Notary V1 Integration

[djoyahoy]

This PR integrates with Notary for image singing. The following explains the singing process:

1. notary init example.registry.io/my-app generates/encrypts the root, targets, and snapshot private keys. The targets key will be used for singing new image tags.
2. notary key rotate example.registry.io/my-app snapshot -r rotates the snapshot key to the server so that it is not managed locally. This is the default behavior of the docker CLI when signing images.
3. notary publish example.registry.io/my-app publishes local changes to the Notary server.
4. kubectl create secret generic notary-secret --from-literal=password=<password> --from-file=$HOME/.notary/private/<targets-hash>.key create a k8s secret with the targets private key and the password used to decrypt the key.
5. Create an image config that references the notary secret and the notary server URL.
6. After export, the completion container uploads the image tag, manifest digest, manifest size to the Notary server. It verifies the content using the private targets key. Registry secrets are used to authenticate with the Notary server as Notary traditionally uses the same auth method as the registry (see here and here).
7. docker CLI users with docker content trust enabled will connect to the Notary server when pulling images to validate their authenticity. This simply validates that the manifest digest is correct (as it is a cryptographic hash function).

[matthewmcnew]

This is really good PR and really does a good job of implementing the notary integration without unnecessary complexity. The exact mechanics/terminology of how notary signs images is still a bit murky for me. Could you walk through that again at somepoint?

[djoyahoy]

This is really good PR and really does a good job of implementing the notary integration without unnecessary complexity. The exact mechanics/terminology of how notary signs images is still a bit murky for me. Could you walk through that again at somepoint?

Sounds good. I'll create a summary in the PR description.

[tylerphelan]

Should we have image and/or build validation for notary config? (must all fields not empty, maybe check that notary secret exists, maybe check url is valid url)

Also maybe run a goimports