Notary User Stories Discussion

[FeynmanZhou]

The notary community is discussing the user stores of RC.1 and future releases. The following table just lists the user stories of RC.1. We are open to any significant user stories from end-users and cloud providers, please leave your comments to share your proposal below.

Category	Summary	CLI
Signing artifacts	US#1: As a signer, I want to remote sign remote artifacts stored in registries, so that the integrity of the artifacts is ensured as artifacts are pulled and promoted across environments. Note: signing with local key, but only for remote artifacts. Not signing local artifacts.	notation sign
Verifying artifacts	US#2: As a verifier, I want to verify remote artifact integrity with remote signatures using my local trust policy and store. Note: verify with local key, verify remote artifacts. Verify local artifacts out of scope RC-1.	notation verify
Signing and verifying Extensibility	US#3: As a signer, I want to use an extensible plugin to sign the artifacts; US#4: As a verifier, I want to use an extensible plugin to verify signed artifacts	/
Plugin management	US#5: As a user, I want to list the plugin(s) so that I can view the installed plugin(s); US#6: As a user, I want to install/uninstall the plugin(s) so that I can manage the plugin(s) lifecycle (not in RC-1 scope, can uninstall via manually removing file/folder where plugin exists)	notation list
Signature operation	US#7: As a user, I want to push signatures into the remote registry, using tag or digest references (Note: Push past RC-1, since notation sign does push);	notation push
Signature operation	US#8: As a user, I want to pull signatures from remote registry (Note: Pull past RC-1, since notation verify does pull)	notation pull
Signature operation	US#9: As a user, I want to list signatures from remote registry	notation list
Signature operation	US#10: As a user, I want to inspect signatures	notation inspect
Key and Cert management	US#11: As a user, I want to add/update/list/delete keys	notation key
Key and Cert management	US#12: As a user, I want to add/delete/list certificates. Note: consider out of scope for RC-1 because needs integration with trust store work?	notation cert
Trust policy and Trust store management	US#13: As a user, I want to configure trust policy and trust store so that I can authenticate signed artifacts. Note: CLI based experience is out of scope, the trust store / policy itself will be there and configurable in filesystem. Need to manually add what you trust. Desire – make usability reasonable even in RC1.	/