Related issue: https://github.com/notaryproject/notation/issues/741#issuecomment-1644323623
PoC: https://github.com/Two-Hearts/notation/releases/tag/v1.0.0-arbitraryFile

### Sign:
A signer wants to sign an arbitrary file and store the signature file in the same file system as the signed file:

notation sign --signature-format <jws/cose> --file hello.txt --signature hello.sig

Note, the signature signs the content of the file (i.e., the file blob).

Later on, the signer would like to distribute the signed file and the signature to a verifier. There are two ways of doing so:
1. Through media other than OCI compliant registry. For example, a webpage or even by email.
2. Through OCI compliant registry. The signer pushes the file to the registry then attach the signature to it, this can be done by tools like oras:

    oras push <myRegistry>/<myRepo> hello.txt
    oras attach <myRegistry>/<myRepo>@<digest> --artifact-type 'application/vnd.cncf.notary.signature' hello.sig:application/cose -a "io.cncf.notary.x509chain.thumbprint#S256=[abcdef]"

Note: as a follow up, Notation should introduce `notation push` command, so that users won't rely on tools like `oras attach` in the future.

### Verify:
1. If the signer chose a media other than OCI compliant registry, such as webpage or email. A verifier needs to download the file and the signature to their file system first. Then:

    notation verify --file --signature hello.sig hello.txt --scope <local>/<myFile>

Note the `--file` flag tells Notation to verify hello.sig against a file blob. The `--signature` flag specifies the path of the signature. The `--scope` is the trust policy scope, it's required in this scenario.

The whole workflow of this scenario is thus:

    notation sign --file hello.txt --output hello.sig

    notation verify --file --signature hello.sig hello.txt --scope <local>/<myFile>

2. If the signer chose an OCI compliant registry to distribute the file and the signature, then the verifier needs the reference of the file artifact:

    notation verify --file <myRegistry>/<myRepo>@<digest>

Note the `--file` flag tells Notation that the signature attached to the target artifact signed the blob of the artifact instead of its manifest descriptor.
For your reference, discussion we had earlier about adding <type> flags when verifying a file: https://github.com/notaryproject/notation/pull/601#discussion_r1150810148. (oras is following the same pattern)

The whole workflow of this scenario is thus:

    notation sign --file hello.txt --output hello.sig
    oras push <myRegistry>/<myRepo> hello.txt
    oras attach <myRegistry>/<myRepo>@<digest> --artifact-type 'application/vnd.cncf.notary.signature' hello.sig:application/cose -a "io.cncf.notary.x509chain.thumbprint#S256=[abcdef]"
    notation verify --file <myRegistry>/<myRepo>@<digest>

(Note: `oras attach` can be replaced by `notation push` in the future.)

------
## Sign pre-calculated hashes (Pritesh)
Solutions to sign a big file

### Solution 1 (Undesirable CX)
* BuildServer (BigFile1 in Gbs) -> Copy file to SignServer
* SignServer (BigFile1) -> Signs file

---
### Solution 2 (Best possible CX)
#### Sign
* BuildServer (BigFile1) -> Calculate SHA384 Hash -> Send this hash to SignServer
* SignServer (SHA384 Hash) -> Notation sign's Hash (notation doesnt rehashes)
* Build Server combines signature to bigFile -> .zip

openssl dgst -sha385 BigFile.txt => hash
notation sign-digest "${hash}" --output hello.sig

#### Verify
Download BigFile1 -> Call notation with bigfile and signature

notation verify --file bigFile --signature hello.sig

---

### Solution 3 (sub optimal CX)
#### Sign
* BuildServer (BigFile1) -> Calculate SHA384 -> Send this hash to SignServer
* SignServer (SHA384 hash) -> Notation signs content (notation rehashes hash)

openssl dgst -sha385 BigFile.txt => hash
notation sign --file "${hash}" --output hello.sig

#### Verify
* Download BigFile1 -> recalculate hash using openssl
* Call notation with hash and signature

openssl dgst -sha385 BigFile.txt
notation verify --file ${fileContainingHash} --signature hello.sig