Blob signing introduced by notaryproject/specifications#283 is slightly different from the OCI artifact signing. In summary, blob signing has the same signing / verification core as OCI artifact signing where the digest algorithm in the notary-project specific descriptor is restricted to the signing / verification key.

It is natural to share the same Signer interface with both OCI artifact and blob signing and add a new option IsBlob in SignerSignOptions (and VerifierVerifyOptions for Verifier) since the signing core is the notary-project specific descriptor. However, this solution is vulnerable for those existing implementations (if any) don't support blob signing / verification. Precisely, the IsBlob option may be dropped by those implementations unintentionally where a blob may be verified as an artifact although IsBlob is set to true, which produces unexpected results. Therefore, it is better to split it to two different interfaces as this PR does. In notation-go/v2, maybe we can combine the signing cores into a single one.

To elaborate a bit, we need the following new stuffs for signing

type BlobSigner interface {
    SignBlob(ctx context.Context, desc ocispec.Descriptor, opts SignerSignOptions) ([]byte, *signature.SignerInfo, error)
    BlobDigestAlgorithm(ctx context.Context) (digest.Algorithm, error)
}

type SignBlobOptions struct {
    SignerSignOptions

    ContentMediaType string
    UserMetadata map[string]string
}

func SignBlob(ctx context.Context, signer BlobSigner, reader io.Reader, signOpts SignBlobOptions) ([]byte, error)

The BlobSigner.SignBlob does not take a reader since notation-go, as a library, it should provide flexibility where the digest of a huge blob is generated by other component efficiently. The BlobSigner.SignBlob implementation can later check if the digest algorithm matches the signing key or not and reject if not.

The SignBlob is more like a utility function of BlobSigner.SignBlob where it takes a reader to compute the digest using the algorithm specified by BlobSigner.BlobDigestAlgorithm() backed by the signing key.

/cc @Two-Hearts

LGTM

LGTM

LGTM