGTM with suggestions.

[shizhMSFT]

How about environment variables associated with -u and -p like NOTATION_USERNAME and NOTATION_PASSWORD?

[gokarnm]

Suggested change

	--username value, -u value Username for registry operations
	--password value, -p value Password for registry operations
	--username value, -u value Username for registry authentication
	--password value, -p value Password for registry authentication

[gokarnm]

Should we also support --password-stdin like docker cli does?

[SteveLasker]

For operations vs. authentication, I was thinking saying authentication was too obvious, and used the more generic, the -u/-p was used for multiple registry operations. If others feel different, I can change to either way.

[shizhMSFT]

It seems we only support basic configurations. Will we support more parameters like --insecure and --ca-file as oras?

[gokarnm]

@shizhMSFT, what is --insecure used for, and how common is the usage for --ca-file (I assume provides custom TLS trust store).

[shizhMSFT]

--insecure is to skip the TLS cert check. Since notation is security oriented, we should not provide this functionality.

--ca-file is to specify the root CA cert to registry access. See oras-project/oras#217

[SteveLasker]

@shizhMSFT, I was thinking this would be done with the insecure registries option in config.
Does that still exist?
Seems calling --insecure is too tedious. For the scenarios/instances where https isn't supported, such as IOT environments, I just assumed the config would solve the problem and not something that's done ad-hoc requiring the cli to support it.

[gokarnm]

LGTM with suggestions.

[gokarnm]

Suggested change

	notation login - Provides credentials for authenticated registry operations
	notation login - Login to a registry with credentials for authenticated registry operations

[gokarnm]

Suggested change

	login Provide credentials for authenticated registry operations
	login Login to a registry with credentials for authenticated registry operations

[SteveLasker]

Saying login, where the parameter says login feels redundant. I was just trying to find a synonym verb.

[gokarnm]

Suggested change

	--username value, -u value Username for registry operations
	--password value, -p value Password for registry operations
	--username value, -u value Username for registry authentication
	--password value, -p value Password for registry authentication

[gokarnm]

Should we also support --password-stdin like docker cli does?

[gokarnm]

@shizhMSFT, what is --insecure used for, and how common is the usage for --ca-file (I assume provides custom TLS trust store).

[SteveLasker]

I've updated the PR to:

• add $NOTATION_USERNAME, $NOTATION_PASSWORD on notation login
• Removed -u -p from other commands, streamlinging so users can benefit from existing cred stores, not having to provide -u -p on every command. This is similar to docker push|pull where the user either does docker login, or benefits from a previously configured store.