fix: add digest check for Sign

[byronchien]

This PR adds digest check on Sign.

Signed-off-by: Byron Chien byronc@ucla.edu
Co-authored-by: Patrick Zheng patrickzheng@microsoft.com

[codecov-commenter]

Codecov Report

Merging #317 (c54ea8d) into main (c3f8c33) will increase coverage by 0.02%.
The diff coverage is 100.00%.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

@@            Coverage Diff             @@
##             main     #317      +/-   ##
==========================================
+ Coverage   74.78%   74.80%   +0.02%     
==========================================
  Files          23       23              
  Lines        2177     2179       +2     
==========================================
+ Hits         1628     1630       +2     
  Misses        433      433              
  Partials      116      116              

Impacted Files	Coverage Δ
notation.go	64.81% <100.00%> (+0.32%)	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[priteshbandi]

LGTM

[Two-Hearts]

After running through a test workflow from Notation CLI, I found this change is not quite correct.
To reproduce: run command notation sign <reg>/<repo>@sha256:b6ca290b6b4cdcca5b3db3ffa338ee0285c11744b4a6abaa9627746ee3291d8d -v
The notation-go logic still sees the above digest as a tag and prints out the warning Always sign the artifact using digest....

The reason causing this issue: notation CLI will always set signOpts.ArtifactReference as a digest and pass it to notation-go, related code: https://github.com/notaryproject/notation/blob/a695b60ed2b0d9a173724c23b5f2c0dd04558f3e/cmd/notation/sign.go#L133.
Thus, in notation-go, given the input is from Notation CLI, ref, err := orasRegistry.ParseReference(artifactRef) would always return non-nil error with EMPTY ref (this code is valid because non-CLI users might choose to pass a full reference to notation-go).
Then, the new change in this PR if ref.ValidateReferenceAsDigest() != nil will always be evaluated to true, as long as the caller is notation CLI.
/cc: @priteshbandi @JeyJeyGao @shizhMSFT

[Two-Hearts]

Based on our discussion offline, fixed the logic in this PR as asked by @priteshbandi. /cc: @byronchien

[priteshbandi]

LGTM

[JeyJeyGao]

LGTM

[shizhMSFT]

LGTM